High level conclusions

Fuzzers reach 78.05% code coverage.

Fuzzers reach 83.03% of cyclomatic complexity.

Fuzzers reach 79.71% of all functions.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 15.38% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.022% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

723 / 907

Cyclomatic complexity statically reachable by fuzzers

7832 / 9432

Runtime code coverage of functions

708 / 907

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	20.6%
gold	[1:9]	47	7.24%
yellow	[10:29]	45	6.93%
greenyellow	[30:49]	16	2.46%
lawngreen	50+	407	62.7%
All colors	649	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	473	dwarf_get_xu_index_header	call site: 00473	_dwarf_error_string
7	408	dwarfstring_append_printf_s	call site: 00408	_dwarfstring_append_spaces
7	509	dwarf_object_init_b	call site: 00509	dwarf_dealloc_error
6	261	_dwarf_load_section	call site: 00261	_dwarf_error
6	432	dwarfstring_append_printf_u	call site: 00432	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	252	_dwarf_determine_section_allocation_type	call site: 00252	_dwarf_error_string
5	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
4	65	elf_load_elf_header64	call site: 00065	_dwarf_destruct_elf_nlaccess
4	268	insert_sht_list_in_group_map	call site: 00268	_dwarf_error
4	274	insert_sht_list_in_group_map	call site: 00274	_dwarf_error
4	421	dwarfstring_append_printf_u	call site: 00421	dwarfstring_append_length

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

40

Reachable functions

206

Percentage of reachable functions covered

80.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	254	30.9%
gold	[1:9]	109	13.2%
yellow	[10:29]	87	10.6%
greenyellow	[30:49]	45	5.48%
lawngreen	50+	325	39.6%
All colors	820	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
34	460	dwarf_get_xu_index_header	call site: 00460	_dwarf_error_string
25	786	_dwarf_check_string_valid	call site: 00786	_dwarf_fill_in_attr_form
15	716	fill_in_abbrevs_table	call site: 00716	_dwarf_error_string
9	259	_dwarf_load_section	call site: 00259	_dwarf_error
8	497	dwarf_get_xu_index_header	call site: 00497	_dwarf_error_string
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
6	451	dwarf_get_xu_index_header	call site: 00451	_dwarf_error_string
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
5	737	dwarf_dealloc_dnames	call site: 00737	dwarf_dealloc_dnames

Runtime coverage analysis

Covered functions

219

Functions that are reachable but not covered

40

Reachable functions

231

Percentage of reachable functions covered

82.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	152	17.7%
gold	[1:9]	88	10.2%
yellow	[10:29]	49	5.71%
greenyellow	[30:49]	23	2.68%
lawngreen	50+	546	63.6%
All colors	858	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	823	_dwarf_get_aranges_list	call site: 00823	free_aranges_chain
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
5	659	internal_load_rnglists_contexts	call site: 00659	_dwarf_error_string
5	729	internal_load_rnglists_contexts	call site: 00729	free_rnglists_chain
5	773	internal_load_loclists_contexts	call site: 00773	free_loclists_chain
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error

Runtime coverage analysis

Covered functions

225

Functions that are reachable but not covered

31

Reachable functions

226

Percentage of reachable functions covered

86.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	162	20.6%
gold	[1:9]	39	4.98%
yellow	[10:29]	59	7.53%
greenyellow	[30:49]	18	2.29%
lawngreen	50+	505	64.4%
All colors	783	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	744	dwarf_get_rnglist_rle	call site: 00744	_dwarf_error_string
7	408	dwarfstring_append_printf_s	call site: 00408	_dwarfstring_append_spaces
7	473	dwarf_get_xu_index_header	call site: 00473	_dwarf_error_string
7	509	dwarf_object_init_b	call site: 00509	dwarf_dealloc_error
7	730	dwarf_get_rnglist_offset_index_value	call site: 00730	_dwarf_error_string
6	261	_dwarf_load_section	call site: 00261	_dwarf_error
6	432	dwarfstring_append_printf_u	call site: 00432	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	252	_dwarf_determine_section_allocation_type	call site: 00252	_dwarf_error_string
5	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
5	649	internal_load_rnglists_contexts	call site: 00649	_dwarf_error_string
5	719	internal_load_rnglists_contexts	call site: 00719	free_rnglists_chain

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

38

Reachable functions

216

Percentage of reachable functions covered

82.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	10
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	159	21.9%
gold	[1:9]	61	8.41%
yellow	[10:29]	30	4.13%
greenyellow	[30:49]	12	1.65%
lawngreen	50+	463	63.8%
All colors	725	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
6	451	dwarf_get_xu_index_header	call site: 00451	_dwarf_error_string
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
5	680	dwarf_get_macro_details	call site: 00680	_dwarf_error
5	701	dwarf_get_macro_details	call site: 00701	_dwarf_error
4	66	elf_load_elf_header64	call site: 00066	_dwarf_destruct_elf_nlaccess
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

31

Reachable functions

215

Percentage of reachable functions covered

85.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	523	30.5%
gold	[1:9]	153	8.94%
yellow	[10:29]	110	6.43%
greenyellow	[30:49]	54	3.15%
lawngreen	50+	870	50.8%
All colors	1710	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1409	_dwarf_create_a_new_cu_context_record_on_list	call site: 01409	dwarf_offdie_b
25	1498	_dwarf_extract_string_offset_via_str_offsets	call site: 01498	_dwarf_trial_read_dwarf_five_hdr
24	1171	_dwarf_next_die_info_ptr	call site: 01171	_dwarf_error_string
17	1614	_dwarf_look_in_local_and_tied_by_index	call site: 01614	_dwarf_get_addr_from_tied
16	937	dwarf_get_xu_section_offset	call site: 00937	_dwarf_error_string
13	1120	_dwarf_next_die_info_ptr	call site: 01120	_dwarf_error
12	889	dwarf_get_debugfission_for_key	call site: 00889	_dwarf_error_string
11	785	reloc_incomplete	call site: 00785	dwarf_insert_harmless_error
11	956	dwarf_get_xu_section_offset	call site: 00956	_dwarf_error_string
11	984	fill_in_dwp_offsets_if_present	call site: 00984	_dwarf_get_debugfission_for_offset
11	1068	_dwarf_count_abbrev_entries	call site: 01068	_dwarf_error_string
10	850	_dwarf_make_CU_Context	call site: 00850	report_local_unit_type_error

Runtime coverage analysis

Covered functions

322

Functions that are reachable but not covered

58

Reachable functions

350

Percentage of reachable functions covered

83.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	527	31.1%
gold	[1:9]	148	8.73%
yellow	[10:29]	104	6.13%
greenyellow	[30:49]	50	2.95%
lawngreen	50+	865	51.0%
All colors	1694	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	1424	dwarf_offdie_b	call site: 01424	_dwarf_fill_in_attr_form_abtable
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
26	1494	_dwarf_extract_string_offset_via_str_offsets	call site: 01494	_dwarf_trial_read_dwarf_five_hdr
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
11	980	fill_in_dwp_offsets_if_present	call site: 00980	_dwarf_get_debugfission_for_offset
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error
10	1465	_dwarf_get_string_from_tied	call site: 01465	_dwarf_load_section

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

59

Reachable functions

350

Percentage of reachable functions covered

83.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	888	46.9%
gold	[1:9]	157	8.29%
yellow	[10:29]	62	3.27%
greenyellow	[30:49]	59	3.11%
lawngreen	50+	726	38.3%
All colors	1892	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
47	1480	_dwarf_extract_string_offset_via_str_offsets	call site: 01480	_dwarf_trial_read_dwarf_five_hdr
42	1586	dwarf_formaddr	call site: 01586	_dwarf_look_in_local_and_tied
41	1361	dwarf_formstring	call site: 01361	dwarf_global_formref_b
38	1440	dwarf_die_CU_offset	call site: 01440	_dwarf_get_string_from_tied
35	1683	_dwarf_die_attr_unsigned_constant	call site: 01683	_dwarf_error_string
28	459	dwarf_get_xu_index_header	call site: 00459	_dwarf_error_string
26	923	dwarf_get_xu_section_offset	call site: 00923	_dwarf_error_string
24	1167	_dwarf_next_die_info_ptr	call site: 01167	_dwarf_error_string
22	1549	set_producer_type	call site: 01549	_dwarf_internal_global_formref_b
16	1656	_dwarf_find_all_offsets_via_fission	call site: 01656	load_xu_loclists_into_cucontext
14	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string

Runtime coverage analysis

Covered functions

330

Functions that are reachable but not covered

81

Reachable functions

380

Percentage of reachable functions covered

78.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	38
src/lib/libdwarf/dwarf_query.c	36
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	25
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1201	98.1%
gold	[1:9]	22	1.79%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.08%
All colors	1224	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
516	226	dwarf_get_debugfission_for_key	call site: 00226	dwarf_offdie_b
312	743	get_attr_dbg	call site: 00743	set_producer_type
181	44	_dwarf_error	call site: 00044	dwarf_get_debugfission_for_key
100	1056	dwarf_formaddr	call site: 01056	_dwarf_look_in_local_and_tied
60	1161	dwarf_finish	call site: 01161	dwarf_object_finish
20	9	dwarf_die_from_hash_signature	call site: 00009	_dwarf_get_alloc
11	32	_dwarf_error_string	call site: 00032	_dwarf_load_debug_info
1	3	LLVMFuzzerTestOneInput	call site: 00003	printf

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

208

Reachable functions

219

Percentage of reachable functions covered

5.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_xu_index.c	13
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	921	34.6%
gold	[1:9]	208	7.82%
yellow	[10:29]	124	4.66%
greenyellow	[30:49]	87	3.27%
lawngreen	50+	1318	49.5%
All colors	2658	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
108	282	_dwarf_pathjoinl	call site: 00282	_dwarf_debuglink_finder_newpath
61	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_construct_linkedto_path
24	1403	_dwarf_next_die_info_ptr	call site: 01403	_dwarf_error_string
19	2009	dwarf_get_ranges_b	call site: 02009	_dwarf_load_section
18	2447	read_line_table_program	call site: 02447	_dwarf_error
17	1844	_dwarf_look_in_local_and_tied_by_index	call site: 01844	_dwarf_get_addr_from_tied
16	1172	dwarf_get_xu_section_offset	call site: 01172	_dwarf_error_string
15	2148	_dwarf_read_line_table_header	call site: 02148	_dwarf_error_string
15	2568	_dwarf_filename	call site: 02568	_dwarf_error_string
14	709	dwarf_get_xu_index_header	call site: 00709	_dwarf_error_string
14	1959	dwarfstring_append_printf_i	call site: 01959	_dwarfstring_append_spaces
12	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_object_detector_path_dSYM

Runtime coverage analysis

Covered functions

410

Functions that are reachable but not covered

72

Reachable functions

450

Percentage of reachable functions covered

84.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	35
src/lib/libdwarf/dwarf_query.c	27
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	27
src/lib/libdwarf/dwarf_line_table_reader_common.h	6

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.6%
gold	[1:9]	27	4.18%
yellow	[10:29]	26	4.03%
greenyellow	[30:49]	23	3.56%
lawngreen	50+	449	69.6%
All colors	645	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	408	dwarfstring_append_printf_s	call site: 00408	_dwarfstring_append_spaces
7	473	dwarf_get_xu_index_header	call site: 00473	_dwarf_error_string
7	509	dwarf_object_init_b	call site: 00509	dwarf_dealloc_error
6	261	_dwarf_load_section	call site: 00261	_dwarf_error
6	432	dwarfstring_append_printf_u	call site: 00432	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	252	_dwarf_determine_section_allocation_type	call site: 00252	_dwarf_error_string
5	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
4	268	insert_sht_list_in_group_map	call site: 00268	_dwarf_error
4	274	insert_sht_list_in_group_map	call site: 00274	_dwarf_error
4	421	dwarfstring_append_printf_u	call site: 00421	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

39

Reachable functions

205

Percentage of reachable functions covered

80.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	118	17.9%
gold	[1:9]	43	6.55%
yellow	[10:29]	42	6.40%
greenyellow	[30:49]	6	0.91%
lawngreen	50+	447	68.1%
All colors	656	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	66	elf_load_elf_header64	call site: 00066	_dwarf_destruct_elf_nlaccess
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error
4	422	dwarfstring_append_printf_u	call site: 00422	dwarfstring_append_length
3	187	_dwarf_tfind	call site: 00187	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

33

Reachable functions

208

Percentage of reachable functions covered

84.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_die_cu_e

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	529	31.5%
gold	[1:9]	156	9.30%
yellow	[10:29]	86	5.12%
greenyellow	[30:49]	55	3.27%
lawngreen	50+	851	50.7%
All colors	1677	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
21	1498	_dwarf_trial_read_dwarf_five_hdr	call site: 01498	emit_invalid_dw5tab
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
16	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
13	1064	_dwarf_count_abbrev_entries	call site: 01064	_dwarf_fill_in_attr_form_abtable
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
11	980	fill_in_dwp_offsets_if_present	call site: 00980	_dwarf_get_debugfission_for_offset
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error

Runtime coverage analysis

Covered functions

318

Functions that are reachable but not covered

58

Reachable functions

346

Percentage of reachable functions covered

83.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	18.3%
gold	[1:9]	56	8.61%
yellow	[10:29]	40	6.15%
greenyellow	[30:49]	17	2.61%
lawngreen	50+	418	64.3%
All colors	650	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	434	dwarfstring_append_printf_u	call site: 00434	_dwarfstring_append_spaces
5	31	dwarfstring_append_length	call site: 00031	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
4	67	elf_load_elf_header64	call site: 00067	_dwarf_destruct_elf_nlaccess
4	270	insert_sht_list_in_group_map	call site: 00270	_dwarf_error
4	276	insert_sht_list_in_group_map	call site: 00276	_dwarf_error
4	423	dwarfstring_append_printf_u	call site: 00423	dwarfstring_append_length
3	188	_dwarf_tfind	call site: 00188	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

197

Functions that are reachable but not covered

35

Reachable functions

206

Percentage of reachable functions covered

83.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_e_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	522	30.6%
gold	[1:9]	158	9.26%
yellow	[10:29]	118	6.92%
greenyellow	[30:49]	46	2.69%
lawngreen	50+	861	50.4%
All colors	1705	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1409	_dwarf_create_a_new_cu_context_record_on_list	call site: 01409	dwarf_offdie_b
25	1498	_dwarf_extract_string_offset_via_str_offsets	call site: 01498	_dwarf_trial_read_dwarf_five_hdr
24	1171	_dwarf_next_die_info_ptr	call site: 01171	_dwarf_error_string
16	937	dwarf_get_xu_section_offset	call site: 00937	_dwarf_error_string
16	1614	_dwarf_look_in_local_and_tied_by_index	call site: 01614	_dwarf_get_addr_from_tied
13	1120	_dwarf_next_die_info_ptr	call site: 01120	_dwarf_error
12	889	dwarf_get_debugfission_for_key	call site: 00889	_dwarf_error_string
11	785	reloc_incomplete	call site: 00785	dwarf_insert_harmless_error
11	956	dwarf_get_xu_section_offset	call site: 00956	_dwarf_error_string
11	984	fill_in_dwp_offsets_if_present	call site: 00984	_dwarf_get_debugfission_for_offset
10	850	_dwarf_make_CU_Context	call site: 00850	report_local_unit_type_error
10	1469	_dwarf_get_string_from_tied	call site: 01469	_dwarf_load_section

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

58

Reachable functions

349

Percentage of reachable functions covered

83.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	496	29.4%
gold	[1:9]	144	8.56%
yellow	[10:29]	103	6.12%
greenyellow	[30:49]	76	4.51%
lawngreen	50+	863	51.3%
All colors	1682	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error
10	1465	_dwarf_get_string_from_tied	call site: 01465	_dwarf_load_section
9	1007	dw_start_load_root_die	call site: 01007	_dwarf_next_die_info_ptr
8	1069	_dwarf_count_abbrev_entries	call site: 01069	_dwarf_fill_in_attr_form_abtable

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

53

Reachable functions

347

Percentage of reachable functions covered

84.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	7.69%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	92.3%
All colors	13	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	3	LLVMFuzzerTestOneInput	call site: 00003	printf

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

11

Reachable functions

13

Percentage of reachable functions covered

15.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	187	22.0%
gold	[1:9]	86	10.1%
yellow	[10:29]	41	4.82%
greenyellow	[30:49]	37	4.35%
lawngreen	50+	499	58.7%
All colors	850	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	467	dwarf_get_xu_index_header	call site: 00467	_dwarf_error_string
10	796	dwarf_get_gnu_index_head	call site: 00796	build_errm_no_v
9	826	_dwarf_count_entries_in_block	call site: 00826	build_errm_no_v
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
6	451	dwarf_get_xu_index_header	call site: 00451	_dwarf_error_string
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
5	659	internal_load_rnglists_contexts	call site: 00659	_dwarf_error_string
5	729	internal_load_rnglists_contexts	call site: 00729	free_rnglists_chain

Runtime coverage analysis

Covered functions

229

Functions that are reachable but not covered

33

Reachable functions

231

Percentage of reachable functions covered

85.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	4
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	132	20.1%
gold	[1:9]	43	6.56%
yellow	[10:29]	46	7.02%
greenyellow	[30:49]	17	2.59%
lawngreen	50+	417	63.6%
All colors	655	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
8	643	dwarf_crc32	call site: 00643	_dwarf_error_string
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	460	dwarf_get_xu_index_header	call site: 00460	_dwarf_error_string
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	66	elf_load_elf_header64	call site: 00066	_dwarf_destruct_elf_nlaccess
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error

Runtime coverage analysis

Covered functions

199

Functions that are reachable but not covered

34

Reachable functions

207

Percentage of reachable functions covered

83.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	502	35.8%
gold	[1:9]	110	7.85%
yellow	[10:29]	67	4.78%
greenyellow	[30:49]	29	2.06%
lawngreen	50+	693	49.4%
All colors	1401	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
15	786	_dwarf_create_cie_from_after_start	call site: 00786	dwarfstring_append_printf_u
15	1115	_dwarf_leb128_sword_wrapper	call site: 01115	_dwarf_leb128_uword_wrapper
13	820	_dwarf_create_fde_from_after_start	call site: 00820	_dwarf_error
11	1147	_dwarf_exec_frame_instr	call site: 01147	_dwarf_leb128_uword_wrapper
11	1202	_dwarf_exec_frame_instr	call site: 01202	_dwarf_error
9	1085	_dwarf_exec_frame_instr	call site: 01085	_dwarf_leb128_uword_wrapper
8	498	dwarf_get_xu_index_header	call site: 00498	_dwarf_error_string
8	732	_dwarf_get_return_address_reg	call site: 00732	_dwarf_error_string
8	742	_dwarf_create_cie_from_after_start	call site: 00742	_dwarf_get_gcc_eh_augmentation
8	923	_dwarf_get_fde_info_for_a_pc_row	call site: 00923	_dwarf_error
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

280

Functions that are reachable but not covered

40

Reachable functions

285

Percentage of reachable functions covered

85.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	3
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	33
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_frame_cfa_read.c	3
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	138	19.5%
gold	[1:9]	39	5.51%
yellow	[10:29]	50	7.07%
greenyellow	[30:49]	26	3.67%
lawngreen	50+	454	64.2%
All colors	707	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	408	dwarfstring_append_printf_s	call site: 00408	_dwarfstring_append_spaces
7	473	dwarf_get_xu_index_header	call site: 00473	_dwarf_error_string
7	509	dwarf_object_init_b	call site: 00509	dwarf_dealloc_error
7	646	dwarf_debug_addr_table	call site: 00646	_dwarf_error_string
6	261	_dwarf_load_section	call site: 00261	_dwarf_error
6	432	dwarfstring_append_printf_u	call site: 00432	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	252	_dwarf_determine_section_allocation_type	call site: 00252	_dwarf_error_string
5	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
5	679	dwarf_debug_addr_table	call site: 00679	_dwarf_error_string
4	268	insert_sht_list_in_group_map	call site: 00268	_dwarf_error
4	274	insert_sht_list_in_group_map	call site: 00274	_dwarf_error

Runtime coverage analysis

Covered functions

199

Functions that are reachable but not covered

40

Reachable functions

209

Percentage of reachable functions covered

80.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1150	61.8%
gold	[1:9]	134	7.20%
yellow	[10:29]	61	3.28%
greenyellow	[30:49]	22	1.18%
lawngreen	50+	492	26.4%
All colors	1859	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
110	883	_dwarf_get_xuhdr	call site: 00883	_dwarf_get_debugfission_for_offset
63	1480	_dwarf_extract_string_offset_via_str_offsets	call site: 01480	_dwarf_extract_local_debug_str_string_given_offset
58	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
55	1573	find_cu_die_base_fields	call site: 01573	_dwarf_setup_base_address
41	1810	_dwarf_get_return_address_reg	call site: 01810	_dwarf_gnu_aug_encodings
38	1153	_dwarf_get_size_of_val	call site: 01153	_dwarf_error_string
34	1102	_dwarf_fill_in_attr_form_abtable	call site: 01102	_dwarf_get_size_of_val
33	1044	_dwarf_count_abbrev_entries	call site: 01044	dwarf_get_AT_name
29	1715	dwarf_get_fde_for_die	call site: 01715	_dwarf_read_encoded_ptr
28	459	dwarf_get_xu_index_header	call site: 00459	_dwarf_error_string
26	1365	_dwarf_internal_global_formref_b	call site: 01365	show_not_ref_error
22	398	dwarf_get_xu_index_header	call site: 00398	dwarfstring_append_printf_u

Runtime coverage analysis

Covered functions

278

Functions that are reachable but not covered

113

Reachable functions

360

Percentage of reachable functions covered

68.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	265	22.8%
gold	[1:9]	72	6.21%
yellow	[10:29]	62	5.34%
greenyellow	[30:49]	24	2.07%
lawngreen	50+	736	63.5%
All colors	1159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	1048	_dwarf_formudata_internal	call site: 01048	dwarf_formsdata
8	959	fill_in_abbrevs_table	call site: 00959	dwarfstring_append_printf_u
8	1004	dwarf_dnames_name	call site: 01004	_dwarf_error_string
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	1026	_dwarf_internal_get_debug_names_globals	call site: 01026	_dwarf_error_string
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	649	dwarf_globals_by_type	call site: 00649	_dwarf_error_string
6	881	_dwarf_internal_get_pubnames_like	call site: 00881	_dwarf_error
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length

Runtime coverage analysis

Covered functions

268

Functions that are reachable but not covered

37

Reachable functions

274

Percentage of reachable functions covered

86.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	601	27.2%
gold	[1:9]	263	11.9%
yellow	[10:29]	135	6.12%
greenyellow	[30:49]	69	3.12%
lawngreen	50+	1137	51.5%
All colors	2205	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
38	1767	_dwarf_read_line_table_header	call site: 01767	dwarfstring_append_printf_i
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
18	2102	read_operands_table	call site: 02102	validate_opcode
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
13	1064	_dwarf_count_abbrev_entries	call site: 01064	_dwarf_fill_in_attr_form_abtable
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error
10	1465	_dwarf_get_string_from_tied	call site: 01465	_dwarf_load_section

Runtime coverage analysis

Covered functions

382

Functions that are reachable but not covered

50

Reachable functions

399

Percentage of reachable functions covered

87.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	13
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	531	31.5%
gold	[1:9]	158	9.38%
yellow	[10:29]	114	6.76%
greenyellow	[30:49]	58	3.44%
lawngreen	50+	823	48.8%
All colors	1684	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
21	1498	_dwarf_trial_read_dwarf_five_hdr	call site: 01498	emit_invalid_dw5tab
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
13	1064	_dwarf_count_abbrev_entries	call site: 01064	_dwarf_fill_in_attr_form_abtable
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
11	980	fill_in_dwp_offsets_if_present	call site: 00980	_dwarf_get_debugfission_for_offset
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error

Runtime coverage analysis

Covered functions

318

Functions that are reachable but not covered

59

Reachable functions

347

Percentage of reachable functions covered

83.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	813	37.1%
gold	[1:9]	199	9.09%
yellow	[10:29]	95	4.34%
greenyellow	[30:49]	86	3.93%
lawngreen	50+	994	45.4%
All colors	2187	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
48	2064	_dwarf_loclists_fill_in_lle_head	call site: 02064	build_array_of_lle
43	1724	_dwarf_get_fission_addition_die	call site: 01724	_dwarf_get_loclist_lle_count_dwo
30	2131	dwarf_highpc_b	call site: 02131	_dwarf_die_attr_unsigned_constant
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
26	1494	_dwarf_extract_string_offset_via_str_offsets	call site: 01494	_dwarf_trial_read_dwarf_five_hdr
20	1993	dwarf_get_loclist_c	call site: 01993	cook_gnu_loclist_contents
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
16	1806	_dwarf_fill_in_locdesc_op_c	call site: 01806	_dwarf_error_string
16	1938	dwarfstring_append_printf_i	call site: 01938	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

351

Functions that are reachable but not covered

77

Reachable functions

396

Percentage of reachable functions covered

80.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	26
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	24
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	24
src/lib/libdwarf/dwarf_locationop_read.c	2

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	136	18.4%
gold	[1:9]	38	5.14%
yellow	[10:29]	42	5.69%
greenyellow	[30:49]	27	3.65%
lawngreen	50+	495	67.0%
All colors	738	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	659	dwarfstring_append_printf_i	call site: 00659	_dwarfstring_append_spaces
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error
4	422	dwarfstring_append_printf_u	call site: 00422	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

33

Reachable functions

220

Percentage of reachable functions covered

85.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	206	23.2%
gold	[1:9]	130	14.6%
yellow	[10:29]	57	6.44%
greenyellow	[30:49]	26	2.93%
lawngreen	50+	466	52.6%
All colors	885	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
30	350	_dwarf_debuglink_finder_internal	call site: 00350	_dwarf_debuglink_finder_newpath
20	703	dwarf_get_xu_index_header	call site: 00703	_dwarf_error_string
8	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_error_string
6	521	insert_sht_list_in_group_map	call site: 00521	_dwarf_error
6	687	dwarf_get_xu_index_header	call site: 00687	_dwarf_error_string
5	192	dwarfstring_append_printf_u	call site: 00192	dwarfstring_append_length
5	668	dwarfstring_append_printf_s	call site: 00668	_dwarfstring_append_spaces
4	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_set_load_preference
4	95	dwarf_add_debuglink_global_path	call site: 00095	dwarf_finish
4	182	_dwarf_extract_buildid	call site: 00182	_dwarf_error
4	187	dwarfstring_append_printf_u	call site: 00187	dwarfstring_append_length
4	198	dwarfstring_append_printf_u	call site: 00198	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

40

Reachable functions

244

Percentage of reachable functions covered

83.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.6%
gold	[1:9]	31	4.81%
yellow	[10:29]	35	5.43%
greenyellow	[30:49]	22	3.41%
lawngreen	50+	436	67.7%
All colors	644	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	408	dwarfstring_append_printf_s	call site: 00408	_dwarfstring_append_spaces
7	473	dwarf_get_xu_index_header	call site: 00473	_dwarf_error_string
7	509	dwarf_object_init_b	call site: 00509	dwarf_dealloc_error
6	261	_dwarf_load_section	call site: 00261	_dwarf_error
6	432	dwarfstring_append_printf_u	call site: 00432	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	252	_dwarf_determine_section_allocation_type	call site: 00252	_dwarf_error_string
5	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
4	268	insert_sht_list_in_group_map	call site: 00268	_dwarf_error
4	274	insert_sht_list_in_group_map	call site: 00274	_dwarf_error
4	421	dwarfstring_append_printf_u	call site: 00421	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

191

Functions that are reachable but not covered

40

Reachable functions

205

Percentage of reachable functions covered

80.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	387	42.6%
gold	[1:9]	39	4.29%
yellow	[10:29]	32	3.52%
greenyellow	[30:49]	13	1.43%
lawngreen	50+	436	48.0%
All colors	907	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
182	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_debuglink_finder_newpath
20	696	dwarf_get_xu_index_header	call site: 00696	_dwarf_error_string
18	168	_dwarf_load_section	call site: 00168	_dwarf_extract_buildid
12	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_object_detector_path_dSYM
8	198	dwarfstring_append_printf_u	call site: 00198	_dwarfstring_append_spaces
7	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
7	733	fill_in_offsets_headerline	call site: 00733	_dwarf_error_string
6	521	insert_sht_list_in_group_map	call site: 00521	_dwarf_error
6	687	dwarf_get_xu_index_header	call site: 00687	_dwarf_error_string
6	745	dwarf_object_init_b	call site: 00745	dwarf_dealloc_error
5	72	dwarf_init_path_dl_a	call site: 00072	_dwarf_debuglink_finder_internal
5	157	_dwarf_free_all_of_one_debug	call site: 00157	dwarf_gnu_debuglink

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

74

Reachable functions

248

Percentage of reachable functions covered

70.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	742	27.1%
gold	[1:9]	233	8.53%
yellow	[10:29]	111	4.06%
greenyellow	[30:49]	60	2.19%
lawngreen	50+	1585	58.0%
All colors	2731	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
24	2406	read_line_table_program	call site: 02406	read_sword_de
21	1498	_dwarf_trial_read_dwarf_five_hdr	call site: 01498	emit_invalid_dw5tab
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
18	2499	read_line_table_program	call site: 02499	_dwarf_error
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
15	2696	_dwarf_filename	call site: 02696	_dwarf_error_string
13	1064	_dwarf_count_abbrev_entries	call site: 01064	_dwarf_fill_in_attr_form_abtable
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string

Runtime coverage analysis

Covered functions

401

Functions that are reachable but not covered

50

Reachable functions

419

Percentage of reachable functions covered

88.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	38
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	244	33.4%
gold	[1:9]	72	9.87%
yellow	[10:29]	40	5.48%
greenyellow	[30:49]	25	3.42%
lawngreen	50+	348	47.7%
All colors	729	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
83	643	LLVMFuzzerTestOneInput	call site: 00643	dwarf_gdbindex_header
28	460	dwarf_get_xu_index_header	call site: 00460	_dwarf_error_string
8	497	dwarf_get_xu_index_header	call site: 00497	_dwarf_error_string
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	451	dwarf_get_xu_index_header	call site: 00451	_dwarf_error_string
5	22	_dwarf_get_alloc	call site: 00022	dwarfstring_append
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error
4	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
4	422	dwarfstring_append_printf_u	call site: 00422	dwarfstring_append_length

Runtime coverage analysis

Covered functions

709

Functions that are reachable but not covered

45

Reachable functions

227

Percentage of reachable functions covered

80.18%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	195	24.3%
gold	[1:9]	163	20.3%
yellow	[10:29]	56	6.99%
greenyellow	[30:49]	27	3.37%
lawngreen	50+	360	44.9%
All colors	801	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	459	dwarf_get_xu_index_header	call site: 00459	_dwarf_error_string
11	658	_dwarf_extract_buildid	call site: 00658	_dwarf_error
8	496	dwarf_get_xu_index_header	call site: 00496	_dwarf_error_string
6	261	_dwarf_load_section	call site: 00261	_dwarf_error
6	450	dwarf_get_xu_index_header	call site: 00450	_dwarf_error_string
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	252	_dwarf_determine_section_allocation_type	call site: 00252	_dwarf_error_string
5	426	dwarfstring_append_printf_u	call site: 00426	dwarfstring_append_length
4	268	insert_sht_list_in_group_map	call site: 00268	_dwarf_error
4	274	insert_sht_list_in_group_map	call site: 00274	_dwarf_error
4	408	dwarfstring_append_printf_s	call site: 00408	_dwarfstring_append_spaces
4	421	dwarfstring_append_printf_u	call site: 00421	dwarfstring_append_length

Runtime coverage analysis

Covered functions

709

Functions that are reachable but not covered

25

Reachable functions

228

Percentage of reachable functions covered

89.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13