High level conclusions

Fuzzers reach 83.47% of cyclomatic complexity.

Fuzzers reach 80.06% of all functions.

Fuzzers reach 80.95% code coverage.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 16.66% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.022% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

723 / 903

Cyclomatic complexity statically reachable by fuzzers

7732 / 9263

Runtime code coverage of functions

731 / 903

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	155	18.4%
gold	[1:9]	72	8.56%
yellow	[10:29]	37	4.39%
greenyellow	[30:49]	28	3.32%
lawngreen	50+	549	65.2%
All colors	841	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	107	2 : View List ['_dwarf_error_string', 'free']	0	107	_dwarf_internal_read_rnglists_header	call site: 00716	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:555
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00244	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1339

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

32

Reachable functions

228

Percentage of reachable functions covered

85.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	4
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	16.9%
gold	[1:9]	45	6.30%
yellow	[10:29]	18	2.52%
greenyellow	[30:49]	28	3.92%
lawngreen	50+	502	70.3%
All colors	714	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00244	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1339
0	8	1 : View List ['_dwarf_error_destructor']	0	8	dwarf_dealloc	call site: 00187	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1057

Runtime coverage analysis

Covered functions

211

Functions that are reachable but not covered

30

Reachable functions

212

Percentage of reachable functions covered

85.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	129	18.5%
gold	[1:9]	50	7.18%
yellow	[10:29]	33	4.74%
greenyellow	[30:49]	23	3.30%
lawngreen	50+	461	66.2%
All colors	696	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['calloc', 'dwarfstring_constructor', '_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_destructor', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00521	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

39

Reachable functions

206

Percentage of reachable functions covered

81.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1187	98.0%
gold	[1:9]	23	1.89%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.08%
All colors	1211	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2335	2549	5 : View List ['_dwarf_calculate_info_section_end_ptr', '_dwarf_look_in_local_and_tied', '_dwarf_error_string', 'dwarf_addr_form_is_indexed', 'generate_form_error']	2335	2549	dwarf_formaddr	call site: 01044	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1310
62	62	1 : View List ['_dwarf_get_alloc']	62	62	_dwarf_error_string	call site: 00024	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:193
29	29	5 : View List ['calloc', 'dwarfstring_constructor', '_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append']	91	91	_dwarf_error_string	call site: 00008	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
0	0	None	126	126	dwarf_dealloc	call site: 00054	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:959
0	0	None	0	323	get_attr_dbg	call site: 00739	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:113
0	0	None	0	0	dwarf_errmsg_by_number	call site: 00030	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:225

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

208

Reachable functions

219

Percentage of reachable functions covered

5.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	117	18.4%
gold	[1:9]	19	2.99%
yellow	[10:29]	31	4.88%
greenyellow	[30:49]	28	4.41%
lawngreen	50+	439	69.2%
All colors	634	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['calloc', 'dwarfstring_constructor', '_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280

Runtime coverage analysis

Covered functions

188

Functions that are reachable but not covered

39

Reachable functions

202

Percentage of reachable functions covered

80.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.7%
gold	[1:9]	12	1.87%
yellow	[10:29]	36	5.63%
greenyellow	[30:49]	35	5.47%
lawngreen	50+	436	68.2%
All colors	639	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['calloc', 'dwarfstring_constructor', '_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

39

Reachable functions

203

Percentage of reachable functions covered

80.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	165	18.8%
gold	[1:9]	17	1.94%
yellow	[10:29]	15	1.71%
greenyellow	[30:49]	15	1.71%
lawngreen	50+	662	75.7%
All colors	874	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
156	1476	7 : View List ['free', 'dwarf_finish', 'dwarf_gnu_debuglink', 'dwarf_crc32', 'match_buildid', 'dwarfstring_append', '_dwarf_get_suppress_debuglink_crc']	156	1791	_dwarf_debuglink_finder_newpath	call site: 00352	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:736
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00673	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00086	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00036	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00108	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	171	5 : View List ['dwarfstring_string', '_dwarf_error_string', 'dwarfstring_constructor', 'dwarfstring_destructor', 'dwarfstring_append_printf_u']	0	171	_dwarf_extract_buildid	call site: 00210	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:914
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00734	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	85	2 : View List ['_dwarf_object_detector_fd_a', '_dwarf_closer']	0	85	dwarf_object_detector_path_dSYM	call site: 00048	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:638
0	17	1 : View List ['dwarfstring_append']	0	33	transform_leading_windowsletter	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:207
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00156	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1339

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

36

Reachable functions

241

Percentage of reachable functions covered

85.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	100.%
All colors	12	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	dwarf_basic_crc32	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_crc.c:137

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

10

Reachable functions

12

Percentage of reachable functions covered

16.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	515	30.8%
gold	[1:9]	148	8.85%
yellow	[10:29]	110	6.57%
greenyellow	[30:49]	65	3.88%
lawngreen	50+	834	49.8%
All colors	1672	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01645	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01474	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_string', 'dwarf_dealloc_error', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_destructor', 'dwarfstring_append']	24	309	_dwarf_internal_global_formref_b	call site: 01381	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	2093	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	4	4034	dwarf_offdie_b	call site: 01399	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3329
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

56

Reachable functions

348

Percentage of reachable functions covered

83.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	534	28.5%
gold	[1:9]	148	7.91%
yellow	[10:29]	121	6.47%
greenyellow	[30:49]	61	3.26%
lawngreen	50+	1006	53.7%
All colors	1870	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01645	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
64	64	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	66	162	dwarfstring_append_printf_i	call site: 01679	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_string', 'dwarf_dealloc_error', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_destructor', 'dwarfstring_append']	24	309	_dwarf_internal_global_formref_b	call site: 01381	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	2093	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	4	4034	dwarf_offdie_b	call site: 01399	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3329
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441

Runtime coverage analysis

Covered functions

356

Functions that are reachable but not covered

52

Reachable functions

378

Percentage of reachable functions covered

86.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	38
src/lib/libdwarf/dwarf_query.c	37
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	25
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	887	33.6%
gold	[1:9]	174	6.60%
yellow	[10:29]	120	4.55%
greenyellow	[30:49]	68	2.58%
lawngreen	50+	1386	52.5%
All colors	2635	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 01109	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
109	109	1 : View List ['dwarf_object_detector_path_dSYM']	109	7178	dwarf_init_path_dl_a	call site: 00035	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:311
64	64	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	66	162	dwarfstring_append_printf_i	call site: 01941	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00673	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00086	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00036	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00108	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	858	1 : View List ['_dwarf_siblingof_internal']	0	858	_dwarf_next_cu_header_internal	call site: 01031	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2168
0	333	3 : View List ['_dwarf_error_string', 'dwarf_dealloc_die', 'local_dealloc_cu_context']	0	333	_dwarf_create_a_new_cu_context_record_on_list	call site: 01106	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1937
0	330	2 : View List ['_dwarf_error_string', '_dwarf_check_string_valid']	0	330	_dwarf_decode_line_string_form	call site: 02188	/src/libdwarf/src/lib/libdwarf/dwarf_line.c:2390

Runtime coverage analysis

Covered functions

401

Functions that are reachable but not covered

78

Reachable functions

448

Percentage of reachable functions covered

82.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	35
src/lib/libdwarf/dwarf_query.c	28
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	27
src/lib/libdwarf/dwarf_line_table_reader_common.h	6

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	145	18.3%
gold	[1:9]	44	5.56%
yellow	[10:29]	22	2.78%
greenyellow	[30:49]	17	2.14%
lawngreen	50+	563	71.1%
All colors	791	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
35	35	1 : View List ['transform_leading_windowsletter']	35	426	_dwarf_construct_linkedto_path	call site: 00698	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:654
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['calloc', 'dwarfstring_constructor', '_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	2 : View List ['strlen', 'strdup']	4	4	dwarf_gnu_debuglink	call site: 00635	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:988
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481

Runtime coverage analysis

Covered functions

209

Functions that are reachable but not covered

41

Reachable functions

225

Percentage of reachable functions covered

81.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	117	18.4%
gold	[1:9]	16	2.51%
yellow	[10:29]	34	5.35%
greenyellow	[30:49]	25	3.93%
lawngreen	50+	443	69.7%
All colors	635	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['calloc', 'dwarfstring_constructor', '_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

38

Reachable functions

202

Percentage of reachable functions covered

81.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_e_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	510	30.2%
gold	[1:9]	161	9.55%
yellow	[10:29]	125	7.41%
greenyellow	[30:49]	30	1.78%
lawngreen	50+	859	50.9%
All colors	1685	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01387	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00872	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01649	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01478	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01386	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_string', 'dwarf_dealloc_error', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_destructor', 'dwarfstring_append']	24	309	_dwarf_internal_global_formref_b	call site: 01385	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562

Runtime coverage analysis

Covered functions

320

Functions that are reachable but not covered

56

Reachable functions

347

Percentage of reachable functions covered

83.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	350	39.0%
gold	[1:9]	24	2.67%
yellow	[10:29]	25	2.79%
greenyellow	[30:49]	21	2.34%
lawngreen	50+	476	53.1%
All colors	896	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
109	109	1 : View List ['dwarf_object_detector_path_dSYM']	109	7178	dwarf_init_path_dl_a	call site: 00035	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:311
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00673	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00082	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	132	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error']	10	426	dwarf_object_init_b	call site: 00749	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
10	29	5 : View List ['calloc', 'dwarfstring_constructor', '_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00036	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00013	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00108	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_destructor', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00756	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_sec_group_map	call site: 00888	/src/libdwarf/src/lib/libdwarf/dwarf_groups.c:294

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

72

Reachable functions

245

Percentage of reachable functions covered

70.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	484	29.1%
gold	[1:9]	127	7.64%
yellow	[10:29]	138	8.30%
greenyellow	[30:49]	48	2.88%
lawngreen	50+	864	52.0%
All colors	1661	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01645	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_string', 'dwarf_dealloc_error', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_destructor', 'dwarfstring_append']	24	309	_dwarf_internal_global_formref_b	call site: 01381	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441

Runtime coverage analysis

Covered functions

322

Functions that are reachable but not covered

52

Reachable functions

345

Percentage of reachable functions covered

84.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	110	17.0%
gold	[1:9]	24	3.72%
yellow	[10:29]	29	4.49%
greenyellow	[30:49]	11	1.70%
lawngreen	50+	471	73.0%
All colors	645	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

33

Reachable functions

204

Percentage of reachable functions covered

83.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	160	20.6%
gold	[1:9]	53	6.84%
yellow	[10:29]	43	5.55%
greenyellow	[30:49]	17	2.19%
lawngreen	50+	501	64.7%
All colors	774	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errno', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error']	115	426	dwarf_object_init_b	call site: 00513	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_error_destructor', '_dwarf_remove_from_staticerrlist']	13	60	dwarf_dealloc	call site: 00186	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['calloc', 'dwarfstring_constructor', '_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc', 'dwarfstring_append']	10	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	226	5 : View List ['dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_append_printf_u', 'dwarfstring_string', 'dwarfstring_destructor']	0	226	dwarf_get_rnglist_rle	call site: 00737	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:1023
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_destructor', 'dwarfstring_string']	0	114	dwarf_object_init_b	call site: 00521	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

37

Reachable functions

213

Percentage of reachable functions covered

82.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	10
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	618	28.4%
gold	[1:9]	232	10.6%
yellow	[10:29]	110	5.06%
greenyellow	[30:49]	70	3.22%
lawngreen	50+	1142	52.5%
All colors	2172	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01645	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01474	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	444	3 : View List ['memcmp', 'dwarf_get_xu_section_offset', 'dwarf_get_xu_hash_entry']	2	444	_dwarf_search_fission_for_offset	call site: 00977	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:1044
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	2093	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	4034	dwarf_offdie_b	call site: 01399	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3329

Runtime coverage analysis

Covered functions

373

Functions that are reachable but not covered

56

Reachable functions

397

Percentage of reachable functions covered

85.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	13
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	17.5%
gold	[1:9]	26	3.62%
yellow	[10:29]	33	4.59%
greenyellow	[30:49]	34	4.73%
lawngreen	50+	499	69.4%
All colors	718	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_culist_entry	call site: 00673	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:420
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_types_culist_entry	call site: 00679	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:497

Runtime coverage analysis

Covered functions

218

Functions that are reachable but not covered

31

Reachable functions

224

Percentage of reachable functions covered

86.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	147	17.3%
gold	[1:9]	77	9.06%
yellow	[10:29]	45	5.30%
greenyellow	[30:49]	18	2.12%
lawngreen	50+	562	66.1%
All colors	849	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	218	2 : View List ['free_aranges_chain', '_dwarf_error']	0	218	dwarf_get_aranges	call site: 00827	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:441
0	218	2 : View List ['free_aranges_chain', '_dwarf_error']	0	218	_dwarf_get_aranges_list	call site: 00821	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:381
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_arange_info_b	call site: 00831	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:698

Runtime coverage analysis

Covered functions

222

Functions that are reachable but not covered

31

Reachable functions

224

Percentage of reachable functions covered

86.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_die_cu_e

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	514	31.0%
gold	[1:9]	156	9.42%
yellow	[10:29]	99	5.97%
greenyellow	[30:49]	60	3.62%
lawngreen	50+	827	49.9%
All colors	1656	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01645	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_string', 'dwarf_dealloc_error', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_destructor', 'dwarfstring_append']	24	309	_dwarf_internal_global_formref_b	call site: 01381	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278

Runtime coverage analysis

Covered functions

318

Functions that are reachable but not covered

55

Reachable functions

344

Percentage of reachable functions covered

84.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	554	33.3%
gold	[1:9]	136	8.17%
yellow	[10:29]	120	7.21%
greenyellow	[30:49]	58	3.48%
lawngreen	50+	795	47.8%
All colors	1663	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
186	291	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01474	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_string', 'dwarf_dealloc_error', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_destructor', 'dwarfstring_append']	24	309	_dwarf_internal_global_formref_b	call site: 01381	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278

Runtime coverage analysis

Covered functions

312

Functions that are reachable but not covered

62

Reachable functions

345

Percentage of reachable functions covered

82.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	16.4%
gold	[1:9]	21	3.25%
yellow	[10:29]	20	3.09%
greenyellow	[30:49]	31	4.79%
lawngreen	50+	468	72.4%
All colors	646	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

32

Reachable functions

205

Percentage of reachable functions covered

84.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	265	19.6%
gold	[1:9]	47	3.48%
yellow	[10:29]	24	1.78%
greenyellow	[30:49]	42	3.11%
lawngreen	50+	970	71.9%
All colors	1348	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	115	2 : View List ['_dwarf_error_string', '_dwarf_skip_leb128']	8	224	_dwarf_get_gcc_eh_augmentation	call site: 00729	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1986
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	329	6 : View List ['dwarfstring_constructor', '_dwarf_error_string', 'dwarfstring_append_printf_u', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_dealloc']	0	332	_dwarf_exec_frame_instr	call site: 01154	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:1867
0	212	2 : View List ['dwarf_dealloc', '_dwarf_error']	0	212	_dwarf_create_cie_from_after_start	call site: 00766	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1057
0	212	2 : View List ['dwarf_dealloc', '_dwarf_error']	0	212	_dwarf_create_fde_from_after_start	call site: 00832	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1360

Runtime coverage analysis

Covered functions

282

Functions that are reachable but not covered

36

Reachable functions

285

Percentage of reachable functions covered

87.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	37
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	16.2%
gold	[1:9]	16	2.5%
yellow	[10:29]	34	5.31%
greenyellow	[30:49]	20	3.12%
lawngreen	50+	466	72.8%
All colors	640	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00015	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00500	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

34

Reachable functions

204

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	509	30.1%
gold	[1:9]	159	9.40%
yellow	[10:29]	93	5.50%
greenyellow	[30:49]	66	3.90%
lawngreen	50+	863	51.0%
All colors	1690	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01387	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00872	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01649	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01478	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01386	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00435	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_string', 'dwarf_dealloc_error', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_destructor', 'dwarfstring_append']	24	309	_dwarf_internal_global_formref_b	call site: 01385	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

56

Reachable functions

348

Percentage of reachable functions covered

83.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	828	38.2%
gold	[1:9]	209	9.64%
yellow	[10:29]	95	4.38%
greenyellow	[30:49]	84	3.87%
lawngreen	50+	950	43.8%
All colors	2166	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2109	2109	1 : View List ['cook_loclists_contents']	2109	2228	dwarf_get_loclist_c	call site: 02043	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1793
2103	2103	1 : View List ['cook_gnu_loclist_contents']	2103	2222	dwarf_get_loclist_c	call site: 01975	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1768
2089	2089	1 : View List ['_dwarf_search_for_signature']	3003	4085	_dwarf_loclists_fill_in_lle_head	call site: 02044	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1238
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
914	1033	6 : View List ['dwarfstring_constructor', 'build_array_of_lle', 'dwarfstring_append_printf_u', '_dwarf_which_loclists_context', 'dwarfstring_string', 'dwarfstring_destructor']	914	1675	_dwarf_loclists_fill_in_lle_head	call site: 02047	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1276
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
202	202	1 : View List ['_dwarf_get_loclist_lle_count_dwo']	400	1407	_dwarf_original_loclist_build	call site: 01696	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1065
186	291	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01474	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
70	203	6 : View List ['dwarfstring_string', '_dwarf_error_string', 'dwarfstring_constructor', '_dwarf_lkind_name', 'dwarfstring_destructor', 'dwarfstring_append']	70	203	_dwarf_loc_block_sanity_check	call site: 01786	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:458
70	203	6 : View List ['dwarfstring_string', '_dwarf_error_string', 'dwarfstring_constructor', '_dwarf_lkind_name', 'dwarfstring_destructor', 'dwarfstring_append']	70	203	_dwarf_loc_block_sanity_check	call site: 01797	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:473
66	66	3 : View List ['strlen', '_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	66	198	dwarfstring_append_printf_i	call site: 01920	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:523

Runtime coverage analysis

Covered functions

342

Functions that are reachable but not covered

83

Reachable functions

394

Percentage of reachable functions covered

78.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	27
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	24
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	24
src/lib/libdwarf/dwarf_locationop_read.c	2

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	18.2%
gold	[1:9]	29	3.58%
yellow	[10:29]	34	4.19%
greenyellow	[30:49]	37	4.56%
lawngreen	50+	562	69.3%
All colors	810	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	107	1 : View List ['_dwarf_error_string']	0	107	dwarf_dnames_sizes	call site: 00737	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:933

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

32

Reachable functions

228

Percentage of reachable functions covered

85.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	618	33.6%
gold	[1:9]	162	8.82%
yellow	[10:29]	154	8.39%
greenyellow	[30:49]	66	3.59%
lawngreen	50+	835	45.5%
All colors	1835	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
346	474	5 : View List ['dwarfstring_constructor', '_dwarf_read_encoded_ptr', 'dwarfstring_append_printf_u', 'dwarfstring_string', 'dwarfstring_destructor']	346	2943	_dwarf_create_fde_from_after_start	call site: 01694	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1115
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['_dwarf_read_str_offsets_header', 'dwarf_dealloc_error']	258	363	load_xu_str_offsets_into_cucontext	call site: 01645	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01474	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_die_offsets', 'dwarf_dealloc_die']	127	349	find_sig8_target_as_global_offset	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
109	109	1 : View List ['regerror']	109	109	_dwarf_validate_register_numbers	call site: 01676	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:169
24	309	7 : View List ['dwarf_errmsg', 'dwarfstring_string', 'dwarf_dealloc_error', '_dwarf_error_string', 'dwarfstring_constructor_fixed', 'dwarfstring_destructor', 'dwarfstring_append']	24	309	_dwarf_internal_global_formref_b	call site: 01381	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00413	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857

Runtime coverage analysis

Covered functions

326

Functions that are reachable but not covered

62

Reachable functions

358

Percentage of reachable functions covered

82.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	133	18.3%
gold	[1:9]	30	4.13%
yellow	[10:29]	38	5.23%
greenyellow	[30:49]	33	4.54%
lawngreen	50+	492	67.7%
All colors	726	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
64	64	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	66	162	dwarfstring_append_printf_i	call site: 00652	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:754
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00499	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

211

Functions that are reachable but not covered

31

Reachable functions

217

Percentage of reachable functions covered

85.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	774	28.5%
gold	[1:9]	212	7.83%
yellow	[10:29]	124	4.58%
greenyellow	[30:49]	55	2.03%
lawngreen	50+	1542	56.9%
All colors	2707	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00868	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
186	291	2 : View List ['_dwarf_trial_read_dwarf_five_hdr', 'dwarf_dealloc_error']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01474	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00190	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00254	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00173	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00582	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00623	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00195	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	2093	2 : View List ['_dwarf_calculate_next_cu_context_offset', '_dwarf_create_a_new_cu_context_record_on_list']	0	4034	dwarf_offdie_b	call site: 01399	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3329
0	858	1 : View List ['_dwarf_siblingof_internal']	0	858	_dwarf_next_cu_header_internal	call site: 00790	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2168
0	440	5 : View List ['_dwarf_error_string', 'dwarfstring_constructor', 'dwarfstring_append_printf_u', 'dwarfstring_string', 'dwarfstring_destructor']	0	440	_dwarf_extract_address_from_debug_addr	call site: 01582	/src/libdwarf/src/lib/libdwarf/dwarf_query.c:999

Runtime coverage analysis

Covered functions

390

Functions that are reachable but not covered

58

Reachable functions

417

Percentage of reachable functions covered

86.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	38
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	249	21.6%
gold	[1:9]	73	6.34%
yellow	[10:29]	49	4.25%
greenyellow	[30:49]	46	3.99%
lawngreen	50+	734	63.7%
All colors	1151	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
119	119	1 : View List ['get_hash_value_number']	119	1223	dwarf_dnames_name	call site: 00982	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1509
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['strcmp', 'dwarf_set_load_preference']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_dnames_entrypool	call site: 01016	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1670
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_globname	call site: 01110	/src/libdwarf/src/lib/libdwarf/dwarf_global.c:1325
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_global_die_offset	call site: 01113	/src/libdwarf/src/lib/libdwarf/dwarf_global.c:1348

Runtime coverage analysis

Covered functions

266

Functions that are reachable but not covered

35

Reachable functions

271

Percentage of reachable functions covered

87.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1