High level conclusions

Fuzzers reach 83.54% of cyclomatic complexity.

Fuzzers reach 80.13% of all functions.

Fuzzers reach 81.01% code coverage.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 15.38% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.022% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

726 / 906

Cyclomatic complexity statically reachable by fuzzers

7781 / 9313

Runtime code coverage of functions

734 / 906

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1199	98.1%
gold	[1:9]	22	1.80%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.08%
All colors	1222	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
515	226	dwarf_get_debugfission_for_key	call site: 00226	dwarf_offdie_b
311	742	get_attr_dbg	call site: 00742	set_producer_type
181	44	_dwarf_error	call site: 00044	dwarf_get_debugfission_for_key
100	1054	dwarf_formaddr	call site: 01054	_dwarf_look_in_local_and_tied
60	1159	dwarf_finish	call site: 01159	dwarf_object_finish
20	9	dwarf_die_from_hash_signature	call site: 00009	_dwarf_get_alloc
11	32	_dwarf_error_string	call site: 00032	_dwarf_load_debug_info
1	3	LLVMFuzzerTestOneInput	call site: 00003	printf

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

208

Reachable functions

219

Percentage of reachable functions covered

5.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.2%
gold	[1:9]	32	4.87%
yellow	[10:29]	27	4.11%
greenyellow	[30:49]	24	3.65%
lawngreen	50+	453	69.0%
All colors	656	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

39

Reachable functions

207

Percentage of reachable functions covered

81.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	149	17.1%
gold	[1:9]	88	10.1%
yellow	[10:29]	48	5.52%
greenyellow	[30:49]	23	2.64%
lawngreen	50+	561	64.5%
All colors	869	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
9	837	_dwarf_get_aranges_list	call site: 00837	free_aranges_chain
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
5	670	internal_load_rnglists_contexts	call site: 00670	_dwarf_error_string
5	722	_dwarf_read_unaligned_ck_wrapper	call site: 00722	_dwarf_error_string
5	741	internal_load_rnglists_contexts	call site: 00741	free_rnglists_chain
5	786	internal_load_loclists_contexts	call site: 00786	free_loclists_chain

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

31

Reachable functions

228

Percentage of reachable functions covered

86.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	132	18.4%
gold	[1:9]	40	5.57%
yellow	[10:29]	37	5.16%
greenyellow	[30:49]	24	3.34%
lawngreen	50+	484	67.5%
All colors	717	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
7	657	dwarf_debug_addr_table	call site: 00657	_dwarf_error_string
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

40

Reachable functions

211

Percentage of reachable functions covered

81.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.3%
gold	[1:9]	31	4.73%
yellow	[10:29]	27	4.12%
greenyellow	[30:49]	23	3.51%
lawngreen	50+	454	69.3%
All colors	655	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

40

Reachable functions

207

Percentage of reachable functions covered

80.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	163	20.5%
gold	[1:9]	60	7.54%
yellow	[10:29]	38	4.77%
greenyellow	[30:49]	24	3.01%
lawngreen	50+	510	64.1%
All colors	795	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	756	dwarf_get_rnglist_rle	call site: 00756	_dwarf_error_string
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
7	742	dwarf_get_rnglist_offset_index_value	call site: 00742	_dwarf_error_string
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
5	660	internal_load_rnglists_contexts	call site: 00660	_dwarf_error_string
5	712	_dwarf_read_unaligned_ck_wrapper	call site: 00712	_dwarf_error_string

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

38

Reachable functions

218

Percentage of reachable functions covered

82.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	10
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	157	18.2%
gold	[1:9]	85	9.86%
yellow	[10:29]	39	4.52%
greenyellow	[30:49]	21	2.43%
lawngreen	50+	560	64.9%
All colors	862	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	809	dwarf_get_gnu_index_head	call site: 00809	build_errm_no_v
9	838	_dwarf_count_entries_in_block	call site: 00838	build_errm_no_v
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
5	670	internal_load_rnglists_contexts	call site: 00670	_dwarf_error_string
5	722	_dwarf_read_unaligned_ck_wrapper	call site: 00722	_dwarf_error_string
5	741	internal_load_rnglists_contexts	call site: 00741	free_rnglists_chain

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

33

Reachable functions

233

Percentage of reachable functions covered

85.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	4
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	526	31.0%
gold	[1:9]	144	8.50%
yellow	[10:29]	129	7.61%
greenyellow	[30:49]	48	2.83%
lawngreen	50+	846	49.9%
All colors	1693	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1415	_dwarf_create_a_new_cu_context_record_on_list	call site: 01415	dwarf_offdie_b
29	1174	_dwarf_get_size_of_val	call site: 01174	_dwarf_error_string
26	1504	_dwarf_extract_string_offset_via_str_offsets	call site: 01504	_dwarf_trial_read_dwarf_five_hdr
19	1124	_dwarf_leb128_sword_wrapper	call site: 01124	_dwarf_get_size_of_val
17	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
16	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_error_string
13	1077	_dwarf_count_abbrev_entries	call site: 01077	_dwarf_fill_in_attr_form_abtable
12	899	dwarf_get_debugfission_for_key	call site: 00899	_dwarf_error_string
11	965	dwarf_get_xu_section_offset	call site: 00965	_dwarf_error_string
11	993	fill_in_dwp_offsets_if_present	call site: 00993	_dwarf_get_debugfission_for_offset
10	860	_dwarf_make_CU_Context	call site: 00860	report_local_unit_type_error
10	1475	_dwarf_get_string_from_tied	call site: 01475	_dwarf_load_section

Runtime coverage analysis

Covered functions

320

Functions that are reachable but not covered

58

Reachable functions

349

Percentage of reachable functions covered

83.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	624	33.4%
gold	[1:9]	200	10.7%
yellow	[10:29]	133	7.13%
greenyellow	[30:49]	52	2.78%
lawngreen	50+	855	45.8%
All colors	1864	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1415	_dwarf_create_a_new_cu_context_record_on_list	call site: 01415	dwarf_offdie_b
29	1174	_dwarf_get_size_of_val	call site: 01174	_dwarf_error_string
28	1724	dwarf_get_fde_for_die	call site: 01724	_dwarf_read_encoded_ptr
26	1504	_dwarf_extract_string_offset_via_str_offsets	call site: 01504	_dwarf_trial_read_dwarf_five_hdr
23	1827	_dwarf_create_cie_from_after_start	call site: 01827	_dwarf_gnu_aug_encodings
19	1124	_dwarf_leb128_sword_wrapper	call site: 01124	_dwarf_get_size_of_val
17	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
16	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_error_string
13	1077	_dwarf_count_abbrev_entries	call site: 01077	_dwarf_fill_in_attr_form_abtable
12	899	dwarf_get_debugfission_for_key	call site: 00899	_dwarf_error_string
12	1755	_dwarf_create_fde_from_after_start	call site: 01755	_dwarf_error
11	965	dwarf_get_xu_section_offset	call site: 00965	_dwarf_error_string

Runtime coverage analysis

Covered functions

333

Functions that are reachable but not covered

59

Reachable functions

362

Percentage of reachable functions covered

83.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	618	27.9%
gold	[1:9]	256	11.5%
yellow	[10:29]	119	5.38%
greenyellow	[30:49]	74	3.35%
lawngreen	50+	1141	51.6%
All colors	2208	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
38	1773	_dwarf_read_line_table_header	call site: 01773	dwarfstring_append_printf_i
29	1174	_dwarf_get_size_of_val	call site: 01174	_dwarf_error_string
26	1504	_dwarf_extract_string_offset_via_str_offsets	call site: 01504	_dwarf_trial_read_dwarf_five_hdr
19	1124	_dwarf_leb128_sword_wrapper	call site: 01124	_dwarf_get_size_of_val
17	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
17	2108	read_operands_table	call site: 02108	validate_opcode
16	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_error_string
13	1077	_dwarf_count_abbrev_entries	call site: 01077	_dwarf_fill_in_attr_form_abtable
12	899	dwarf_get_debugfission_for_key	call site: 00899	_dwarf_error_string
11	965	dwarf_get_xu_section_offset	call site: 00965	_dwarf_error_string
10	860	_dwarf_make_CU_Context	call site: 00860	report_local_unit_type_error
10	1475	_dwarf_get_string_from_tied	call site: 01475	_dwarf_load_section

Runtime coverage analysis

Covered functions

379

Functions that are reachable but not covered

54

Reachable functions

401

Percentage of reachable functions covered

86.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	13
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	168	18.7%
gold	[1:9]	13	1.45%
yellow	[10:29]	26	2.90%
greenyellow	[30:49]	4	0.44%
lawngreen	50+	684	76.4%
All colors	895	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	354	_dwarf_debuglink_finder_newpath	call site: 00354	dwarf_gnu_debuglink
8	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_error_string
7	714	dwarf_get_xu_index_header	call site: 00714	_dwarf_error_string
6	524	insert_sht_list_in_group_map	call site: 00524	_dwarf_error
5	192	dwarfstring_append_printf_u	call site: 00192	dwarfstring_append_length
5	673	dwarfstring_append_printf_s	call site: 00673	_dwarfstring_append_spaces
4	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_set_load_preference
4	95	dwarf_add_debuglink_global_path	call site: 00095	dwarf_finish
4	187	dwarfstring_append_printf_u	call site: 00187	dwarfstring_append_length
4	198	dwarfstring_append_printf_u	call site: 00198	_dwarfstring_append_spaces
4	384	dwarf_object_detector_path_b	call site: 00384	_dwarf_closer
4	531	insert_sht_list_in_group_map	call site: 00531	_dwarf_error

Runtime coverage analysis

Covered functions

234

Functions that are reachable but not covered

37

Reachable functions

246

Percentage of reachable functions covered

84.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	111	16.6%
gold	[1:9]	33	4.95%
yellow	[10:29]	24	3.60%
greenyellow	[30:49]	19	2.85%
lawngreen	50+	479	71.9%
All colors	666	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	654	dwarf_crc32	call site: 00654	_dwarf_error_string
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

33

Reachable functions

209

Percentage of reachable functions covered

84.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	494	29.2%
gold	[1:9]	183	10.8%
yellow	[10:29]	132	7.80%
greenyellow	[30:49]	58	3.42%
lawngreen	50+	824	48.7%
All colors	1691	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1415	_dwarf_create_a_new_cu_context_record_on_list	call site: 01415	dwarf_offdie_b
29	1174	_dwarf_get_size_of_val	call site: 01174	_dwarf_error_string
19	1124	_dwarf_leb128_sword_wrapper	call site: 01124	_dwarf_get_size_of_val
17	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
16	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_error_string
13	1077	_dwarf_count_abbrev_entries	call site: 01077	_dwarf_fill_in_attr_form_abtable
12	899	dwarf_get_debugfission_for_key	call site: 00899	_dwarf_error_string
11	965	dwarf_get_xu_section_offset	call site: 00965	_dwarf_error_string
10	860	_dwarf_make_CU_Context	call site: 00860	report_local_unit_type_error
10	1475	_dwarf_get_string_from_tied	call site: 01475	_dwarf_load_section
8	1020	dw_start_load_root_die	call site: 01020	_dwarf_next_die_info_ptr
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

327

Functions that are reachable but not covered

51

Reachable functions

349

Percentage of reachable functions covered

85.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	513	29.8%
gold	[1:9]	165	9.59%
yellow	[10:29]	113	6.56%
greenyellow	[30:49]	45	2.61%
lawngreen	50+	884	51.3%
All colors	1720	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1419	_dwarf_create_a_new_cu_context_record_on_list	call site: 01419	dwarf_offdie_b
26	1508	_dwarf_extract_string_offset_via_str_offsets	call site: 01508	_dwarf_trial_read_dwarf_five_hdr
24	1183	_dwarf_next_die_info_ptr	call site: 01183	_dwarf_error_string
17	1624	_dwarf_look_in_local_and_tied_by_index	call site: 01624	_dwarf_get_addr_from_tied
16	950	dwarf_get_xu_section_offset	call site: 00950	_dwarf_error_string
13	1133	_dwarf_next_die_info_ptr	call site: 01133	_dwarf_error
12	903	dwarf_get_debugfission_for_key	call site: 00903	_dwarf_error_string
11	969	dwarf_get_xu_section_offset	call site: 00969	_dwarf_error_string
11	997	fill_in_dwp_offsets_if_present	call site: 00997	_dwarf_get_debugfission_for_offset
11	1081	_dwarf_count_abbrev_entries	call site: 01081	_dwarf_error_string
10	864	_dwarf_make_CU_Context	call site: 00864	report_local_unit_type_error
10	1479	_dwarf_get_string_from_tied	call site: 01479	_dwarf_load_section

Runtime coverage analysis

Covered functions

325

Functions that are reachable but not covered

56

Reachable functions

352

Percentage of reachable functions covered

84.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	270	19.6%
gold	[1:9]	42	3.05%
yellow	[10:29]	68	4.94%
greenyellow	[30:49]	59	4.29%
lawngreen	50+	935	68.0%
All colors	1374	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	1177	_dwarf_exec_frame_instr	call site: 01177	_dwarf_error
10	826	_dwarf_create_fde_from_after_start	call site: 00826	_dwarf_error_string
7	415	dwarfstring_append_printf_s	call site: 00415	_dwarfstring_append_spaces
7	480	dwarf_get_xu_index_header	call site: 00480	_dwarf_error_string
7	926	_dwarf_exec_frame_instr	call site: 00926	_dwarf_error
6	266	_dwarf_load_section	call site: 00266	_dwarf_error
5	31	dwarfstring_append_length	call site: 00031	_dwarf_get_alloc
5	257	_dwarf_determine_section_allocation_type	call site: 00257	_dwarf_error_string
5	433	dwarfstring_append_printf_u	call site: 00433	dwarfstring_append_length
5	895	print_fde_selected_regs	call site: 00895	_dwarf_error
4	273	insert_sht_list_in_group_map	call site: 00273	_dwarf_error
4	279	insert_sht_list_in_group_map	call site: 00279	_dwarf_error

Runtime coverage analysis

Covered functions

285

Functions that are reachable but not covered

36

Reachable functions

288

Percentage of reachable functions covered

87.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	3
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	37
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	267	22.6%
gold	[1:9]	74	6.28%
yellow	[10:29]	46	3.90%
greenyellow	[30:49]	42	3.56%
lawngreen	50+	748	63.5%
All colors	1177	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	1066	_dwarf_formudata_internal	call site: 01066	dwarf_formsdata
8	1023	dwarf_dnames_name	call site: 01023	_dwarf_error_string
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
7	1044	_dwarf_internal_get_debug_names_globals	call site: 01044	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	660	dwarf_globals_by_type	call site: 00660	_dwarf_error_string
6	743	_dwarf_internal_read_rnglists_header	call site: 00743	_dwarf_error_string
6	752	internal_load_rnglists_contexts	call site: 00752	free_rnglists_chain
6	894	_dwarf_internal_get_pubnames_like	call site: 00894	_dwarf_error
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string

Runtime coverage analysis

Covered functions

270

Functions that are reachable but not covered

36

Reachable functions

276

Percentage of reachable functions covered

86.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	741	27.0%
gold	[1:9]	238	8.68%
yellow	[10:29]	115	4.19%
greenyellow	[30:49]	68	2.48%
lawngreen	50+	1578	57.5%
All colors	2740	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
29	1174	_dwarf_get_size_of_val	call site: 01174	_dwarf_error_string
26	1504	_dwarf_extract_string_offset_via_str_offsets	call site: 01504	_dwarf_trial_read_dwarf_five_hdr
24	2411	read_line_table_program	call site: 02411	read_sword_de
19	1124	_dwarf_leb128_sword_wrapper	call site: 01124	_dwarf_get_size_of_val
18	2508	read_line_table_program	call site: 02508	_dwarf_error
17	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
16	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_error_string
15	2705	_dwarf_filename	call site: 02705	_dwarf_error_string
13	1077	_dwarf_count_abbrev_entries	call site: 01077	_dwarf_fill_in_attr_form_abtable
12	899	dwarf_get_debugfission_for_key	call site: 00899	_dwarf_error_string
11	965	dwarf_get_xu_section_offset	call site: 00965	_dwarf_error_string
11	993	fill_in_dwp_offsets_if_present	call site: 00993	_dwarf_get_debugfission_for_offset

Runtime coverage analysis

Covered functions

402

Functions that are reachable but not covered

50

Reachable functions

421

Percentage of reachable functions covered

88.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	38
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	858	32.1%
gold	[1:9]	217	8.13%
yellow	[10:29]	108	4.04%
greenyellow	[30:49]	66	2.47%
lawngreen	50+	1420	53.2%
All colors	2669	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
108	282	_dwarf_pathjoinl	call site: 00282	_dwarf_debuglink_finder_newpath
61	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_construct_linkedto_path
24	1416	_dwarf_next_die_info_ptr	call site: 01416	_dwarf_error_string
19	2018	dwarf_get_ranges_b	call site: 02018	_dwarf_load_section
18	2458	read_line_table_program	call site: 02458	_dwarf_error
17	1854	_dwarf_look_in_local_and_tied_by_index	call site: 01854	_dwarf_get_addr_from_tied
16	1186	dwarf_get_xu_section_offset	call site: 01186	_dwarf_error_string
15	2157	_dwarf_read_line_table_header	call site: 02157	_dwarf_error_string
15	2579	_dwarf_filename	call site: 02579	_dwarf_error_string
14	1968	dwarfstring_append_printf_i	call site: 01968	_dwarfstring_append_spaces
12	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_object_detector_path_dSYM
11	1140	dwarf_get_debugfission_for_key	call site: 01140	_dwarf_error_string

Runtime coverage analysis

Covered functions

411

Functions that are reachable but not covered

72

Reachable functions

452

Percentage of reachable functions covered

84.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	35
src/lib/libdwarf/dwarf_query.c	28
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	27
src/lib/libdwarf/dwarf_line_table_reader_common.h	6

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	7.69%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	92.3%
All colors	13	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	3	LLVMFuzzerTestOneInput	call site: 00003	printf

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

11

Reachable functions

13

Percentage of reachable functions covered

15.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	16.0%
gold	[1:9]	25	3.78%
yellow	[10:29]	25	3.78%
greenyellow	[30:49]	24	3.63%
lawngreen	50+	481	72.7%
All colors	661	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	415	dwarfstring_append_printf_s	call site: 00415	_dwarfstring_append_spaces
7	480	dwarf_get_xu_index_header	call site: 00480	_dwarf_error_string
6	266	_dwarf_load_section	call site: 00266	_dwarf_error
6	439	dwarfstring_append_printf_u	call site: 00439	_dwarfstring_append_spaces
5	31	dwarfstring_append_length	call site: 00031	_dwarf_get_alloc
5	257	_dwarf_determine_section_allocation_type	call site: 00257	_dwarf_error_string
5	433	dwarfstring_append_printf_u	call site: 00433	dwarfstring_append_length
4	273	insert_sht_list_in_group_map	call site: 00273	_dwarf_error
4	279	insert_sht_list_in_group_map	call site: 00279	_dwarf_error
4	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
3	68	_dwarf_elf_object_access_internals_init	call site: 00068	_dwarf_closer
3	191	_dwarf_tfind	call site: 00191	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

34

Reachable functions

208

Percentage of reachable functions covered

83.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	128	17.3%
gold	[1:9]	26	3.51%
yellow	[10:29]	46	6.22%
greenyellow	[30:49]	30	4.05%
lawngreen	50+	509	68.8%
All colors	739	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	706	examplewgdbindex	call site: 00706	emit_one_value_msg
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer
3	190	_dwarf_tfind	call site: 00190	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

32

Reachable functions

229

Percentage of reachable functions covered

86.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	136	18.1%
gold	[1:9]	39	5.20%
yellow	[10:29]	33	4.40%
greenyellow	[30:49]	36	4.80%
lawngreen	50+	505	67.4%
All colors	749	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	670	dwarfstring_append_printf_i	call site: 00670	_dwarfstring_append_spaces
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

33

Reachable functions

222

Percentage of reachable functions covered

85.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	108	16.1%
gold	[1:9]	22	3.29%
yellow	[10:29]	48	7.19%
greenyellow	[30:49]	4	0.59%
lawngreen	50+	485	72.7%
All colors	667	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer
3	190	_dwarf_tfind	call site: 00190	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

33

Reachable functions

210

Percentage of reachable functions covered

84.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	354	38.6%
gold	[1:9]	26	2.83%
yellow	[10:29]	24	2.61%
greenyellow	[30:49]	24	2.61%
lawngreen	50+	489	53.3%
All colors	917	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
182	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_debuglink_finder_newpath
18	168	_dwarf_load_section	call site: 00168	_dwarf_extract_buildid
12	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_object_detector_path_dSYM
8	198	dwarfstring_append_printf_u	call site: 00198	_dwarfstring_append_spaces
7	714	dwarf_get_xu_index_header	call site: 00714	_dwarf_error_string
6	524	insert_sht_list_in_group_map	call site: 00524	_dwarf_error
6	750	dwarf_object_init_b	call site: 00750	dwarf_dealloc_error
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	72	dwarf_init_path_dl_a	call site: 00072	_dwarf_debuglink_finder_internal
5	157	_dwarf_free_all_of_one_debug	call site: 00157	dwarf_gnu_debuglink
5	192	dwarfstring_append_printf_u	call site: 00192	dwarfstring_append_length
5	673	dwarfstring_append_printf_s	call site: 00673	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

73

Reachable functions

250

Percentage of reachable functions covered

70.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	150	18.0%
gold	[1:9]	41	4.93%
yellow	[10:29]	44	5.29%
greenyellow	[30:49]	29	3.48%
lawngreen	50+	567	68.2%
All colors	831	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	814	dwarf_dnames_name	call site: 00814	_dwarf_error_string
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
5	758	LLVMFuzzerTestOneInput	call site: 00758	dwarf_finish
5	764	LLVMFuzzerTestOneInput	call site: 00764	dwarf_finish
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

33

Reachable functions

233

Percentage of reachable functions covered

85.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_die_cu_e_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	515	30.0%
gold	[1:9]	202	11.7%
yellow	[10:29]	103	6.00%
greenyellow	[30:49]	23	1.34%
lawngreen	50+	872	50.8%
All colors	1715	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1419	_dwarf_create_a_new_cu_context_record_on_list	call site: 01419	dwarf_offdie_b
26	1508	_dwarf_extract_string_offset_via_str_offsets	call site: 01508	_dwarf_trial_read_dwarf_five_hdr
24	1183	_dwarf_next_die_info_ptr	call site: 01183	_dwarf_error_string
16	950	dwarf_get_xu_section_offset	call site: 00950	_dwarf_error_string
16	1624	_dwarf_look_in_local_and_tied_by_index	call site: 01624	_dwarf_get_addr_from_tied
13	1133	_dwarf_next_die_info_ptr	call site: 01133	_dwarf_error
12	903	dwarf_get_debugfission_for_key	call site: 00903	_dwarf_error_string
11	969	dwarf_get_xu_section_offset	call site: 00969	_dwarf_error_string
11	997	fill_in_dwp_offsets_if_present	call site: 00997	_dwarf_get_debugfission_for_offset
10	864	_dwarf_make_CU_Context	call site: 00864	report_local_unit_type_error
10	1479	_dwarf_get_string_from_tied	call site: 01479	_dwarf_load_section
8	1641	_dwarf_next_cu_header_internal	call site: 01641	_dwarf_extract_address_from_debug_addr

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

56

Reachable functions

351

Percentage of reachable functions covered

84.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	18.6%
gold	[1:9]	33	5.0%
yellow	[10:29]	37	5.60%
greenyellow	[30:49]	11	1.66%
lawngreen	50+	456	69.0%
All colors	660	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

40

Reachable functions

208

Percentage of reachable functions covered

80.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	129	17.5%
gold	[1:9]	38	5.17%
yellow	[10:29]	37	5.03%
greenyellow	[30:49]	20	2.72%
lawngreen	50+	511	69.5%
All colors	735	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
5	691	dwarf_get_macro_details	call site: 00691	_dwarf_error
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

32

Reachable functions

217

Percentage of reachable functions covered

85.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	18.2%
gold	[1:9]	26	3.20%
yellow	[10:29]	33	4.06%
greenyellow	[30:49]	29	3.57%
lawngreen	50+	576	70.9%
All colors	812	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	670	_dwarf_extract_buildid	call site: 00670	_dwarf_error_string
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	719	_dwarf_construct_linkedto_path	call site: 00719	transform_leading_windowsletter
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length

Runtime coverage analysis

Covered functions

213

Functions that are reachable but not covered

42

Reachable functions

230

Percentage of reachable functions covered

81.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	521	30.5%
gold	[1:9]	156	9.16%
yellow	[10:29]	107	6.28%
greenyellow	[30:49]	61	3.58%
lawngreen	50+	858	50.3%
All colors	1703	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	1434	dwarf_offdie_b	call site: 01434	_dwarf_fill_in_attr_form_abtable
29	1174	_dwarf_get_size_of_val	call site: 01174	_dwarf_error_string
26	1504	_dwarf_extract_string_offset_via_str_offsets	call site: 01504	_dwarf_trial_read_dwarf_five_hdr
19	1124	_dwarf_leb128_sword_wrapper	call site: 01124	_dwarf_get_size_of_val
17	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
16	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_error_string
13	1077	_dwarf_count_abbrev_entries	call site: 01077	_dwarf_fill_in_attr_form_abtable
12	899	dwarf_get_debugfission_for_key	call site: 00899	_dwarf_error_string
11	965	dwarf_get_xu_section_offset	call site: 00965	_dwarf_error_string
11	993	fill_in_dwp_offsets_if_present	call site: 00993	_dwarf_get_debugfission_for_offset
10	860	_dwarf_make_CU_Context	call site: 00860	report_local_unit_type_error
10	1475	_dwarf_get_string_from_tied	call site: 01475	_dwarf_load_section

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

57

Reachable functions

352

Percentage of reachable functions covered

83.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	20
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_die_cu_e

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	518	30.7%
gold	[1:9]	185	10.9%
yellow	[10:29]	96	5.69%
greenyellow	[30:49]	45	2.66%
lawngreen	50+	842	49.9%
All colors	1686	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1415	_dwarf_create_a_new_cu_context_record_on_list	call site: 01415	dwarf_offdie_b
29	1174	_dwarf_get_size_of_val	call site: 01174	_dwarf_error_string
21	1508	_dwarf_trial_read_dwarf_five_hdr	call site: 01508	emit_invalid_dw5tab
19	1124	_dwarf_leb128_sword_wrapper	call site: 01124	_dwarf_get_size_of_val
16	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_error_string
16	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
13	1077	_dwarf_count_abbrev_entries	call site: 01077	_dwarf_fill_in_attr_form_abtable
12	899	dwarf_get_debugfission_for_key	call site: 00899	_dwarf_error_string
11	965	dwarf_get_xu_section_offset	call site: 00965	_dwarf_error_string
11	993	fill_in_dwp_offsets_if_present	call site: 00993	_dwarf_get_debugfission_for_offset
10	860	_dwarf_make_CU_Context	call site: 00860	report_local_unit_type_error
10	1475	_dwarf_get_string_from_tied	call site: 01475	_dwarf_load_section

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

56

Reachable functions

348

Percentage of reachable functions covered

83.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	533	28.0%
gold	[1:9]	181	9.52%
yellow	[10:29]	105	5.52%
greenyellow	[30:49]	49	2.57%
lawngreen	50+	1032	54.3%
All colors	1900	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	1179	_dwarf_next_die_info_ptr	call site: 01179	_dwarf_error_string
21	1508	_dwarf_trial_read_dwarf_five_hdr	call site: 01508	emit_invalid_dw5tab
17	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
16	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_error_string
16	1450	dwarf_die_CU_offset	call site: 01450	dwarf_dealloc_die
15	1706	dwarfstring_append_printf_i	call site: 01706	_dwarfstring_append_spaces
12	899	dwarf_get_debugfission_for_key	call site: 00899	_dwarf_error_string
12	1434	dwarf_offdie_b	call site: 01434	_dwarf_fill_in_attr_form_abtable
11	965	dwarf_get_xu_section_offset	call site: 00965	_dwarf_error_string
11	993	fill_in_dwp_offsets_if_present	call site: 00993	_dwarf_get_debugfission_for_offset
11	1855	dwarf_discr_list	call site: 01855	_dwarf_error
10	860	_dwarf_make_CU_Context	call site: 00860	report_local_unit_type_error

Runtime coverage analysis

Covered functions

363

Functions that are reachable but not covered

49

Reachable functions

382

Percentage of reachable functions covered

87.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	38
src/lib/libdwarf/dwarf_query.c	37
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	25
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	829	37.7%
gold	[1:9]	219	9.97%
yellow	[10:29]	129	5.87%
greenyellow	[30:49]	49	2.23%
lawngreen	50+	969	44.1%
All colors	2195	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1415	_dwarf_create_a_new_cu_context_record_on_list	call site: 01415	dwarf_offdie_b
46	946	dwarf_get_xu_section_offset	call site: 00946	_dwarf_find_xu_target_sec_size
43	1733	_dwarf_get_fission_addition_die	call site: 01733	_dwarf_get_loclist_lle_count_dwo
43	2077	_dwarf_loclists_fill_in_lle_head	call site: 02077	build_array_of_lle
30	2139	dwarf_highpc_b	call site: 02139	_dwarf_die_attr_unsigned_constant
29	1174	_dwarf_get_size_of_val	call site: 01174	_dwarf_error_string
26	1504	_dwarf_extract_string_offset_via_str_offsets	call site: 01504	_dwarf_trial_read_dwarf_five_hdr
20	2005	dwarf_get_loclist_c	call site: 02005	cook_gnu_loclist_contents
19	1124	_dwarf_leb128_sword_wrapper	call site: 01124	_dwarf_get_size_of_val
17	1620	_dwarf_look_in_local_and_tied_by_index	call site: 01620	_dwarf_get_addr_from_tied
17	1664	_dwarf_find_all_offsets_via_fission	call site: 01664	load_xu_loclists_into_cucontext
17	1815	_dwarf_fill_in_locdesc_op_c	call site: 01815	_dwarf_error_string

Runtime coverage analysis

Covered functions

349

Functions that are reachable but not covered

80

Reachable functions

398

Percentage of reachable functions covered

79.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	20
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	27
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	4
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	24
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	24
src/lib/libdwarf/dwarf_locationop_read.c	2