High level conclusions

Fuzzers reach 83.47% of cyclomatic complexity.

Fuzzers reach 80.06% of all functions.

Fuzzers reach 80.95% code coverage.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 15.38% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.022% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

723 / 903

Cyclomatic complexity statically reachable by fuzzers

7734 / 9265

Runtime code coverage of functions

731 / 903

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1189	98.0%
gold	[1:9]	23	1.89%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.08%
All colors	1213	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2335	2549	5 : View List ['_dwarf_error_string', 'dwarf_addr_form_is_indexed', '_dwarf_calculate_info_section_end_ptr', '_dwarf_look_in_local_and_tied', 'generate_form_error']	2335	2549	dwarf_formaddr	call site: 01046	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1310
62	62	1 : View List ['_dwarf_get_alloc']	62	62	_dwarf_error_string	call site: 00025	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:193
29	29	5 : View List ['dwarfstring_constructor', 'calloc', 'dwarfstring_append', '_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	91	91	_dwarf_error_string	call site: 00009	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
0	0	None	126	126	dwarf_dealloc	call site: 00055	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:959
0	0	None	0	323	get_attr_dbg	call site: 00741	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:113
0	0	None	0	0	dwarf_errmsg_by_number	call site: 00031	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:225

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

208

Reachable functions

219

Percentage of reachable functions covered

5.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	166	18.9%
gold	[1:9]	10	1.14%
yellow	[10:29]	28	3.2%
greenyellow	[30:49]	9	1.02%
lawngreen	50+	662	75.6%
All colors	875	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
156	1476	7 : View List ['dwarf_crc32', 'dwarfstring_append', 'match_buildid', 'free', '_dwarf_get_suppress_debuglink_crc', 'dwarf_finish', 'dwarf_gnu_debuglink']	156	1791	_dwarf_debuglink_finder_newpath	call site: 00353	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:736
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00674	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00087	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00037	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00109	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	171	5 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarfstring_append_printf_u', 'dwarfstring_constructor']	0	171	_dwarf_extract_buildid	call site: 00211	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:914
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00735	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	85	2 : View List ['_dwarf_object_detector_fd_a', '_dwarf_closer']	0	85	dwarf_object_detector_path_dSYM	call site: 00049	/src/libdwarf/src/lib/libdwarf/dwarf_object_detector.c:638
0	17	1 : View List ['dwarfstring_append']	0	33	transform_leading_windowsletter	call site: 00257	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:207
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00157	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1339

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

37

Reachable functions

242

Percentage of reachable functions covered

84.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	17.4%
gold	[1:9]	76	8.95%
yellow	[10:29]	40	4.71%
greenyellow	[30:49]	23	2.70%
lawngreen	50+	562	66.1%
All colors	849	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	218	2 : View List ['free_aranges_chain', '_dwarf_error']	0	218	dwarf_get_aranges	call site: 00828	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:441
0	218	2 : View List ['free_aranges_chain', '_dwarf_error']	0	218	_dwarf_get_aranges_list	call site: 00822	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:381
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_arange_info_b	call site: 00832	/src/libdwarf/src/lib/libdwarf/dwarf_arange.c:698

Runtime coverage analysis

Covered functions

222

Functions that are reachable but not covered

31

Reachable functions

224

Percentage of reachable functions covered

86.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	130	18.6%
gold	[1:9]	44	6.31%
yellow	[10:29]	47	6.74%
greenyellow	[30:49]	7	1.00%
lawngreen	50+	469	67.2%
All colors	697	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errno']	115	426	dwarf_object_init_b	call site: 00514	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00187	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['dwarfstring_constructor', 'calloc', 'dwarfstring_append', '_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	91	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	114	dwarf_object_init_b	call site: 00522	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

40

Reachable functions

207

Percentage of reachable functions covered

80.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	156	18.5%
gold	[1:9]	73	8.66%
yellow	[10:29]	29	3.44%
greenyellow	[30:49]	35	4.15%
lawngreen	50+	549	65.2%
All colors	842	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00500	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	107	2 : View List ['_dwarf_error_string', 'free']	0	107	_dwarf_internal_read_rnglists_header	call site: 00717	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:555
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00245	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1339

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

33

Reachable functions

229

Percentage of reachable functions covered

85.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	4
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	17.2%
gold	[1:9]	44	6.15%
yellow	[10:29]	13	1.81%
greenyellow	[30:49]	27	3.77%
lawngreen	50+	508	71.0%
All colors	715	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00015	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00500	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	11	1 : View List ['_dwarf_tdestroy']	0	11	_dwarf_free_all_of_one_debug	call site: 00245	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1339

Runtime coverage analysis

Covered functions

210

Functions that are reachable but not covered

32

Reachable functions

213

Percentage of reachable functions covered

84.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_die_cu_e_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	511	30.3%
gold	[1:9]	161	9.54%
yellow	[10:29]	124	7.35%
greenyellow	[30:49]	31	1.83%
lawngreen	50+	859	50.9%
All colors	1686	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01388	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00873	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01650	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01479	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	349	find_sig8_target_as_global_offset	call site: 01387	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarfstring_constructor_fixed']	24	309	_dwarf_internal_global_formref_b	call site: 01386	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562

Runtime coverage analysis

Covered functions

320

Functions that are reachable but not covered

56

Reachable functions

347

Percentage of reachable functions covered

83.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	7.69%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	92.3%
All colors	13	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	dwarf_basic_crc32	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_crc.c:137

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

11

Reachable functions

13

Percentage of reachable functions covered

15.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	149	18.3%
gold	[1:9]	25	3.08%
yellow	[10:29]	39	4.80%
greenyellow	[30:49]	28	3.45%
lawngreen	50+	570	70.2%
All colors	811	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00015	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00500	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418
0	107	1 : View List ['_dwarf_error_string']	0	107	dwarf_dnames_sizes	call site: 00738	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:933

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

33

Reachable functions

229

Percentage of reachable functions covered

85.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	615	33.4%
gold	[1:9]	179	9.74%
yellow	[10:29]	128	6.97%
greenyellow	[30:49]	52	2.83%
lawngreen	50+	862	46.9%
All colors	1836	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01384	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
346	474	5 : View List ['dwarfstring_string', 'dwarfstring_constructor', '_dwarf_read_encoded_ptr', 'dwarfstring_destructor', 'dwarfstring_append_printf_u']	346	2943	_dwarf_create_fde_from_after_start	call site: 01695	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1115
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00869	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01646	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01475	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	349	find_sig8_target_as_global_offset	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
109	109	1 : View List ['regerror']	109	109	_dwarf_validate_register_numbers	call site: 01677	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:169
24	309	7 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarfstring_constructor_fixed']	24	309	_dwarf_internal_global_formref_b	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857

Runtime coverage analysis

Covered functions

329

Functions that are reachable but not covered

59

Reachable functions

358

Percentage of reachable functions covered

83.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	161	20.7%
gold	[1:9]	46	5.93%
yellow	[10:29]	44	5.67%
greenyellow	[30:49]	26	3.35%
lawngreen	50+	498	64.2%
All colors	775	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errno']	115	426	dwarf_object_init_b	call site: 00514	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00187	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['dwarfstring_constructor', 'calloc', 'dwarfstring_append', '_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	91	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	226	5 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor', 'dwarfstring_destructor', 'dwarfstring_append_printf_u']	0	226	dwarf_get_rnglist_rle	call site: 00738	/src/libdwarf/src/lib/libdwarf/dwarf_rnglists.c:1023
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	114	dwarf_object_init_b	call site: 00522	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

38

Reachable functions

214

Percentage of reachable functions covered

82.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	10
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	888	33.6%
gold	[1:9]	167	6.33%
yellow	[10:29]	106	4.02%
greenyellow	[30:49]	66	2.50%
lawngreen	50+	1409	53.4%
All colors	2636	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 01110	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
109	109	1 : View List ['dwarf_object_detector_path_dSYM']	109	7178	dwarf_init_path_dl_a	call site: 00036	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:311
64	64	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	66	162	dwarfstring_append_printf_i	call site: 01942	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00674	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00087	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00037	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00109	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	858	1 : View List ['_dwarf_siblingof_internal']	0	858	_dwarf_next_cu_header_internal	call site: 01032	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2168
0	333	3 : View List ['dwarf_dealloc_die', 'local_dealloc_cu_context', '_dwarf_error_string']	0	333	_dwarf_create_a_new_cu_context_record_on_list	call site: 01107	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:1937
0	330	2 : View List ['_dwarf_error_string', '_dwarf_check_string_valid']	0	330	_dwarf_decode_line_string_form	call site: 02189	/src/libdwarf/src/lib/libdwarf/dwarf_line.c:2390

Runtime coverage analysis

Covered functions

401

Functions that are reachable but not covered

78

Reachable functions

448

Percentage of reachable functions covered

82.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	35
src/lib/libdwarf/dwarf_query.c	28
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	27
src/lib/libdwarf/dwarf_line_table_reader_common.h	6

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	829	38.2%
gold	[1:9]	208	9.59%
yellow	[10:29]	92	4.24%
greenyellow	[30:49]	74	3.41%
lawngreen	50+	964	44.4%
All colors	2167	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2109	2109	1 : View List ['cook_loclists_contents']	2109	2228	dwarf_get_loclist_c	call site: 02044	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1793
2103	2103	1 : View List ['cook_gnu_loclist_contents']	2103	2222	dwarf_get_loclist_c	call site: 01976	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1768
2089	2089	1 : View List ['_dwarf_search_for_signature']	3003	4085	_dwarf_loclists_fill_in_lle_head	call site: 02045	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1238
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01384	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
914	1033	6 : View List ['dwarfstring_string', 'dwarfstring_constructor', 'dwarfstring_destructor', 'dwarfstring_append_printf_u', '_dwarf_which_loclists_context', 'build_array_of_lle']	914	1675	_dwarf_loclists_fill_in_lle_head	call site: 02048	/src/libdwarf/src/lib/libdwarf/dwarf_loclists.c:1276
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00869	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
202	202	1 : View List ['_dwarf_get_loclist_lle_count_dwo']	400	1407	_dwarf_original_loclist_build	call site: 01697	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:1065
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01475	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	349	find_sig8_target_as_global_offset	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
70	203	6 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', '_dwarf_lkind_name', 'dwarfstring_constructor', 'dwarfstring_append']	70	203	_dwarf_loc_block_sanity_check	call site: 01787	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:458
70	203	6 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', '_dwarf_lkind_name', 'dwarfstring_constructor', 'dwarfstring_append']	70	203	_dwarf_loc_block_sanity_check	call site: 01798	/src/libdwarf/src/lib/libdwarf/dwarf_loc.c:473
66	66	3 : View List ['_dwarfstring_append_spaces', 'strlen', '_dwarfstring_append_zeros']	66	198	dwarfstring_append_printf_i	call site: 01921	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:523

Runtime coverage analysis

Covered functions

342

Functions that are reachable but not covered

83

Reachable functions

394

Percentage of reachable functions covered

78.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	27
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	24
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	24
src/lib/libdwarf/dwarf_locationop_read.c	2

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	18.9%
gold	[1:9]	16	2.5%
yellow	[10:29]	27	4.21%
greenyellow	[30:49]	30	4.68%
lawngreen	50+	446	69.6%
All colors	640	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errno']	115	426	dwarf_object_init_b	call site: 00514	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00187	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['dwarfstring_constructor', 'calloc', 'dwarfstring_append', '_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	91	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

40

Reachable functions

204

Percentage of reachable functions covered

80.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	266	19.7%
gold	[1:9]	39	2.89%
yellow	[10:29]	28	2.07%
greenyellow	[30:49]	35	2.59%
lawngreen	50+	981	72.7%
All colors	1349	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00416	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	115	2 : View List ['_dwarf_error_string', '_dwarf_skip_leb128']	8	224	_dwarf_get_gcc_eh_augmentation	call site: 00730	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1986
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00193	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00257	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00176	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00585	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00626	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00198	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	329	6 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_constructor', 'dwarfstring_destructor', 'dwarfstring_append_printf_u', 'dwarf_dealloc']	0	332	_dwarf_exec_frame_instr	call site: 01155	/src/libdwarf/src/lib/libdwarf/dwarf_frame.c:1867
0	212	2 : View List ['dwarf_dealloc', '_dwarf_error']	0	212	_dwarf_create_cie_from_after_start	call site: 00767	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1057
0	212	2 : View List ['dwarf_dealloc', '_dwarf_error']	0	212	_dwarf_create_fde_from_after_start	call site: 00833	/src/libdwarf/src/lib/libdwarf/dwarf_frame2.c:1360

Runtime coverage analysis

Covered functions

282

Functions that are reachable but not covered

36

Reachable functions

285

Percentage of reachable functions covered

87.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	37
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	351	39.1%
gold	[1:9]	25	2.78%
yellow	[10:29]	20	2.22%
greenyellow	[30:49]	22	2.45%
lawngreen	50+	479	53.4%
All colors	897	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
109	109	1 : View List ['dwarf_object_detector_path_dSYM']	109	7178	dwarf_init_path_dl_a	call site: 00036	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:311
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00674	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00083	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	132	4 : View List ['dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errno']	10	426	dwarf_object_init_b	call site: 00750	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
10	29	5 : View List ['dwarfstring_constructor', 'calloc', 'dwarfstring_append', '_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	91	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00037	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00109	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	114	3 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor']	0	114	dwarf_object_init_b	call site: 00757	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1162
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_sec_group_map	call site: 00889	/src/libdwarf/src/lib/libdwarf/dwarf_groups.c:294

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

73

Reachable functions

246

Percentage of reachable functions covered

70.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	522	31.3%
gold	[1:9]	150	9.01%
yellow	[10:29]	105	6.31%
greenyellow	[30:49]	67	4.02%
lawngreen	50+	820	49.2%
All colors	1664	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01384	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00869	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01646	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01475	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	349	find_sig8_target_as_global_offset	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarfstring_constructor_fixed']	24	309	_dwarf_internal_global_formref_b	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562

Runtime coverage analysis

Covered functions

317

Functions that are reachable but not covered

57

Reachable functions

345

Percentage of reachable functions covered

83.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	146	18.4%
gold	[1:9]	41	5.17%
yellow	[10:29]	18	2.27%
greenyellow	[30:49]	27	3.40%
lawngreen	50+	560	70.7%
All colors	792	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errno']	115	426	dwarf_object_init_b	call site: 00514	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
35	35	1 : View List ['transform_leading_windowsletter']	35	426	_dwarf_construct_linkedto_path	call site: 00699	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:654
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00187	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['dwarfstring_constructor', 'calloc', 'dwarfstring_append', '_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	91	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	2 : View List ['strdup', 'strlen']	4	4	dwarf_gnu_debuglink	call site: 00636	/src/libdwarf/src/lib/libdwarf/dwarf_debuglink.c:988
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481

Runtime coverage analysis

Covered functions

209

Functions that are reachable but not covered

42

Reachable functions

226

Percentage of reachable functions covered

81.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	127	17.6%
gold	[1:9]	30	4.17%
yellow	[10:29]	34	4.72%
greenyellow	[30:49]	24	3.33%
lawngreen	50+	504	70.0%
All colors	719	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00015	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_culist_entry	call site: 00674	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:420
0	155	1 : View List ['emit_one_value_msg']	0	155	dwarf_gdbindex_types_culist_entry	call site: 00680	/src/libdwarf/src/lib/libdwarf/dwarf_gdbindex.c:497

Runtime coverage analysis

Covered functions

218

Functions that are reachable but not covered

32

Reachable functions

225

Percentage of reachable functions covered

85.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	509	30.1%
gold	[1:9]	145	8.57%
yellow	[10:29]	106	6.26%
greenyellow	[30:49]	64	3.78%
lawngreen	50+	867	51.2%
All colors	1691	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01388	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00873	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01650	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01479	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	349	find_sig8_target_as_global_offset	call site: 01387	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarfstring_constructor_fixed']	24	309	_dwarf_internal_global_formref_b	call site: 01386	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

56

Reachable functions

348

Percentage of reachable functions covered

83.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	250	21.5%
gold	[1:9]	75	6.47%
yellow	[10:29]	49	4.23%
greenyellow	[30:49]	30	2.59%
lawngreen	50+	754	65.1%
All colors	1158	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
119	119	1 : View List ['get_hash_value_number']	119	1223	dwarf_dnames_name	call site: 00983	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1509
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_dnames_entrypool	call site: 01017	/src/libdwarf/src/lib/libdwarf/dwarf_debugnames.c:1670
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_globname	call site: 01111	/src/libdwarf/src/lib/libdwarf/dwarf_global.c:1325
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_global_die_offset	call site: 01114	/src/libdwarf/src/lib/libdwarf/dwarf_global.c:1348

Runtime coverage analysis

Covered functions

266

Functions that are reachable but not covered

36

Reachable functions

272

Percentage of reachable functions covered

86.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	118	18.5%
gold	[1:9]	12	1.88%
yellow	[10:29]	41	6.44%
greenyellow	[30:49]	16	2.51%
lawngreen	50+	449	70.5%
All colors	636	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errno']	115	426	dwarf_object_init_b	call site: 00514	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00187	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['dwarfstring_constructor', 'calloc', 'dwarfstring_append', '_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	91	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

39

Reachable functions

203

Percentage of reachable functions covered

80.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	517	30.8%
gold	[1:9]	143	8.54%
yellow	[10:29]	118	7.04%
greenyellow	[30:49]	56	3.34%
lawngreen	50+	840	50.1%
All colors	1674	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00869	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01646	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01475	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
127	349	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	349	find_sig8_target_as_global_offset	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarfstring_constructor_fixed']	24	309	_dwarf_internal_global_formref_b	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	2093	2 : View List ['_dwarf_create_a_new_cu_context_record_on_list', '_dwarf_calculate_next_cu_context_offset']	4	4034	dwarf_offdie_b	call site: 01400	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3329
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

56

Reachable functions

348

Percentage of reachable functions covered

83.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	615	28.3%
gold	[1:9]	237	10.9%
yellow	[10:29]	77	3.54%
greenyellow	[30:49]	79	3.63%
lawngreen	50+	1165	53.6%
All colors	2173	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01646	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01475	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	713	5 : View List ['dwarf_get_xu_section_offset', 'memcmp', 'dwarf_get_xu_section_names', '_dwarf_error', 'dwarf_get_xu_hash_entry']	2	713	_dwarf_search_fission_for_offset	call site: 00978	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:1035
2	444	3 : View List ['dwarf_get_xu_section_offset', 'memcmp', 'dwarf_get_xu_hash_entry']	2	444	_dwarf_search_fission_for_offset	call site: 00978	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:1044
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280

Runtime coverage analysis

Covered functions

375

Functions that are reachable but not covered

54

Reachable functions

397

Percentage of reachable functions covered

86.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	13
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	111	17.1%
gold	[1:9]	24	3.71%
yellow	[10:29]	16	2.47%
greenyellow	[30:49]	23	3.56%
lawngreen	50+	472	73.0%
All colors	646	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00015	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00500	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

34

Reachable functions

205

Percentage of reachable functions covered

83.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_die_cu_e

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	515	31.0%
gold	[1:9]	156	9.41%
yellow	[10:29]	81	4.88%
greenyellow	[30:49]	59	3.56%
lawngreen	50+	846	51.0%
All colors	1657	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01384	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00869	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01646	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
127	349	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	349	find_sig8_target_as_global_offset	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarfstring_constructor_fixed']	24	309	_dwarf_internal_global_formref_b	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278

Runtime coverage analysis

Covered functions

318

Functions that are reachable but not covered

55

Reachable functions

344

Percentage of reachable functions covered

84.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	737	27.2%
gold	[1:9]	198	7.31%
yellow	[10:29]	123	4.54%
greenyellow	[30:49]	45	1.66%
lawngreen	50+	1605	59.2%
All colors	2708	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00869	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01646	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
186	291	2 : View List ['dwarf_dealloc_error', '_dwarf_trial_read_dwarf_five_hdr']	186	731	_dwarf_extract_string_offset_via_str_offsets	call site: 01475	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:1871
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	2093	2 : View List ['_dwarf_create_a_new_cu_context_record_on_list', '_dwarf_calculate_next_cu_context_offset']	0	4034	dwarf_offdie_b	call site: 01400	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3329
0	858	1 : View List ['_dwarf_siblingof_internal']	0	858	_dwarf_next_cu_header_internal	call site: 00791	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:2168

Runtime coverage analysis

Covered functions

398

Functions that are reachable but not covered

50

Reachable functions

417

Percentage of reachable functions covered

88.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	38
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	16.3%
gold	[1:9]	22	3.43%
yellow	[10:29]	20	3.12%
greenyellow	[30:49]	29	4.52%
lawngreen	50+	465	72.5%
All colors	641	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00438	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00416	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00193	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00257	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00012	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00176	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00585	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00626	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00016	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00198	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00501	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

34

Reachable functions

204

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	135	18.5%
gold	[1:9]	30	4.12%
yellow	[10:29]	33	4.53%
greenyellow	[30:49]	34	4.67%
lawngreen	50+	495	68.0%
All colors	727	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
64	64	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	66	162	dwarfstring_append_printf_i	call site: 00653	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:754
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00015	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280

Runtime coverage analysis

Covered functions

210

Functions that are reachable but not covered

33

Reachable functions

218

Percentage of reachable functions covered

84.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	531	28.3%
gold	[1:9]	151	8.07%
yellow	[10:29]	127	6.78%
greenyellow	[30:49]	50	2.67%
lawngreen	50+	1012	54.0%
All colors	1871	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
326	326	1 : View List ['_dwarf_get_debugfission_for_offset']	326	433	fill_in_dwp_offsets_if_present	call site: 00869	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:620
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01646	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
64	64	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	66	162	dwarfstring_append_printf_i	call site: 01680	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:612
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarfstring_constructor_fixed']	24	309	_dwarf_internal_global_formref_b	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	2093	2 : View List ['_dwarf_create_a_new_cu_context_record_on_list', '_dwarf_calculate_next_cu_context_offset']	4	4034	dwarf_offdie_b	call site: 01400	/src/libdwarf/src/lib/libdwarf/dwarf_die_deliv.c:3329
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441

Runtime coverage analysis

Covered functions

359

Functions that are reachable but not covered

49

Reachable functions

378

Percentage of reachable functions covered

87.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	38
src/lib/libdwarf/dwarf_query.c	37
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	25
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	16.5%
gold	[1:9]	21	3.24%
yellow	[10:29]	20	3.09%
greenyellow	[30:49]	22	3.40%
lawngreen	50+	477	73.7%
All colors	647	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00437	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00415	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00192	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00256	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	6	2 : View List ['fflush', 'dwarf_errmsg_by_number']	4	68	_dwarf_error_string	call site: 00011	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00175	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00584	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00625	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00015	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00197	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280
0	109	1 : View List ['_dwarf_error']	0	109	dwarf_get_xu_index_header	call site: 00500	/src/libdwarf/src/lib/libdwarf/dwarf_xu_index.c:418

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

33

Reachable functions

206

Percentage of reachable functions covered

83.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	483	29.0%
gold	[1:9]	133	8.00%
yellow	[10:29]	128	7.70%
greenyellow	[30:49]	51	3.06%
lawngreen	50+	867	52.1%
All colors	1662	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2089	2089	1 : View List ['dwarf_offdie_b']	2089	2089	_dwarf_internal_find_die_given_sig8	call site: 01384	/src/libdwarf/src/lib/libdwarf/dwarf_find_sigref.c:212
258	363	2 : View List ['dwarf_dealloc_error', '_dwarf_read_str_offsets_header']	258	363	load_xu_str_offsets_into_cucontext	call site: 01646	/src/libdwarf/src/lib/libdwarf/dwarf_fission_to_cu.c:162
127	349	2 : View List ['dwarf_dealloc_die', 'dwarf_die_offsets']	127	349	find_sig8_target_as_global_offset	call site: 01383	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:682
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
24	309	7 : View List ['_dwarf_error_string', 'dwarfstring_string', 'dwarfstring_destructor', 'dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarfstring_constructor_fixed']	24	309	_dwarf_internal_global_formref_b	call site: 01382	/src/libdwarf/src/lib/libdwarf/dwarf_form.c:957
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
8	8	2 : View List ['_dwarf_add_to_static_err_list', '_dwarf_special_no_dbg_error_malloc']	10	29	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:129
5	5	1 : View List ['_dwarf_remove_from_staticerrlist']	5	52	dwarf_dealloc	call site: 00191	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1075
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

50

Reachable functions

345

Percentage of reachable functions covered

85.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	118	18.5%
gold	[1:9]	28	4.40%
yellow	[10:29]	28	4.40%
greenyellow	[30:49]	16	2.51%
lawngreen	50+	445	70.0%
All colors	635	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	132	4 : View List ['dwarf_errmsg', 'dwarfstring_append', 'dwarf_dealloc_error', 'dwarf_errno']	115	426	dwarf_object_init_b	call site: 00514	/src/libdwarf/src/lib/libdwarf/dwarf_init_finish.c:1145
54	54	1 : View List ['apply_rela_entries']	54	54	elf_relocations_nolibelf	call site: 00000	/src/libdwarf/src/lib/libdwarf/dwarf_elfread.c:729
32	32	2 : View List ['_dwarfstring_append_spaces', '_dwarfstring_append_zeros']	34	70	dwarfstring_append_printf_u	call site: 00436	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:867
16	16	1 : View List ['_dwarfstring_append_spaces']	18	42	dwarfstring_append_printf_s	call site: 00414	/src/libdwarf/src/lib/libdwarf/dwarf_string.c:347
13	13	2 : View List ['_dwarf_remove_from_staticerrlist', '_dwarf_error_destructor']	13	60	dwarf_dealloc	call site: 00187	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1054
10	29	5 : View List ['dwarfstring_constructor', 'calloc', 'dwarfstring_append', '_dwarf_special_no_dbg_error_malloc', '_dwarf_add_to_static_err_list']	10	91	_dwarf_error_string	call site: 00010	/src/libdwarf/src/lib/libdwarf/dwarf_error.c:126
4	18	2 : View List ['dwarf_set_load_preference', 'strcmp']	4	18	_dwarf_determine_section_allocation_type	call site: 00255	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:857
4	4	1 : View List ['_dwarf_closer']	4	186	dwarf_finish	call site: 00174	/src/libdwarf/src/lib/libdwarf/dwarf_generic_init.c:562
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_macho_internals	call site: 00583	/src/libdwarf/src/lib/libdwarf/dwarf_machoread.c:278
4	4	1 : View List ['_dwarf_closer']	4	4	_dwarf_destruct_pe_access	call site: 00624	/src/libdwarf/src/lib/libdwarf/dwarf_peread.c:441
3	3	1 : View List ['allocate_ts_entry']	3	3	_tsearch_inner	call site: 00014	/src/libdwarf/src/lib/libdwarf/dwarf_tsearchhash.c:481
2	2	1 : View List ['fclose']	2	458	_dwarf_free_all_of_one_debug	call site: 00196	/src/libdwarf/src/lib/libdwarf/dwarf_alloc.c:1280

Runtime coverage analysis

Covered functions

188

Functions that are reachable but not covered

40

Reachable functions

203

Percentage of reachable functions covered

80.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	22
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13