High level conclusions

Fuzzers reach 80.68% code coverage.

Fuzzers reach 83.08% of cyclomatic complexity.

Fuzzers reach 79.80% of all functions.

Fuzzer fuzz_simplereader_tu is blocked:

The runtime code coverage of fuzz_simplereader_tu covers 5.022% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_crc is blocked:

The runtime code coverage of fuzz_crc covers 15.38% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

723 / 906

Cyclomatic complexity statically reachable by fuzzers

7844 / 9441

Runtime code coverage of functions

731 / 906

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_crc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	7.69%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	92.3%
All colors	13	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	3	LLVMFuzzerTestOneInput	call site: 00003	printf

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

11

Reachable functions

13

Percentage of reachable functions covered

15.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_debuglink

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	18.4%
gold	[1:9]	20	2.49%
yellow	[10:29]	52	6.49%
greenyellow	[30:49]	32	3.99%
lawngreen	50+	549	68.5%
All colors	801	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	659	_dwarf_extract_buildid	call site: 00659	_dwarf_error_string
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	510	dwarf_object_init_b	call site: 00510	dwarf_dealloc_error
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	708	_dwarf_construct_linkedto_path	call site: 00708	transform_leading_windowsletter
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error
4	422	dwarfstring_append_printf_u	call site: 00422	dwarfstring_append_length

Runtime coverage analysis

Covered functions

212

Functions that are reachable but not covered

42

Reachable functions

228

Percentage of reachable functions covered

81.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debuglink.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_init_b

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	16.3%
gold	[1:9]	20	3.07%
yellow	[10:29]	49	7.53%
greenyellow	[30:49]	7	1.07%
lawngreen	50+	468	72.0%
All colors	650	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	411	dwarfstring_append_printf_s	call site: 00411	_dwarfstring_append_spaces
7	476	dwarf_get_xu_index_header	call site: 00476	_dwarf_error_string
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	435	dwarfstring_append_printf_u	call site: 00435	_dwarfstring_append_spaces
5	31	dwarfstring_append_length	call site: 00031	_dwarf_get_alloc
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	429	dwarfstring_append_printf_u	call site: 00429	dwarfstring_append_length
4	271	insert_sht_list_in_group_map	call site: 00271	_dwarf_error
4	277	insert_sht_list_in_group_map	call site: 00277	_dwarf_error
4	424	dwarfstring_append_printf_u	call site: 00424	dwarfstring_append_length
3	68	_dwarf_elf_object_access_internals_init	call site: 00068	_dwarf_closer
3	189	_dwarf_tfind	call site: 00189	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

34

Reachable functions

206

Percentage of reachable functions covered

83.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_b.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_init_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.6%
gold	[1:9]	24	3.72%
yellow	[10:29]	33	5.12%
greenyellow	[30:49]	21	3.26%
lawngreen	50+	446	69.2%
All colors	644	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	510	dwarf_object_init_b	call site: 00510	dwarf_dealloc_error
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error
4	422	dwarfstring_append_printf_u	call site: 00422	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

191

Functions that are reachable but not covered

40

Reachable functions

205

Percentage of reachable functions covered

80.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_binary.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_offset

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	527	31.1%
gold	[1:9]	136	8.02%
yellow	[10:29]	122	7.20%
greenyellow	[30:49]	43	2.53%
lawngreen	50+	866	51.1%
All colors	1694	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	1424	dwarf_offdie_b	call site: 01424	_dwarf_fill_in_attr_form_abtable
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
26	1494	_dwarf_extract_string_offset_via_str_offsets	call site: 01494	_dwarf_trial_read_dwarf_five_hdr
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
11	980	fill_in_dwp_offsets_if_present	call site: 00980	_dwarf_get_debugfission_for_offset
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error
10	1465	_dwarf_get_string_from_tied	call site: 01465	_dwarf_load_section

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

59

Reachable functions

350

Percentage of reachable functions covered

83.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_offset.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_global.c	2

Fuzzer: fuzz_crc_32

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	112	17.0%
gold	[1:9]	13	1.98%
yellow	[10:29]	42	6.41%
greenyellow	[30:49]	20	3.05%
lawngreen	50+	468	71.4%
All colors	655	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	643	dwarf_crc32	call site: 00643	_dwarf_error_string
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	434	dwarfstring_append_printf_u	call site: 00434	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
4	270	insert_sht_list_in_group_map	call site: 00270	_dwarf_error
4	276	insert_sht_list_in_group_map	call site: 00276	_dwarf_error
4	423	dwarfstring_append_printf_u	call site: 00423	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

199

Functions that are reachable but not covered

34

Reachable functions

207

Percentage of reachable functions covered

83.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_crc_32.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1

Fuzzer: fuzz_die_cu_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	523	30.5%
gold	[1:9]	154	9.00%
yellow	[10:29]	113	6.60%
greenyellow	[30:49]	46	2.69%
lawngreen	50+	874	51.1%
All colors	1710	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1409	_dwarf_create_a_new_cu_context_record_on_list	call site: 01409	dwarf_offdie_b
25	1498	_dwarf_extract_string_offset_via_str_offsets	call site: 01498	_dwarf_trial_read_dwarf_five_hdr
24	1171	_dwarf_next_die_info_ptr	call site: 01171	_dwarf_error_string
17	1614	_dwarf_look_in_local_and_tied_by_index	call site: 01614	_dwarf_get_addr_from_tied
16	937	dwarf_get_xu_section_offset	call site: 00937	_dwarf_error_string
13	1120	_dwarf_next_die_info_ptr	call site: 01120	_dwarf_error
12	889	dwarf_get_debugfission_for_key	call site: 00889	_dwarf_error_string
11	785	reloc_incomplete	call site: 00785	dwarf_insert_harmless_error
11	956	dwarf_get_xu_section_offset	call site: 00956	_dwarf_error_string
11	984	fill_in_dwp_offsets_if_present	call site: 00984	_dwarf_get_debugfission_for_offset
11	1068	_dwarf_count_abbrev_entries	call site: 01068	_dwarf_error_string
10	850	_dwarf_make_CU_Context	call site: 00850	report_local_unit_type_error

Runtime coverage analysis

Covered functions

322

Functions that are reachable but not covered

58

Reachable functions

350

Percentage of reachable functions covered

83.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_set_frame_all

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	312	22.2%
gold	[1:9]	47	3.35%
yellow	[10:29]	34	2.42%
greenyellow	[30:49]	26	1.85%
lawngreen	50+	982	70.0%
All colors	1401	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	786	_dwarf_create_cie_from_after_start	call site: 00786	dwarfstring_append_printf_u
11	1202	_dwarf_exec_frame_instr	call site: 01202	_dwarf_error
10	822	_dwarf_create_fde_from_after_start	call site: 00822	_dwarf_error_string
8	923	_dwarf_get_fde_info_for_a_pc_row	call site: 00923	_dwarf_error
7	411	dwarfstring_append_printf_s	call site: 00411	_dwarfstring_append_spaces
7	476	dwarf_get_xu_index_header	call site: 00476	_dwarf_error_string
6	264	_dwarf_load_section	call site: 00264	_dwarf_error
6	435	dwarfstring_append_printf_u	call site: 00435	_dwarfstring_append_spaces
5	31	dwarfstring_append_length	call site: 00031	_dwarf_get_alloc
5	255	_dwarf_determine_section_allocation_type	call site: 00255	_dwarf_error_string
5	429	dwarfstring_append_printf_u	call site: 00429	dwarfstring_append_length
5	890	print_fde_selected_regs	call site: 00890	_dwarf_error

Runtime coverage analysis

Covered functions

281

Functions that are reachable but not covered

39

Reachable functions

285

Percentage of reachable functions covered

86.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_set_frame_all.c	11
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	3
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_frame.c	33
src/lib/libdwarf/dwarf_frame2.c	17
src/lib/libdwarf/dwarf_die_deliv.c	1
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_frame_cfa_read.c	3
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_macro_dwarf5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	602	27.3%
gold	[1:9]	220	9.97%
yellow	[10:29]	139	6.30%
greenyellow	[30:49]	89	4.03%
lawngreen	50+	1155	52.3%
All colors	2205	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
38	1767	_dwarf_read_line_table_header	call site: 01767	dwarfstring_append_printf_i
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
18	2102	read_operands_table	call site: 02102	validate_opcode
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
13	1064	_dwarf_count_abbrev_entries	call site: 01064	_dwarf_fill_in_attr_form_abtable
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error
10	1465	_dwarf_get_string_from_tied	call site: 01465	_dwarf_load_section

Runtime coverage analysis

Covered functions

382

Functions that are reachable but not covered

50

Reachable functions

399

Percentage of reachable functions covered

87.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf5.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_macro5.c	21
src/lib/libdwarf/dwarf_line.c	13
src/lib/libdwarf/dwarf_line_table_reader_common.h	4

Fuzzer: fuzz_findfuncbypc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	863	32.4%
gold	[1:9]	169	6.35%
yellow	[10:29]	115	4.32%
greenyellow	[30:49]	92	3.45%
lawngreen	50+	1421	53.4%
All colors	2660	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
108	282	_dwarf_pathjoinl	call site: 00282	_dwarf_debuglink_finder_newpath
61	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_construct_linkedto_path
24	1404	_dwarf_next_die_info_ptr	call site: 01404	_dwarf_error_string
19	2011	dwarf_get_ranges_b	call site: 02011	_dwarf_load_section
18	2449	read_line_table_program	call site: 02449	_dwarf_error
17	1845	_dwarf_look_in_local_and_tied_by_index	call site: 01845	_dwarf_get_addr_from_tied
16	1173	dwarf_get_xu_section_offset	call site: 01173	_dwarf_error_string
15	1960	dwarfstring_append_printf_i	call site: 01960	_dwarfstring_append_spaces
15	2150	_dwarf_read_line_table_header	call site: 02150	_dwarf_error_string
15	2570	_dwarf_filename	call site: 02570	_dwarf_error_string
12	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_object_detector_path_dSYM
12	1125	dwarf_get_debugfission_for_key	call site: 01125	_dwarf_error_string

Runtime coverage analysis

Covered functions

411

Functions that are reachable but not covered

71

Reachable functions

450

Percentage of reachable functions covered

84.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_findfuncbypc.c	11
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	35
src/lib/libdwarf/dwarf_query.c	27
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_ranges.c	4
src/lib/libdwarf/dwarf_line.c	27
src/lib/libdwarf/dwarf_line_table_reader_common.h	6

Fuzzer: fuzz_srcfiles

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	744	27.2%
gold	[1:9]	204	7.46%
yellow	[10:29]	133	4.87%
greenyellow	[30:49]	88	3.22%
lawngreen	50+	1562	57.1%
All colors	2731	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
24	2406	read_line_table_program	call site: 02406	read_sword_de
21	1498	_dwarf_trial_read_dwarf_five_hdr	call site: 01498	emit_invalid_dw5tab
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
18	2499	read_line_table_program	call site: 02499	_dwarf_error
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
15	2696	_dwarf_filename	call site: 02696	_dwarf_error_string
13	1064	_dwarf_count_abbrev_entries	call site: 01064	_dwarf_fill_in_attr_form_abtable
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string

Runtime coverage analysis

Covered functions

401

Functions that are reachable but not covered

50

Reachable functions

419

Percentage of reachable functions covered

88.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_srcfiles.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	15
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	21
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	3
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	23
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_line.c	38
src/lib/libdwarf/dwarf_line_table_reader_common.h	6
src/lib/libdwarf/dwarf_print_lines.c	12

Fuzzer: fuzz_tie

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	18.9%
gold	[1:9]	22	3.38%
yellow	[10:29]	30	4.62%
greenyellow	[30:49]	26	4.00%
lawngreen	50+	448	69.0%
All colors	649	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	510	dwarf_object_init_b	call site: 00510	dwarf_dealloc_error
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error
4	422	dwarfstring_append_printf_u	call site: 00422	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

40

Reachable functions

206

Percentage of reachable functions covered

80.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_tie.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_e_print

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	522	30.6%
gold	[1:9]	142	8.32%
yellow	[10:29]	140	8.21%
greenyellow	[30:49]	38	2.22%
lawngreen	50+	863	50.6%
All colors	1705	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1409	_dwarf_create_a_new_cu_context_record_on_list	call site: 01409	dwarf_offdie_b
25	1498	_dwarf_extract_string_offset_via_str_offsets	call site: 01498	_dwarf_trial_read_dwarf_five_hdr
24	1171	_dwarf_next_die_info_ptr	call site: 01171	_dwarf_error_string
16	937	dwarf_get_xu_section_offset	call site: 00937	_dwarf_error_string
16	1614	_dwarf_look_in_local_and_tied_by_index	call site: 01614	_dwarf_get_addr_from_tied
13	1120	_dwarf_next_die_info_ptr	call site: 01120	_dwarf_error
12	889	dwarf_get_debugfission_for_key	call site: 00889	_dwarf_error_string
11	785	reloc_incomplete	call site: 00785	dwarf_insert_harmless_error
11	956	dwarf_get_xu_section_offset	call site: 00956	_dwarf_error_string
11	984	fill_in_dwp_offsets_if_present	call site: 00984	_dwarf_get_debugfission_for_offset
10	850	_dwarf_make_CU_Context	call site: 00850	report_local_unit_type_error
10	1469	_dwarf_get_string_from_tied	call site: 01469	_dwarf_load_section

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

58

Reachable functions

349

Percentage of reachable functions covered

83.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e_print.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_frame.c	1
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_gdbindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	128	17.5%
gold	[1:9]	47	6.44%
yellow	[10:29]	29	3.97%
greenyellow	[30:49]	33	4.52%
lawngreen	50+	492	67.4%
All colors	729	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
4	270	insert_sht_list_in_group_map	call site: 00270	_dwarf_error
4	276	insert_sht_list_in_group_map	call site: 00276	_dwarf_error
4	423	dwarfstring_append_printf_u	call site: 00423	dwarfstring_append_length
4	696	examplewgdbindex	call site: 00696	emit_one_value_msg
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer
3	188	_dwarf_tfind	call site: 00188	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

32

Reachable functions

227

Percentage of reachable functions covered

85.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gdbindex.c	4
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gdbindex.c	17

Fuzzer: fuzz_debug_addr_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	133	18.8%
gold	[1:9]	49	6.93%
yellow	[10:29]	32	4.52%
greenyellow	[30:49]	29	4.10%
lawngreen	50+	464	65.6%
All colors	707	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	510	dwarf_object_init_b	call site: 00510	dwarf_dealloc_error
7	646	dwarf_debug_addr_table	call site: 00646	_dwarf_error_string
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error
4	422	dwarfstring_append_printf_u	call site: 00422	dwarfstring_append_length

Runtime coverage analysis

Covered functions

199

Functions that are reachable but not covered

40

Reachable functions

209

Percentage of reachable functions covered

80.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_addr_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugaddr.c	3

Fuzzer: fuzz_die_cu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	531	31.5%
gold	[1:9]	132	7.83%
yellow	[10:29]	133	7.89%
greenyellow	[30:49]	54	3.20%
lawngreen	50+	834	49.5%
All colors	1684	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
21	1498	_dwarf_trial_read_dwarf_five_hdr	call site: 01498	emit_invalid_dw5tab
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
13	1064	_dwarf_count_abbrev_entries	call site: 01064	_dwarf_fill_in_attr_form_abtable
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
11	980	fill_in_dwp_offsets_if_present	call site: 00980	_dwarf_get_debugfission_for_offset
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error

Runtime coverage analysis

Covered functions

318

Functions that are reachable but not covered

59

Reachable functions

347

Percentage of reachable functions covered

83.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_macro_dwarf4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	124	17.1%
gold	[1:9]	48	6.62%
yellow	[10:29]	22	3.03%
greenyellow	[30:49]	25	3.44%
lawngreen	50+	506	69.7%
All colors	725	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	434	dwarfstring_append_printf_u	call site: 00434	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
5	680	dwarf_get_macro_details	call site: 00680	_dwarf_error
4	270	insert_sht_list_in_group_map	call site: 00270	_dwarf_error
4	276	insert_sht_list_in_group_map	call site: 00276	_dwarf_error
4	423	dwarfstring_append_printf_u	call site: 00423	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

213

Functions that are reachable but not covered

32

Reachable functions

215

Percentage of reachable functions covered

85.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_macro_dwarf4.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_macro.c	5
src/lib/libdwarf/dwarf_leb.c	2

Fuzzer: fuzz_str_offsets

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	135	18.2%
gold	[1:9]	33	4.47%
yellow	[10:29]	38	5.14%
greenyellow	[30:49]	28	3.79%
lawngreen	50+	504	68.2%
All colors	738	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	659	dwarfstring_append_printf_i	call site: 00659	_dwarfstring_append_spaces
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	434	dwarfstring_append_printf_u	call site: 00434	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
4	270	insert_sht_list_in_group_map	call site: 00270	_dwarf_error
4	276	insert_sht_list_in_group_map	call site: 00276	_dwarf_error
4	423	dwarfstring_append_printf_u	call site: 00423	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer

Runtime coverage analysis

Covered functions

215

Functions that are reachable but not covered

32

Reachable functions

220

Percentage of reachable functions covered

85.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_str_offsets.c	2
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_str_offsets.c	11

Fuzzer: fuzz_showsectgrp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	354	39.0%
gold	[1:9]	32	3.52%
yellow	[10:29]	36	3.96%
greenyellow	[30:49]	12	1.32%
lawngreen	50+	473	52.1%
All colors	907	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
182	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_debuglink_finder_newpath
18	168	_dwarf_load_section	call site: 00168	_dwarf_extract_buildid
12	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_object_detector_path_dSYM
8	198	dwarfstring_append_printf_u	call site: 00198	_dwarfstring_append_spaces
7	710	dwarf_get_xu_index_header	call site: 00710	_dwarf_error_string
6	522	insert_sht_list_in_group_map	call site: 00522	_dwarf_error
6	746	dwarf_object_init_b	call site: 00746	dwarf_dealloc_error
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	72	dwarf_init_path_dl_a	call site: 00072	_dwarf_debuglink_finder_internal
5	157	_dwarf_free_all_of_one_debug	call site: 00157	dwarf_gnu_debuglink
5	192	dwarfstring_append_printf_u	call site: 00192	dwarfstring_append_length
5	669	dwarfstring_append_printf_s	call site: 00669	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

73

Reachable functions

248

Percentage of reachable functions covered

70.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_showsectgrp.c	1
src/lib/libdwarf/dwarf_generic_init.c	5
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	14
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_simplereader_tu

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1201	98.1%
gold	[1:9]	22	1.79%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	0.08%
All colors	1224	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
516	226	dwarf_get_debugfission_for_key	call site: 00226	dwarf_offdie_b
312	743	get_attr_dbg	call site: 00743	set_producer_type
181	44	_dwarf_error	call site: 00044	dwarf_get_debugfission_for_key
100	1056	dwarf_formaddr	call site: 01056	_dwarf_look_in_local_and_tied
60	1161	dwarf_finish	call site: 01161	dwarf_object_finish
20	9	dwarf_die_from_hash_signature	call site: 00009	_dwarf_get_alloc
11	32	_dwarf_error_string	call site: 00032	_dwarf_load_debug_info
1	3	LLVMFuzzerTestOneInput	call site: 00003	printf

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

208

Reachable functions

219

Percentage of reachable functions covered

5.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_simplereader_tu.c	1
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	10
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_init_finish.c	2
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_xu_index.c	13
src/lib/libdwarf/dwarf_global.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_generic_init.c	1
src/lib/libdwarf/dwarf_seekr.c	1
src/lib/libdwarf/dwarf_groups.c	2

Fuzzer: fuzz_globals

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	262	22.6%
gold	[1:9]	68	5.86%
yellow	[10:29]	57	4.91%
greenyellow	[30:49]	42	3.62%
lawngreen	50+	730	62.9%
All colors	1159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	1048	_dwarf_formudata_internal	call site: 01048	dwarf_formsdata
8	959	fill_in_abbrevs_table	call site: 00959	dwarfstring_append_printf_u
8	1004	dwarf_dnames_name	call site: 01004	_dwarf_error_string
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
7	1026	_dwarf_internal_get_debug_names_globals	call site: 01026	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	649	dwarf_globals_by_type	call site: 00649	_dwarf_error_string
6	881	_dwarf_internal_get_pubnames_like	call site: 00881	_dwarf_error
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length

Runtime coverage analysis

Covered functions

268

Functions that are reachable but not covered

37

Reachable functions

274

Percentage of reachable functions covered

86.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_globals.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	7
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_global.c	20
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	2
src/lib/libdwarf/dwarf_form.c	5
src/lib/libdwarf/dwarf_query.c	1
src/lib/libdwarf/dwarf_names.c	1

Fuzzer: fuzz_gnu_index

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	155	18.2%
gold	[1:9]	81	9.52%
yellow	[10:29]	28	3.29%
greenyellow	[30:49]	27	3.17%
lawngreen	50+	559	65.7%
All colors	850	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	796	dwarf_get_gnu_index_head	call site: 00796	build_errm_no_v
9	826	_dwarf_count_entries_in_block	call site: 00826	build_errm_no_v
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	434	dwarfstring_append_printf_u	call site: 00434	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
5	659	internal_load_rnglists_contexts	call site: 00659	_dwarf_error_string
5	729	internal_load_rnglists_contexts	call site: 00729	free_rnglists_chain
5	773	internal_load_loclists_contexts	call site: 00773	free_loclists_chain

Runtime coverage analysis

Covered functions

229

Functions that are reachable but not covered

33

Reachable functions

231

Percentage of reachable functions covered

85.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_gnu_index.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	11
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	4
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_gnu_index.c	13

Fuzzer: fuzz_xuindex

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	18.6%
gold	[1:9]	20	3.10%
yellow	[10:29]	27	4.18%
greenyellow	[30:49]	29	4.49%
lawngreen	50+	449	69.6%
All colors	645	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	510	dwarf_object_init_b	call site: 00510	dwarf_dealloc_error
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
4	269	insert_sht_list_in_group_map	call site: 00269	_dwarf_error
4	275	insert_sht_list_in_group_map	call site: 00275	_dwarf_error
4	422	dwarfstring_append_printf_u	call site: 00422	dwarfstring_append_length
3	66	_dwarf_elf_object_access_internals_init	call site: 00066	_dwarf_closer

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

39

Reachable functions

205

Percentage of reachable functions covered

80.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_xuindex.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	1
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_die_cu_attrs

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	544	28.7%
gold	[1:9]	168	8.87%
yellow	[10:29]	76	4.01%
greenyellow	[30:49]	46	2.43%
lawngreen	50+	1058	55.9%
All colors	1892	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	1167	_dwarf_next_die_info_ptr	call site: 01167	_dwarf_error_string
21	1498	_dwarf_trial_read_dwarf_five_hdr	call site: 01498	emit_invalid_dw5tab
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
16	1440	dwarf_die_CU_offset	call site: 01440	dwarf_dealloc_die
15	1697	dwarfstring_append_printf_i	call site: 01697	_dwarfstring_append_spaces
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
12	1424	dwarf_offdie_b	call site: 01424	_dwarf_fill_in_attr_form_abtable
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
11	980	fill_in_dwp_offsets_if_present	call site: 00980	_dwarf_get_debugfission_for_offset
11	1846	dwarf_discr_list	call site: 01846	_dwarf_error

Runtime coverage analysis

Covered functions

360

Functions that are reachable but not covered

51

Reachable functions

380

Percentage of reachable functions covered

86.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs.c	1
src/lib/libdwarf/dwarf_generic_init.c	4
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	19
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	38
src/lib/libdwarf/dwarf_query.c	36
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	25
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_dsc.c	2

Fuzzer: fuzz_aranges

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	150	17.4%
gold	[1:9]	83	9.67%
yellow	[10:29]	36	4.19%
greenyellow	[30:49]	20	2.33%
lawngreen	50+	569	66.3%
All colors	858	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	823	_dwarf_get_aranges_list	call site: 00823	free_aranges_chain
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	434	dwarfstring_append_printf_u	call site: 00434	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
5	659	internal_load_rnglists_contexts	call site: 00659	_dwarf_error_string
5	729	internal_load_rnglists_contexts	call site: 00729	free_rnglists_chain
5	773	internal_load_loclists_contexts	call site: 00773	free_loclists_chain
4	270	insert_sht_list_in_group_map	call site: 00270	_dwarf_error

Runtime coverage analysis

Covered functions

225

Functions that are reachable but not covered

31

Reachable functions

226

Percentage of reachable functions covered

86.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_aranges.c	3
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	6
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_arange.c	4

Fuzzer: fuzz_stack_frame_access

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	639	34.3%
gold	[1:9]	182	9.79%
yellow	[10:29]	142	7.63%
greenyellow	[30:49]	51	2.74%
lawngreen	50+	845	45.4%
All colors	1859	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
28	1715	dwarf_get_fde_for_die	call site: 01715	_dwarf_read_encoded_ptr
26	1494	_dwarf_extract_string_offset_via_str_offsets	call site: 01494	_dwarf_trial_read_dwarf_five_hdr
22	1822	_dwarf_create_cie_from_after_start	call site: 01822	_dwarf_gnu_aug_encodings
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
15	1762	_dwarf_create_fde_from_after_start	call site: 01762	_dwarf_error_string
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
12	1745	_dwarf_create_fde_from_after_start	call site: 01745	_dwarf_error
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error

Runtime coverage analysis

Covered functions

330

Functions that are reachable but not covered

62

Reachable functions

360

Percentage of reachable functions covered

82.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_stack_frame_access.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	19
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_frame.c	4
src/lib/libdwarf/dwarf_frame2.c	8

Fuzzer: fuzz_die_cu_attrs_loclist

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	813	37.1%
gold	[1:9]	191	8.73%
yellow	[10:29]	88	4.02%
greenyellow	[30:49]	90	4.11%
lawngreen	50+	1005	45.9%
All colors	2187	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
48	2064	_dwarf_loclists_fill_in_lle_head	call site: 02064	build_array_of_lle
43	1724	_dwarf_get_fission_addition_die	call site: 01724	_dwarf_get_loclist_lle_count_dwo
30	2131	dwarf_highpc_b	call site: 02131	_dwarf_die_attr_unsigned_constant
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
26	1494	_dwarf_extract_string_offset_via_str_offsets	call site: 01494	_dwarf_trial_read_dwarf_five_hdr
20	1993	dwarf_get_loclist_c	call site: 01993	cook_gnu_loclist_contents
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
16	1806	_dwarf_fill_in_locdesc_op_c	call site: 01806	_dwarf_error_string
16	1938	dwarfstring_append_printf_i	call site: 01938	_dwarfstring_append_spaces

Runtime coverage analysis

Covered functions

351

Functions that are reachable but not covered

77

Reachable functions

396

Percentage of reachable functions covered

80.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_attrs_loclist.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	13
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	20
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	14
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	34
src/lib/libdwarf/dwarf_query.c	26
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	3
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	24
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5
src/lib/libdwarf/dwarf_loc.c	24
src/lib/libdwarf/dwarf_locationop_read.c	2

Fuzzer: fuzz_dnames

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	158	19.2%
gold	[1:9]	37	4.51%
yellow	[10:29]	34	4.14%
greenyellow	[30:49]	30	3.65%
lawngreen	50+	561	68.4%
All colors	820	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	723	fill_in_abbrevs_table	call site: 00723	dwarfstring_append_printf_u
8	803	dwarf_dnames_name	call site: 00803	_dwarf_error_string
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	434	dwarfstring_append_printf_u	call site: 00434	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
5	748	LLVMFuzzerTestOneInput	call site: 00748	dwarf_finish
5	754	LLVMFuzzerTestOneInput	call site: 00754	dwarf_finish
4	270	insert_sht_list_in_group_map	call site: 00270	_dwarf_error

Runtime coverage analysis

Covered functions

228

Functions that are reachable but not covered

34

Reachable functions

231

Percentage of reachable functions covered

85.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_dnames.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_debugnames.c	21
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_rng

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	162	20.6%
gold	[1:9]	37	4.72%
yellow	[10:29]	50	6.38%
greenyellow	[30:49]	25	3.19%
lawngreen	50+	509	65.0%
All colors	783	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	744	dwarf_get_rnglist_rle	call site: 00744	_dwarf_error_string
7	409	dwarfstring_append_printf_s	call site: 00409	_dwarfstring_append_spaces
7	474	dwarf_get_xu_index_header	call site: 00474	_dwarf_error_string
7	510	dwarf_object_init_b	call site: 00510	dwarf_dealloc_error
7	730	dwarf_get_rnglist_offset_index_value	call site: 00730	_dwarf_error_string
6	262	_dwarf_load_section	call site: 00262	_dwarf_error
6	433	dwarfstring_append_printf_u	call site: 00433	_dwarfstring_append_spaces
5	21	_dwarf_get_alloc	call site: 00021	dwarfstring_append
5	253	_dwarf_determine_section_allocation_type	call site: 00253	_dwarf_error_string
5	427	dwarfstring_append_printf_u	call site: 00427	dwarfstring_append_length
5	649	internal_load_rnglists_contexts	call site: 00649	_dwarf_error_string
5	719	internal_load_rnglists_contexts	call site: 00719	free_rnglists_chain

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

38

Reachable functions

216

Percentage of reachable functions covered

82.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_rng.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	3
src/lib/libdwarf/dwarf_rnglists.c	10
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_leb.c	1

Fuzzer: fuzz_init_path

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	168	18.9%
gold	[1:9]	10	1.12%
yellow	[10:29]	19	2.14%
greenyellow	[30:49]	12	1.35%
lawngreen	50+	676	76.3%
All colors	885	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	354	_dwarf_debuglink_finder_newpath	call site: 00354	dwarf_gnu_debuglink
8	208	dwarfstring_append_printf_u	call site: 00208	_dwarf_error_string
7	710	dwarf_get_xu_index_header	call site: 00710	_dwarf_error_string
6	522	insert_sht_list_in_group_map	call site: 00522	_dwarf_error
5	192	dwarfstring_append_printf_u	call site: 00192	dwarfstring_append_length
5	669	dwarfstring_append_printf_s	call site: 00669	_dwarfstring_append_spaces
4	37	_dwarf_determine_section_allocation_type	call site: 00037	dwarf_set_load_preference
4	95	dwarf_add_debuglink_global_path	call site: 00095	dwarf_finish
4	187	dwarfstring_append_printf_u	call site: 00187	dwarfstring_append_length
4	198	dwarfstring_append_printf_u	call site: 00198	_dwarfstring_append_spaces
4	384	dwarf_object_detector_path_b	call site: 00384	_dwarf_closer
4	529	insert_sht_list_in_group_map	call site: 00529	_dwarf_error

Runtime coverage analysis

Covered functions

233

Functions that are reachable but not covered

37

Reachable functions

244

Percentage of reachable functions covered

84.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_init_path.c	1
src/lib/libdwarf/dwarf_generic_init.c	6
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	17
src/lib/libdwarf/dwarf_seekr.c	4
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_debuglink.c	20
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_crc32.c	1
src/lib/libdwarf/dwarf_crc.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_peread.c	13

Fuzzer: fuzz_debug_str

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	108	16.4%
gold	[1:9]	16	2.43%
yellow	[10:29]	52	7.92%
greenyellow	[30:49]	12	1.82%
lawngreen	50+	468	71.3%
All colors	656	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	410	dwarfstring_append_printf_s	call site: 00410	_dwarfstring_append_spaces
7	475	dwarf_get_xu_index_header	call site: 00475	_dwarf_error_string
6	263	_dwarf_load_section	call site: 00263	_dwarf_error
6	434	dwarfstring_append_printf_u	call site: 00434	_dwarfstring_append_spaces
5	30	dwarfstring_append_length	call site: 00030	_dwarf_get_alloc
5	254	_dwarf_determine_section_allocation_type	call site: 00254	_dwarf_error_string
5	428	dwarfstring_append_printf_u	call site: 00428	dwarfstring_append_length
4	270	insert_sht_list_in_group_map	call site: 00270	_dwarf_error
4	276	insert_sht_list_in_group_map	call site: 00276	_dwarf_error
4	423	dwarfstring_append_printf_u	call site: 00423	dwarfstring_append_length
3	67	_dwarf_elf_object_access_internals_init	call site: 00067	_dwarf_closer
3	188	_dwarf_tfind	call site: 00188	_dwarf_error_destructor

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

33

Reachable functions

208

Percentage of reachable functions covered

84.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_debug_str.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	19
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	10
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	2
src/lib/libdwarf/dwarf_xu_index.c	3
src/lib/libdwarf/dwarf_util.c	2
src/lib/libdwarf/dwarf_rnglists.c	2
src/lib/libdwarf/dwarf_loclists.c	2
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	1
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_stringsection.c	1

Fuzzer: fuzz_die_cu_info1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	496	29.4%
gold	[1:9]	141	8.38%
yellow	[10:29]	118	7.01%
greenyellow	[30:49]	73	4.34%
lawngreen	50+	854	50.7%
All colors	1682	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
17	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error
10	1465	_dwarf_get_string_from_tied	call site: 01465	_dwarf_load_section
9	1007	dw_start_load_root_die	call site: 01007	_dwarf_next_die_info_ptr
8	1069	_dwarf_count_abbrev_entries	call site: 01069	_dwarf_fill_in_attr_form_abtable

Runtime coverage analysis

Covered functions

324

Functions that are reachable but not covered

53

Reachable functions

347

Percentage of reachable functions covered

84.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_info1.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	33
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5

Fuzzer: fuzz_die_cu_e

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	529	31.5%
gold	[1:9]	154	9.18%
yellow	[10:29]	91	5.42%
greenyellow	[30:49]	45	2.68%
lawngreen	50+	858	51.1%
All colors	1677	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
51	1405	_dwarf_create_a_new_cu_context_record_on_list	call site: 01405	dwarf_offdie_b
29	1162	_dwarf_get_size_of_val	call site: 01162	_dwarf_error_string
21	1498	_dwarf_trial_read_dwarf_five_hdr	call site: 01498	emit_invalid_dw5tab
19	1111	_dwarf_leb128_sword_wrapper	call site: 01111	_dwarf_get_size_of_val
16	933	dwarf_get_xu_section_offset	call site: 00933	_dwarf_error_string
16	1611	_dwarf_look_in_local_and_tied_by_index	call site: 01611	_dwarf_get_addr_from_tied
13	1064	_dwarf_count_abbrev_entries	call site: 01064	_dwarf_fill_in_attr_form_abtable
12	885	dwarf_get_debugfission_for_key	call site: 00885	_dwarf_error_string
11	781	reloc_incomplete	call site: 00781	dwarf_insert_harmless_error
11	952	dwarf_get_xu_section_offset	call site: 00952	_dwarf_error_string
11	980	fill_in_dwp_offsets_if_present	call site: 00980	_dwarf_get_debugfission_for_offset
10	846	_dwarf_make_CU_Context	call site: 00846	report_local_unit_type_error

Runtime coverage analysis

Covered functions

318

Functions that are reachable but not covered

58

Reachable functions

346

Percentage of reachable functions covered

83.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/fuzz_die_cu_e.c	1
src/lib/libdwarf/dwarf_generic_init.c	3
src/lib/libdwarf/dwarf_error.c	5
src/lib/libdwarf/dwarf_alloc.c	21
src/lib/libdwarf/dwarf_tsearchhash.c	12
src/lib/libdwarf/dwarf_string.c	12
src/lib/libdwarf/dwarf_object_detector.c	7
src/lib/libdwarf/dwarf_seekr.c	3
src/lib/libdwarf/dwarf_object_read_common.c	1
src/lib/libdwarf/dwarf_elfread.c	4
src/lib/libdwarf/dwarf_elf_load_headers.c	38
src/lib/libdwarf/dwarf_memcpy_swap.c	1
src/lib/libdwarf/dwarf_secname_ck.c	3
src/lib/libdwarf/dwarf_init_finish.c	13
src/lib/libdwarf/dwarf_harmless.c	3
src/lib/libdwarf/dwarf_xu_index.c	15
src/lib/libdwarf/dwarf_util.c	18
src/lib/libdwarf/dwarf_rnglists.c	6
src/lib/libdwarf/dwarf_loclists.c	6
src/lib/libdwarf/dwarf_groups.c	10
src/lib/libdwarf/dwarf_tied.c	6
src/lib/libdwarf/dwarf_setup_sections.c	4
src/lib/libdwarf/dwarf_debuglink.c	1
src/lib/libdwarf/dwarf_machoread.c	19
src/lib/libdwarf/dwarf_64machoread.c	4
src/lib/libdwarf/dwarf_safe_arithmetic.c	2
src/lib/libdwarf/dwarf_safe_strcpy.c	1
src/lib/libdwarf/dwarf_peread.c	13
src/lib/libdwarf/dwarf_die_deliv.c	32
src/lib/libdwarf/dwarf_query.c	18
src/lib/libdwarf/dwarf_leb.c	3
src/lib/libdwarf/dwarf_abbrev.c	1
src/lib/libdwarf/dwarf_names.c	2
src/lib/libdwarf/dwarf_fill_in_attr_form.c	2
src/lib/libdwarf/dwarf_form.c	21
src/lib/libdwarf/dwarf_lvn_name.c	1
src/lib/libdwarf/dwarf_lname_version.c	1
src/lib/libdwarf/dwarf_find_sigref.c	2
src/lib/libdwarf/dwarf_str_offsets.c	5
src/lib/libdwarf/dwarf_fission_to_cu.c	5