High level conclusions

Fuzzers reach 80.57% code coverage.

Fuzzers reach 83.06% of cyclomatic complexity.

Fuzzers reach 79.80% of all functions.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 15.38% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.045% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

723 / 906

Cyclomatic complexity statically reachable by fuzzers

7823 / 9418

Runtime code coverage of functions

730 / 906

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1198	98.1%
gold	[1:9]	22	1.80%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.08%
All colors	1221	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
513	226	dwarf_get_debugfission_for_key	call site: 00226	dwarf_offdie_b
312	740	get_attr_dbg	call site: 00740	set_producer_type
181	44	_dwarf_error	call site: 00044	dwarf_get_debugfission_for_key
100	1053	dwarf_formaddr	call site: 01053	_dwarf_look_in_local_and_tied
60	1158	dwarf_finish	call site: 01158	dwarf_object_finish
20	9	dwarf_die_from_hash_signature	call site: 00009	_dwarf_get_alloc
11	32	_dwarf_error_string	call site: 00032	_dwarf_load_debug_info
1	3	LLVMFuzzerTestOneInput	call site: 00003	printf

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

207

Reachable functions

218

Percentage of reachable functions covered

5.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_xu_index.c	12
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.4%
gold	[1:9]	24	3.68%
yellow	[10:29]	22	3.37%
greenyellow	[30:49]	26	3.99%
lawngreen	50+	459	70.5%
All colors	651	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

39

Reachable functions

206

Percentage of reachable functions covered

81.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	133	18.6%
gold	[1:9]	48	6.73%
yellow	[10:29]	38	5.32%
greenyellow	[30:49]	28	3.92%
lawngreen	50+	466	65.3%
All colors	713	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
7	652	dwarf_debug_addr_table	call site: 00652	_dwarf_error_string
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length

Runtime coverage analysis

Covered functions

199

Functions that are reachable but not covered

40

Reachable functions

210

Percentage of reachable functions covered

80.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	16.1%
gold	[1:9]	23	3.50%
yellow	[10:29]	34	5.18%
greenyellow	[30:49]	21	3.20%
lawngreen	50+	472	71.9%
All colors	656	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	415	dwarfstring_append_printf_s	call site: 00415	_dwarfstring_append_spaces
7	480	dwarf_get_xu_index_header	call site: 00480	_dwarf_error_string
6	266	_dwarf_load_section	call site: 00266	_dwarf_error
6	439	dwarfstring_append_printf_u	call site: 00439	_dwarfstring_append_spaces
5	31	dwarfstring_append_length	call site: 00031	_dwarf_get_alloc
5	257	_dwarf_determine_section_allocation_type	call site: 00257	_dwarf_error_string
5	433	dwarfstring_append_printf_u	call site: 00433	dwarfstring_append_length
4	273	insert_sht_list_in_group_map	call site: 00273	_dwarf_error
4	279	insert_sht_list_in_group_map	call site: 00279	_dwarf_error
4	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
3	68	_dwarf_elf_object_access_internals_init	call site: 00068	_dwarf_closer
3	191	_dwarf_tfind	call site: 00191	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

197

Functions that are reachable but not covered

34

Reachable functions

207

Percentage of reachable functions covered

83.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.4%
gold	[1:9]	24	3.69%
yellow	[10:29]	28	4.30%
greenyellow	[30:49]	25	3.84%
lawngreen	50+	453	69.6%
All colors	650	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

191

Functions that are reachable but not covered

40

Reachable functions

206

Percentage of reachable functions covered

80.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	313	22.2%
gold	[1:9]	37	2.62%
yellow	[10:29]	47	3.33%
greenyellow	[30:49]	43	3.05%
lawngreen	50+	968	68.7%
All colors	1408	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	792	_dwarf_create_cie_from_after_start	call site: 00792	dwarfstring_append_printf_u
11	1209	_dwarf_exec_frame_instr	call site: 01209	_dwarf_error
10	828	_dwarf_create_fde_from_after_start	call site: 00828	_dwarf_error_string
8	930	_dwarf_get_fde_info_for_a_pc_row	call site: 00930	_dwarf_error
7	415	dwarfstring_append_printf_s	call site: 00415	_dwarfstring_append_spaces
7	480	dwarf_get_xu_index_header	call site: 00480	_dwarf_error_string
6	266	_dwarf_load_section	call site: 00266	_dwarf_error
6	439	dwarfstring_append_printf_u	call site: 00439	_dwarfstring_append_spaces
5	31	dwarfstring_append_length	call site: 00031	_dwarf_get_alloc
5	257	_dwarf_determine_section_allocation_type	call site: 00257	_dwarf_error_string
5	433	dwarfstring_append_printf_u	call site: 00433	dwarfstring_append_length
5	896	print_fde_selected_regs	call site: 00896	_dwarf_error

Runtime coverage analysis

Covered functions

281

Functions that are reachable but not covered

39

Reachable functions

286

Percentage of reachable functions covered

86.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	3
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	33
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_frame_cfa_read.c	3
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	168	18.8%
gold	[1:9]	26	2.92%
yellow	[10:29]	8	0.89%
greenyellow	[30:49]	21	2.35%
lawngreen	50+	667	74.9%
All colors	890	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	354	_dwarf_debuglink_finder_newpath	call site: 00354	dwarf_gnu_debuglink
8	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_error_string
7	714	dwarf_get_xu_index_header	call site: 00714	_dwarf_error_string
6	524	insert_sht_list_in_group_map	call site: 00524	_dwarf_error
5	192	dwarfstring_append_printf_u	call site: 00192	dwarfstring_append_length
5	673	dwarfstring_append_printf_s	call site: 00673	_dwarfstring_append_spaces
4	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_set_load_preference
4	95	dwarf_add_debuglink_global_path	call site: 00095	dwarf_finish
4	187	dwarfstring_append_printf_u	call site: 00187	dwarfstring_append_length
4	198	dwarfstring_append_printf_u	call site: 00198	_dwarfstring_append_spaces
4	384	dwarf_object_detector_path_b	call site: 00384	_dwarf_closer
4	531	insert_sht_list_in_group_map	call site: 00531	_dwarf_error

Runtime coverage analysis

Covered functions

233

Functions that are reachable but not covered

37

Reachable functions

245

Percentage of reachable functions covered

84.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_e

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	529	31.4%
gold	[1:9]	179	10.6%
yellow	[10:29]	74	4.40%
greenyellow	[30:49]	59	3.50%
lawngreen	50+	840	49.9%
All colors	1681	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1410	_dwarf_create_a_new_cu_context_record_on_list	call site: 01410	dwarf_offdie_b
29	1169	_dwarf_get_size_of_val	call site: 01169	_dwarf_error_string
21	1503	_dwarf_trial_read_dwarf_five_hdr	call site: 01503	emit_invalid_dw5tab
19	1118	_dwarf_leb128_sword_wrapper	call site: 01118	_dwarf_get_size_of_val
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
16	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
13	1071	_dwarf_count_abbrev_entries	call site: 01071	_dwarf_fill_in_attr_form_abtable
12	894	dwarf_get_debugfission_for_key	call site: 00894	_dwarf_error_string
11	789	reloc_incomplete	call site: 00789	dwarf_insert_harmless_error
11	960	dwarf_get_xu_section_offset	call site: 00960	_dwarf_error_string
11	988	fill_in_dwp_offsets_if_present	call site: 00988	_dwarf_get_debugfission_for_offset
10	855	_dwarf_make_CU_Context	call site: 00855	report_local_unit_type_error

Runtime coverage analysis

Covered functions

317

Functions that are reachable but not covered

58

Reachable functions

346

Percentage of reachable functions covered

83.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	136	18.2%
gold	[1:9]	38	5.10%
yellow	[10:29]	35	4.70%
greenyellow	[30:49]	23	3.09%
lawngreen	50+	512	68.8%
All colors	744	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	665	dwarfstring_append_printf_i	call site: 00665	_dwarfstring_append_spaces
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

33

Reachable functions

221

Percentage of reachable functions covered

85.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	264	22.5%
gold	[1:9]	72	6.14%
yellow	[10:29]	64	5.46%
greenyellow	[30:49]	26	2.21%
lawngreen	50+	746	63.6%
All colors	1172	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	1061	_dwarf_formudata_internal	call site: 01061	dwarf_formsdata
8	972	fill_in_abbrevs_table	call site: 00972	dwarfstring_append_printf_u
8	1018	dwarf_dnames_name	call site: 01018	_dwarf_error_string
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
7	1039	_dwarf_internal_get_debug_names_globals	call site: 01039	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	655	dwarf_globals_by_type	call site: 00655	_dwarf_error_string
6	889	_dwarf_internal_get_pubnames_like	call site: 00889	_dwarf_error
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length

Runtime coverage analysis

Covered functions

268

Functions that are reachable but not covered

37

Reachable functions

275

Percentage of reachable functions covered

86.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	527	31.0%
gold	[1:9]	150	8.83%
yellow	[10:29]	108	6.36%
greenyellow	[30:49]	56	3.29%
lawngreen	50+	857	50.4%
All colors	1698	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	1429	dwarf_offdie_b	call site: 01429	_dwarf_fill_in_attr_form_abtable
29	1169	_dwarf_get_size_of_val	call site: 01169	_dwarf_error_string
26	1499	_dwarf_extract_string_offset_via_str_offsets	call site: 01499	_dwarf_trial_read_dwarf_five_hdr
19	1118	_dwarf_leb128_sword_wrapper	call site: 01118	_dwarf_get_size_of_val
17	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
12	894	dwarf_get_debugfission_for_key	call site: 00894	_dwarf_error_string
11	789	reloc_incomplete	call site: 00789	dwarf_insert_harmless_error
11	960	dwarf_get_xu_section_offset	call site: 00960	_dwarf_error_string
11	988	fill_in_dwp_offsets_if_present	call site: 00988	_dwarf_get_debugfission_for_offset
10	855	_dwarf_make_CU_Context	call site: 00855	report_local_unit_type_error
10	1470	_dwarf_get_string_from_tied	call site: 01470	_dwarf_load_section

Runtime coverage analysis

Covered functions

320

Functions that are reachable but not covered

59

Reachable functions

350

Percentage of reachable functions covered

83.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	603	27.3%
gold	[1:9]	258	11.7%
yellow	[10:29]	123	5.58%
greenyellow	[30:49]	93	4.22%
lawngreen	50+	1124	51.0%
All colors	2201	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
38	1768	_dwarf_read_line_table_header	call site: 01768	dwarfstring_append_printf_i
29	1169	_dwarf_get_size_of_val	call site: 01169	_dwarf_error_string
19	1118	_dwarf_leb128_sword_wrapper	call site: 01118	_dwarf_get_size_of_val
17	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
17	2101	read_operands_table	call site: 02101	validate_opcode
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
13	1071	_dwarf_count_abbrev_entries	call site: 01071	_dwarf_fill_in_attr_form_abtable
12	894	dwarf_get_debugfission_for_key	call site: 00894	_dwarf_error_string
11	789	reloc_incomplete	call site: 00789	dwarf_insert_harmless_error
11	960	dwarf_get_xu_section_offset	call site: 00960	_dwarf_error_string
10	855	_dwarf_make_CU_Context	call site: 00855	report_local_unit_type_error
10	1470	_dwarf_get_string_from_tied	call site: 01470	_dwarf_load_section

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

50

Reachable functions

399

Percentage of reachable functions covered

87.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	13
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	163	20.6%
gold	[1:9]	46	5.82%
yellow	[10:29]	45	5.69%
greenyellow	[30:49]	30	3.79%
lawngreen	50+	506	64.0%
All colors	790	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	751	dwarf_get_rnglist_rle	call site: 00751	_dwarf_error_string
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
7	737	dwarf_get_rnglist_offset_index_value	call site: 00737	_dwarf_error_string
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
5	655	internal_load_rnglists_contexts	call site: 00655	_dwarf_error_string
5	707	_dwarf_read_unaligned_ck_wrapper	call site: 00707	_dwarf_error_string

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

38

Reachable functions

217

Percentage of reachable functions covered

82.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	10
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	157	18.9%
gold	[1:9]	40	4.83%
yellow	[10:29]	47	5.67%
greenyellow	[30:49]	23	2.77%
lawngreen	50+	561	67.7%
All colors	828	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	730	fill_in_abbrevs_table	call site: 00730	dwarfstring_append_printf_u
8	811	dwarf_dnames_name	call site: 00811	_dwarf_error_string
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
5	755	LLVMFuzzerTestOneInput	call site: 00755	dwarf_finish
5	761	LLVMFuzzerTestOneInput	call site: 00761	dwarf_finish
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error

Runtime coverage analysis

Covered functions

229

Functions that are reachable but not covered

33

Reachable functions

232

Percentage of reachable functions covered

85.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	643	34.5%
gold	[1:9]	182	9.77%
yellow	[10:29]	151	8.10%
greenyellow	[30:49]	59	3.16%
lawngreen	50+	827	44.4%
All colors	1862	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1410	_dwarf_create_a_new_cu_context_record_on_list	call site: 01410	dwarf_offdie_b
29	1169	_dwarf_get_size_of_val	call site: 01169	_dwarf_error_string
27	1719	dwarf_get_fde_for_die	call site: 01719	_dwarf_read_encoded_ptr
26	1499	_dwarf_extract_string_offset_via_str_offsets	call site: 01499	_dwarf_trial_read_dwarf_five_hdr
22	1825	_dwarf_create_cie_from_after_start	call site: 01825	_dwarf_gnu_aug_encodings
19	1118	_dwarf_leb128_sword_wrapper	call site: 01118	_dwarf_get_size_of_val
17	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
15	1765	_dwarf_create_fde_from_after_start	call site: 01765	_dwarf_error_string
12	894	dwarf_get_debugfission_for_key	call site: 00894	_dwarf_error_string
12	1748	_dwarf_create_fde_from_after_start	call site: 01748	_dwarf_error
11	789	reloc_incomplete	call site: 00789	dwarf_insert_harmless_error

Runtime coverage analysis

Covered functions

329

Functions that are reachable but not covered

62

Reachable functions

360

Percentage of reachable functions covered

82.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	18.3%
gold	[1:9]	32	3.96%
yellow	[10:29]	22	2.72%
greenyellow	[30:49]	27	3.34%
lawngreen	50+	578	71.6%
All colors	807	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	665	_dwarf_extract_buildid	call site: 00665	_dwarf_error_string
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	714	_dwarf_construct_linkedto_path	call site: 00714	transform_leading_windowsletter
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length

Runtime coverage analysis

Covered functions

212

Functions that are reachable but not covered

42

Reachable functions

229

Percentage of reachable functions covered

81.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	856	32.1%
gold	[1:9]	171	6.43%
yellow	[10:29]	116	4.36%
greenyellow	[30:49]	73	2.74%
lawngreen	50+	1443	54.2%
All colors	2659	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
108	282	_dwarf_pathjoinl	call site: 00282	_dwarf_debuglink_finder_newpath
61	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_construct_linkedto_path
24	1411	_dwarf_next_die_info_ptr	call site: 01411	_dwarf_error_string
19	2012	dwarf_get_ranges_b	call site: 02012	_dwarf_load_section
18	2450	read_line_table_program	call site: 02450	_dwarf_error
17	1849	_dwarf_look_in_local_and_tied_by_index	call site: 01849	_dwarf_get_addr_from_tied
16	1181	dwarf_get_xu_section_offset	call site: 01181	_dwarf_error_string
15	2151	_dwarf_read_line_table_header	call site: 02151	_dwarf_error_string
15	2569	_dwarf_filename	call site: 02569	_dwarf_error_string
14	1962	dwarfstring_append_printf_i	call site: 01962	_dwarfstring_append_spaces
12	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_object_detector_path_dSYM
11	1030	reloc_incomplete	call site: 01030	dwarf_insert_harmless_error

Runtime coverage analysis

Covered functions

410

Functions that are reachable but not covered

71

Reachable functions

450

Percentage of reachable functions covered

84.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	35
src/lib/libdwarf/dwarf_query.c	27
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	27
src/lib/libdwarf/dwarf_line_table_reader_common.h	6

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	7.69%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	92.3%
All colors	13	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	3	LLVMFuzzerTestOneInput	call site: 00003	printf

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

11

Reachable functions

13

Percentage of reachable functions covered

15.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_die_cu_e_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	522	30.5%
gold	[1:9]	188	11.0%
yellow	[10:29]	92	5.38%
greenyellow	[30:49]	53	3.10%
lawngreen	50+	854	49.9%
All colors	1709	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1414	_dwarf_create_a_new_cu_context_record_on_list	call site: 01414	dwarf_offdie_b
25	1503	_dwarf_extract_string_offset_via_str_offsets	call site: 01503	_dwarf_trial_read_dwarf_five_hdr
24	1178	_dwarf_next_die_info_ptr	call site: 01178	_dwarf_error_string
16	945	dwarf_get_xu_section_offset	call site: 00945	_dwarf_error_string
16	1618	_dwarf_look_in_local_and_tied_by_index	call site: 01618	_dwarf_get_addr_from_tied
13	1127	_dwarf_next_die_info_ptr	call site: 01127	_dwarf_error
12	898	dwarf_get_debugfission_for_key	call site: 00898	_dwarf_error_string
11	793	reloc_incomplete	call site: 00793	dwarf_insert_harmless_error
11	964	dwarf_get_xu_section_offset	call site: 00964	_dwarf_error_string
11	992	fill_in_dwp_offsets_if_present	call site: 00992	_dwarf_get_debugfission_for_offset
10	859	_dwarf_make_CU_Context	call site: 00859	report_local_unit_type_error
10	1474	_dwarf_get_string_from_tied	call site: 01474	_dwarf_load_section

Runtime coverage analysis

Covered functions

320

Functions that are reachable but not covered

58

Reachable functions

349

Percentage of reachable functions covered

83.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	152	17.5%
gold	[1:9]	77	8.89%
yellow	[10:29]	50	5.77%
greenyellow	[30:49]	32	3.69%
lawngreen	50+	555	64.0%
All colors	866	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	831	_dwarf_get_aranges_list	call site: 00831	free_aranges_chain
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
5	665	internal_load_rnglists_contexts	call site: 00665	_dwarf_error_string
5	717	_dwarf_read_unaligned_ck_wrapper	call site: 00717	_dwarf_error_string
5	736	internal_load_rnglists_contexts	call site: 00736	free_rnglists_chain
5	780	internal_load_loclists_contexts	call site: 00780	free_loclists_chain

Runtime coverage analysis

Covered functions

225

Functions that are reachable but not covered

31

Reachable functions

227

Percentage of reachable functions covered

86.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	112	16.9%
gold	[1:9]	22	3.32%
yellow	[10:29]	28	4.23%
greenyellow	[30:49]	24	3.63%
lawngreen	50+	475	71.8%
All colors	661	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	649	dwarf_crc32	call site: 00649	_dwarf_error_string
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

199

Functions that are reachable but not covered

34

Reachable functions

208

Percentage of reachable functions covered

83.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	157	18.3%
gold	[1:9]	70	8.16%
yellow	[10:29]	48	5.60%
greenyellow	[30:49]	29	3.38%
lawngreen	50+	553	64.5%
All colors	857	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	804	dwarf_get_gnu_index_head	call site: 00804	build_errm_no_v
9	833	_dwarf_count_entries_in_block	call site: 00833	build_errm_no_v
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
5	665	internal_load_rnglists_contexts	call site: 00665	_dwarf_error_string
5	717	_dwarf_read_unaligned_ck_wrapper	call site: 00717	_dwarf_error_string
5	736	internal_load_rnglists_contexts	call site: 00736	free_rnglists_chain

Runtime coverage analysis

Covered functions

229

Functions that are reachable but not covered

33

Reachable functions

232

Percentage of reachable functions covered

85.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	4
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	544	28.7%
gold	[1:9]	161	8.49%
yellow	[10:29]	85	4.48%
greenyellow	[30:49]	79	4.16%
lawngreen	50+	1026	54.1%
All colors	1895	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	1174	_dwarf_next_die_info_ptr	call site: 01174	_dwarf_error_string
21	1503	_dwarf_trial_read_dwarf_five_hdr	call site: 01503	emit_invalid_dw5tab
17	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
16	1445	dwarf_die_CU_offset	call site: 01445	dwarf_dealloc_die
15	1700	dwarfstring_append_printf_i	call site: 01700	_dwarfstring_append_spaces
12	894	dwarf_get_debugfission_for_key	call site: 00894	_dwarf_error_string
12	1429	dwarf_offdie_b	call site: 01429	_dwarf_fill_in_attr_form_abtable
11	789	reloc_incomplete	call site: 00789	dwarf_insert_harmless_error
11	960	dwarf_get_xu_section_offset	call site: 00960	_dwarf_error_string
11	988	fill_in_dwp_offsets_if_present	call site: 00988	_dwarf_get_debugfission_for_offset
11	1849	dwarf_discr_list	call site: 01849	_dwarf_error

Runtime coverage analysis

Covered functions

359

Functions that are reachable but not covered

51

Reachable functions

380

Percentage of reachable functions covered

86.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	38
src/lib/libdwarf/dwarf_query.c	36
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	25
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	532	31.5%
gold	[1:9]	140	8.29%
yellow	[10:29]	117	6.93%
greenyellow	[30:49]	59	3.49%
lawngreen	50+	840	49.7%
All colors	1688	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1410	_dwarf_create_a_new_cu_context_record_on_list	call site: 01410	dwarf_offdie_b
29	1169	_dwarf_get_size_of_val	call site: 01169	_dwarf_error_string
21	1503	_dwarf_trial_read_dwarf_five_hdr	call site: 01503	emit_invalid_dw5tab
19	1118	_dwarf_leb128_sword_wrapper	call site: 01118	_dwarf_get_size_of_val
17	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
13	1071	_dwarf_count_abbrev_entries	call site: 01071	_dwarf_fill_in_attr_form_abtable
12	894	dwarf_get_debugfission_for_key	call site: 00894	_dwarf_error_string
11	789	reloc_incomplete	call site: 00789	dwarf_insert_harmless_error
11	960	dwarf_get_xu_section_offset	call site: 00960	_dwarf_error_string
11	988	fill_in_dwp_offsets_if_present	call site: 00988	_dwarf_get_debugfission_for_offset
10	855	_dwarf_make_CU_Context	call site: 00855	report_local_unit_type_error

Runtime coverage analysis

Covered functions

317

Functions that are reachable but not covered

59

Reachable functions

347

Percentage of reachable functions covered

83.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	498	29.5%
gold	[1:9]	132	7.82%
yellow	[10:29]	124	7.35%
greenyellow	[30:49]	68	4.03%
lawngreen	50+	864	51.2%
All colors	1686	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1410	_dwarf_create_a_new_cu_context_record_on_list	call site: 01410	dwarf_offdie_b
29	1169	_dwarf_get_size_of_val	call site: 01169	_dwarf_error_string
19	1118	_dwarf_leb128_sword_wrapper	call site: 01118	_dwarf_get_size_of_val
17	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
12	894	dwarf_get_debugfission_for_key	call site: 00894	_dwarf_error_string
11	789	reloc_incomplete	call site: 00789	dwarf_insert_harmless_error
11	960	dwarf_get_xu_section_offset	call site: 00960	_dwarf_error_string
10	855	_dwarf_make_CU_Context	call site: 00855	report_local_unit_type_error
10	1470	_dwarf_get_string_from_tied	call site: 01470	_dwarf_load_section
8	1015	dw_start_load_root_die	call site: 01015	_dwarf_next_die_info_ptr
8	1076	_dwarf_count_abbrev_entries	call site: 01076	_dwarf_fill_in_attr_form_abtable

Runtime coverage analysis

Covered functions

323

Functions that are reachable but not covered

53

Reachable functions

347

Percentage of reachable functions covered

84.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	354	38.8%
gold	[1:9]	26	2.85%
yellow	[10:29]	27	2.96%
greenyellow	[30:49]	33	3.61%
lawngreen	50+	472	51.7%
All colors	912	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
182	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_debuglink_finder_newpath
18	168	_dwarf_load_section	call site: 00168	_dwarf_extract_buildid
12	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_object_detector_path_dSYM
8	198	dwarfstring_append_printf_u	call site: 00198	_dwarfstring_append_spaces
7	714	dwarf_get_xu_index_header	call site: 00714	_dwarf_error_string
6	524	insert_sht_list_in_group_map	call site: 00524	_dwarf_error
6	750	dwarf_object_init_b	call site: 00750	dwarf_dealloc_error
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	72	dwarf_init_path_dl_a	call site: 00072	_dwarf_debuglink_finder_internal
5	157	_dwarf_free_all_of_one_debug	call site: 00157	dwarf_gnu_debuglink
5	192	dwarfstring_append_printf_u	call site: 00192	dwarfstring_append_length
5	673	dwarfstring_append_printf_s	call site: 00673	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

73

Reachable functions

249

Percentage of reachable functions covered

70.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	108	16.3%
gold	[1:9]	14	2.11%
yellow	[10:29]	33	4.98%
greenyellow	[30:49]	28	4.22%
lawngreen	50+	479	72.3%
All colors	662	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer
3	190	_dwarf_tfind	call site: 00190	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

33

Reachable functions

209

Percentage of reachable functions covered

84.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	128	17.4%
gold	[1:9]	26	3.54%
yellow	[10:29]	49	6.67%
greenyellow	[30:49]	25	3.40%
lawngreen	50+	506	68.9%
All colors	734	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	701	examplewgdbindex	call site: 00701	emit_one_value_msg
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer
3	190	_dwarf_tfind	call site: 00190	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

32

Reachable functions

228

Percentage of reachable functions covered

85.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	16.8%
gold	[1:9]	45	6.16%
yellow	[10:29]	30	4.10%
greenyellow	[30:49]	21	2.87%
lawngreen	50+	511	70.0%
All colors	730	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	414	dwarfstring_append_printf_s	call site: 00414	_dwarfstring_append_spaces
7	479	dwarf_get_xu_index_header	call site: 00479	_dwarf_error_string
6	265	_dwarf_load_section	call site: 00265	_dwarf_error
6	438	dwarfstring_append_printf_u	call site: 00438	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	256	_dwarf_determine_section_allocation_type	call site: 00256	_dwarf_error_string
5	432	dwarfstring_append_printf_u	call site: 00432	dwarfstring_append_length
5	686	dwarf_get_macro_details	call site: 00686	_dwarf_error
4	272	insert_sht_list_in_group_map	call site: 00272	_dwarf_error
4	278	insert_sht_list_in_group_map	call site: 00278	_dwarf_error
4	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

213

Functions that are reachable but not covered

32

Reachable functions

216

Percentage of reachable functions covered

85.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	18.7%
gold	[1:9]	26	3.96%
yellow	[10:29]	27	4.12%
greenyellow	[30:49]	30	4.58%
lawngreen	50+	449	68.5%
All colors	655	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	413	dwarfstring_append_printf_s	call site: 00413	_dwarfstring_append_spaces
7	478	dwarf_get_xu_index_header	call site: 00478	_dwarf_error_string
7	514	dwarf_object_init_b	call site: 00514	dwarf_dealloc_error
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	437	dwarfstring_append_printf_u	call site: 00437	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	431	dwarfstring_append_printf_u	call site: 00431	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

40

Reachable functions

207

Percentage of reachable functions covered

80.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	523	30.5%
gold	[1:9]	170	9.91%
yellow	[10:29]	92	5.36%
greenyellow	[30:49]	57	3.32%
lawngreen	50+	872	50.8%
All colors	1714	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1414	_dwarf_create_a_new_cu_context_record_on_list	call site: 01414	dwarf_offdie_b
25	1503	_dwarf_extract_string_offset_via_str_offsets	call site: 01503	_dwarf_trial_read_dwarf_five_hdr
24	1178	_dwarf_next_die_info_ptr	call site: 01178	_dwarf_error_string
17	1618	_dwarf_look_in_local_and_tied_by_index	call site: 01618	_dwarf_get_addr_from_tied
16	945	dwarf_get_xu_section_offset	call site: 00945	_dwarf_error_string
13	1127	_dwarf_next_die_info_ptr	call site: 01127	_dwarf_error
12	898	dwarf_get_debugfission_for_key	call site: 00898	_dwarf_error_string
11	793	reloc_incomplete	call site: 00793	dwarf_insert_harmless_error
11	964	dwarf_get_xu_section_offset	call site: 00964	_dwarf_error_string
11	992	fill_in_dwp_offsets_if_present	call site: 00992	_dwarf_get_debugfission_for_offset
11	1075	_dwarf_count_abbrev_entries	call site: 01075	_dwarf_error_string
10	859	_dwarf_make_CU_Context	call site: 00859	report_local_unit_type_error

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

58

Reachable functions

350

Percentage of reachable functions covered

83.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	807	36.8%
gold	[1:9]	218	9.96%
yellow	[10:29]	80	3.65%
greenyellow	[30:49]	75	3.42%
lawngreen	50+	1008	46.0%
All colors	2188	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1410	_dwarf_create_a_new_cu_context_record_on_list	call site: 01410	dwarf_offdie_b
44	2070	_dwarf_loclists_fill_in_lle_head	call site: 02070	build_array_of_lle
43	1728	_dwarf_get_fission_addition_die	call site: 01728	_dwarf_get_loclist_lle_count_dwo
29	1169	_dwarf_get_size_of_val	call site: 01169	_dwarf_error_string
29	2133	dwarf_highpc_b	call site: 02133	_dwarf_die_attr_unsigned_constant
26	1499	_dwarf_extract_string_offset_via_str_offsets	call site: 01499	_dwarf_trial_read_dwarf_five_hdr
20	1998	dwarf_get_loclist_c	call site: 01998	cook_gnu_loclist_contents
19	1118	_dwarf_leb128_sword_wrapper	call site: 01118	_dwarf_get_size_of_val
17	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
16	1810	_dwarf_fill_in_locdesc_op_c	call site: 01810	_dwarf_error_string
16	1943	dwarfstring_append_printf_i	call site: 01943	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

350

Functions that are reachable but not covered

77

Reachable functions

396

Percentage of reachable functions covered

80.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	26
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	24
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	24
src/lib/libdwarf/dwarf_locationop_read.c	2

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	741	27.1%
gold	[1:9]	216	7.90%
yellow	[10:29]	119	4.35%
greenyellow	[30:49]	82	2.99%
lawngreen	50+	1576	57.6%
All colors	2734	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
29	1169	_dwarf_get_size_of_val	call site: 01169	_dwarf_error_string
24	2404	read_line_table_program	call site: 02404	read_sword_de
21	1503	_dwarf_trial_read_dwarf_five_hdr	call site: 01503	emit_invalid_dw5tab
19	1118	_dwarf_leb128_sword_wrapper	call site: 01118	_dwarf_get_size_of_val
18	2501	read_line_table_program	call site: 02501	_dwarf_error
17	1615	_dwarf_look_in_local_and_tied_by_index	call site: 01615	_dwarf_get_addr_from_tied
16	941	dwarf_get_xu_section_offset	call site: 00941	_dwarf_error_string
15	2699	_dwarf_filename	call site: 02699	_dwarf_error_string
13	1071	_dwarf_count_abbrev_entries	call site: 01071	_dwarf_fill_in_attr_form_abtable
12	894	dwarf_get_debugfission_for_key	call site: 00894	_dwarf_error_string
11	789	reloc_incomplete	call site: 00789	dwarf_insert_harmless_error
11	960	dwarf_get_xu_section_offset	call site: 00960	_dwarf_error_string

Runtime coverage analysis

Covered functions

400

Functions that are reachable but not covered

50

Reachable functions

419

Percentage of reachable functions covered

88.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	39
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	14
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	38
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12