High level conclusions

Fuzzer encoder_fuzzer is blocked:

The runtime code coverage of encoder_fuzzer covers 11.11% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer file_fuzzer is blocked:

The runtime code coverage of file_fuzzer covers 19.76% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer box_fuzzer is blocked:

The runtime code coverage of box_fuzzer covers 0.613% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer color_conversion_fuzzer is blocked:

The runtime code coverage of color_conversion_fuzzer covers 12.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 3.717% of cyclomatic complexity.

Fuzzers reach 2.463% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

135 / 5480

Cyclomatic complexity statically reachable by fuzzers

364 / 9791

Runtime code coverage of functions

92 / 5480

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: color_conversion_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	550	90.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.16%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	55	9.07%
All colors	606	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
287	9	LLVMFuzzerTestOneInput	call site: 00009	Box::read
208	373	heif_color_conversion_options_ext_copy	call site: 00373	ColorConversionPipeline::construct_pipeline
13	313	LLVMFuzzerTestOneInput	call site: 00313	Catch::ReporterRegistry::create
12	329	LLVMFuzzerTestOneInput	call site: 00329	Box::read
10	350	LLVMFuzzerTestOneInput	call site: 00350	Box::read
8	584	LLVMFuzzerTestOneInput	call site: 00584
6	2	LLVMFuzzerTestOneInput	call site: 00002	BitstreamRange::prepare_read
4	298	LLVMFuzzerTestOneInput	call site: 00298	Box::read
1	362	LLVMFuzzerTestOneInput	call site: 00362
1	371	LLVMFuzzerTestOneInput	call site: 00371	heif_color_conversion_options_ext_copy

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

44

Reachable functions

50

Percentage of reachable functions covered

12.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/color_conversion_fuzzer.cc	31
libheif/bitstream.cc	8
libheif/bitstream.h	3
libheif/box.cc	137
libheif/common_utils.h	3
libheif/common_utils.cc	1
tests/catch_amalgamated.cpp	10
libheif/api/libheif/heif_encoding.cc	2
libheif/api/libheif/heif_color.cc	3
libheif/color-conversion/colorconversion.cc	104
libheif/pixelimage.cc	1
libheif/nclx.h	2
libheif/color-conversion/colorconversion.h	1
tests/conversion.cc	6

Fuzzer: box_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	297	96.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	3.88%
All colors	309	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
285	17	LLVMFuzzerTestOneInput	call site: 00017	BoxHeader::parse_header
12	2	LLVMFuzzerTestOneInput	call site: 00002	HeifContext::reset_to_empty_heif

Runtime coverage analysis

Covered functions

536

Functions that are reachable but not covered

162

Reachable functions

163

Percentage of reachable functions covered

0.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/box_fuzzer.cc	11
libheif/context.cc	9
libheif/box.cc	137
libheif/common_utils.h	3
libheif/common_utils.cc	1
libheif/bitstream.h	2
libheif/bitstream.cc	2

Fuzzer: file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1380	92.0%
gold	[1:9]	14	0.93%
yellow	[10:29]	10	0.66%
greenyellow	[30:49]	4	0.26%
lawngreen	50+	91	6.07%
All colors	1499	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
468	221	heif_context_read_from_memory	call site: 00221	HeifContext::read_from_memory
320	1136	heif_context_get_image_handle	call site: 01136	load_image
153	730	heif_nclx_color_profile_alloc	call site: 00730	ColorConversionPipeline::construct_pipeline
101	68	heif_init	call site: 00068	list_all_potential_plugins_in_directory
84	984	heif_context_get_number_of_top_level_images	call site: 00984	heif_image_handle_get_metadata
65	2	heif_init	call site: 00002
62	887	heif_decode_image	call site: 00887	convert_libde265_image_to_heif_image
19	710	heif_decode_image	call site: 00710	HeifContext::convert_to_output_colorspace
15	186	heif_main_brand	call site: 00186
15	1072	heif_image_handle_get_metadata	call site: 01072	REQUIRE
11	1090	heif_image_handle_get_metadata	call site: 01090	Error::error_struct
11	1109	heif_image_handle_get_metadata_content_type	call site: 01109	heif_image_handle_get_metadata

Runtime coverage analysis

Covered functions

1030

Functions that are reachable but not covered

134

Reachable functions

167

Percentage of reachable functions covered

19.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/file_fuzzer.cc	40
libheif/init.cc	29
libheif/color-conversion/colorconversion.cc	104
libheif/plugin_registry.cc	33
libheif/plugins_windows.cc	8
libheif/plugins_unix.cc	12
libheif/api/libheif/heif_library.cc	2
libheif/api/libheif/heif_brands.cc	8
libheif/common_utils.h	3
libheif/api/libheif/heif_context.cc	17
libheif/api/libheif/heif_security.cc	1
libheif/context.cc	163
libheif/image-items/image_item.cc	22
libheif/common_utils.cc	1
libheif/image-items/overlay.h	1
libheif/image-items/image_item.h	3
libheif/image-items/jpeg2000.cc	7
libheif/codecs/decoder.cc	1
libheif/box.cc	11
libheif/codecs/hevc_boxes.cc	18
libheif/bitstream.cc	5
tests/catch_amalgamated.cpp	12
libheif/pixelimage.cc	9
tests/conversion.cc	6
libheif/nclx.h	2
libheif/box.h	2
libheif/sequences/track.cc	10
libheif/sequences/track_visual.cc	11
libheif/error.cc	7
libheif/error.h	2
tests/test_utils.cc	4
libheif/api/libheif/heif_decoding.cc	10
libheif/api/libheif/heif_color.cc	8
libheif/color-conversion/colorconversion.h	1
libheif/plugins/decoder_libde265.cc	11
libheif/api/libheif/heif_image.cc	23
libheif/security_limits.cc	4
libheif/pixelimage.h	4
libheif/api/libheif/heif_image_handle.cc	4
libheif/api/libheif/heif_metadata.cc	10
libheif/api/libheif/heif_cxx.h	5
tests/uncompressed_decode_rgb.cc	12
tests/uncompressed_encode_multicomponent.cc	10
examples/heif_enc.cc	16
heifio/decoder_png.cc	41
heifio/exif.cc	7
heifio/decoder_y4m.cc	13
heifio/decoder_jpeg.cc	39
libheif/api/libheif/heif_aux_images.cc	6

Fuzzer: encoder_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	307	83.8%
gold	[1:9]	1	0.27%
yellow	[10:29]	2	0.54%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	56	15.3%
All colors	366	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
167	4	heif_init	call site: 00004	list_all_potential_plugins_in_directory
44	204	heif_image_create	call site: 00204	MemoryHandle::alloc
27	309	heif_context_encode_image	call site: 00309	get_encoder_or_skip_test
19	289	heif_context_encode_image	call site: 00289	ImageExtraData::has_nclx_color_profile
14	250	heif_image_create	call site: 00250	Catch::ReporterRegistry::create
8	265	heif_image_add_plane	call site: 00265	Error::error_struct
7	277	heif_image_get_plane	call site: 00277	heif_image_get_plane
6	177	heif_get_encoder_descriptors	call site: 00177	load_plugins_if_not_initialized_yet
4	338	heif_context_encode_image	call site: 00338
4	350	LLVMFuzzerTestOneInput	call site: 00350	Error::error_struct
2	355	heif_context_write	call site: 00355	Catch::JsonUtils::appendCommaNewline
1	2	heif_context_alloc	call site: 00002	heif_init

Runtime coverage analysis

Covered functions

2310

Functions that are reachable but not covered

128

Reachable functions

144

Percentage of reachable functions covered

11.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/encoder_fuzzer.cc	22
libheif/api/libheif/heif_context.cc	10
libheif/init.cc	21
libheif/color-conversion/colorconversion.cc	34
libheif/plugin_registry.cc	33
libheif/plugins_windows.cc	8
libheif/plugins_unix.cc	12
libheif/api/libheif/heif_library.cc	2
libheif/api/libheif/heif_encoding.cc	24
libheif/api/libheif/heif_image.cc	14
tests/catch_amalgamated.cpp	8
libheif/plugins/decoder_libde265.cc	11
libheif/pixelimage.cc	5
libheif/security_limits.cc	4
libheif/error.cc	7
libheif/error.h	1
libheif/pixelimage.h	4
tests/conversion.cc	6
libheif/nclx.h	2
tests/encode.cc	6
tests/test_utils.cc	2
libheif/context.cc	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
do_encode_sequence	/src/libheif/examples/heif_enc.cc	4	['heif_context*', 'heif_encoder*', 'heif_encoding_options*', 'std::vector ']	9	0	92	22	26	497	0	555	515
HeifContext::read	/src/libheif/libheif/context.cc	1	['std::shared_ptr ']	6	0	7	2	1	184	1	234	231
ImageItem_uncompressed::decode_compressed_image	/src/libheif/libheif/image-items/unc_image.cc	5	['heif_decoding_options', 'bool', 'uint32_t', 'uint32_t', 'std::set ']	9	0	11	3	2	110	0	131	131

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

298 / 5480

Cyclomatic complexity statically reachable by fuzzers

1240 / 9791

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzzing/color_conversion_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'heif_color_conversion_options_ext_copy']

fuzzing/box_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

fuzzing/file_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['heif_context_read_from_memory', 'heif_context_get_image_handle', 'heif_nclx_color_profile_alloc', 'heif_init', 'heif_context_get_number_of_top_level_images', 'heif_decode_image', 'heif_main_brand', 'heif_image_handle_get_metadata']

fuzzing/encoder_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['heif_init', 'heif_image_create', 'heif_context_encode_image', 'heif_image_add_plane', 'heif_image_get_plane', 'heif_get_encoder_descriptors', 'LLVMFuzzerTestOneInput']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
get_Kr_Kb(unsignedshort,unsignedshort)	47	13	27.65%
heif_decoding_options_copy	38	4	10.52%	['file_fuzzer']
Decoder::decode_sequence_frame_from_compressed_data(bool,heif_decoding_optionsconst&,unsignedlong,heif_security_limitsconst*)	55	21	38.18%
fill_uncC_and_cmpd_from_profile(std::__1::shared_ptr const&,std::__1::shared_ptr &)	231	4	1.731%
UncompressedImageCodec::check_header_validity(std::__1::optional const>,std::__1::shared_ptr const&,std::__1::shared_ptr const&)	49	7	14.28%
UncompressedImageCodec::decode_uncompressed_image(HeifContextconst*,unsignedint,std::__1::shared_ptr &)	52	16	30.76%
ImageItem_Tiled::initialize_decoder()	63	8	12.69%
HeifPixelImage::get_visual_image_bits_per_pixel()const	33	12	36.36%
HeifPixelImage::rotate_ccw(int,heif_security_limitsconst*)	75	37	49.33%
HeifPixelImage::mirror_inplace(heif_transform_mirror_direction,heif_security_limitsconst*)	49	15	30.61%
HeifPixelImage::scale_nearest_neighbor(std::__1::shared_ptr &,unsignedint,unsignedint,heif_security_limitsconst*)const	139	41	29.49%
HeifPixelImage::create_clone_image_at_new_size(std::__1::shared_ptr const&,unsignedint,unsignedint,heif_security_limitsconst*)	50	19	38.0%
Track::load(std::__1::shared_ptr const&)	245	86	35.10%
Track_Visual::load(std::__1::shared_ptr const&)	37	5	13.51%
decoder_destroy	35	9	25.71%
Box_iloc::append_data(unsignedint,std::__1::vector >const&,unsignedchar)	50	21	42.0%
Box_iloc::write_mdat_after_iloc(StreamWriter&)	53	29	54.71%
fill_av1C_configuration_from_stream(Box_av1C::configuration*,unsignedcharconst*,int)	188	72	38.29%
HeifContext::write(StreamWriter&)	75	31	41.33%
HeifContext::encode_image(std::__1::shared_ptr const&,heif_encoder*,heif_encoding_optionsconst&,heif_image_input_class)	58	28	48.27%
HeifFile::add_orientation_properties(unsignedint,heif_orientation)	48	11	22.91%
ImageExtraData::generate_property_boxes(bool)const	37	12	32.43%
HeifPixelImage::extend_padding_to_size(unsignedint,unsignedint,bool,heif_security_limitsconst*)	53	29	54.71%
aom_set_parameter_integer(void*,charconst*,int)	32	14	43.75%
aom_set_parameter_string(void*,charconst*,charconst*)	40	15	37.5%
aom_start_sequence_encoding_intern(void*,heif_imageconst*,heif_image_input_class,unsignedint,unsignedint,heif_sequence_encoding_optionsconst*,bool)	148	81	54.72%
x265_set_parameter_string(void*,charconst*,charconst*)	39	20	51.28%
x265_start_sequence_encoding_intern(void*,heif_imageconst*,heif_image_input_class,unsignedint,unsignedint,heif_sequence_encoding_optionsconst*,bool)	218	103	47.24%
aom_codec_get_cx_data	35	17	48.57%
reset	34	18	52.94%
av1_alloc_cdef_buffers	66	28	42.42%
update_ext_partition_context	35	17	48.57%
av1_get_filter_level	37	8	21.62%
get_flip_cfg	38	11	28.94%
get_entropy_context	83	34	40.96%
av1_setup_skip_mode_allowed	61	8	13.11%
scale_chroma_bsize	49	9	18.36%
av1_loop_restoration_corners_in_sb	37	6	16.21%
av1_loop_restoration_dealloc	40	19	47.5%
av1_calculate_tile_cols	46	25	54.34%
av1_quantize_b_facade	63	24	38.09%
quantize_fp_helper_c	40	18	45.0%
av1_write_sequence_header_obu	62	21	33.87%
write_sequence_header	54	16	29.62%
write_color_config	57	25	43.85%
write_uncompressed_header_obu	255	73	28.62%
encode_loopfilter	43	20	46.51%
encode_restoration_mode	65	3	4.615%
write_modes_sb	91	44	48.35%
write_delta_q_params	38	4	10.52%
write_tokens_b	37	11	29.72%
av1_write_metadata_array	38	6	15.78%
av1_find_cnn_layer_output_size	37	14	37.83%
av1_cnn_predict_c	134	71	52.98%
av1_cnn_convolve	56	22	39.28%
av1_configure_buffer_updates	53	13	24.52%
av1_update_ref_frame_map	77	18	23.37%
av1_get_refresh_frame_flags	116	7	6.034%
av1_get_ref_frames	59	32	54.23%
choose_frame_source	44	17	38.63%
adjust_frame_rate	37	17	45.94%
denoise_and_encode	116	37	31.89%
encode_rd_sb	71	37	52.11%
init_ref_frame_space	83	10	12.04%
encode_frame_internal	289	128	44.29%
setup_prune_ref_frame_mask	46	6	13.04%
av1_get_tpl_stats_sb	55	4	7.272%
av1_get_q_for_deltaq_objective	85	22	25.88%
av1_set_cost_upd_freq	60	30	50.0%
av1_dropout_qcoeff_num	64	9	14.06%
av1_receive_raw_frame	52	18	34.61%
av1_apply_encoding_flags	64	29	45.31%
set_tile_info	46	19	41.30%
set_bitstream_level_tier	50	14	28.00%
encode_frame_to_data_rate	204	85	41.66%
encode_with_recode_loop_and_filter	69	31	44.92%
encode_without_recode	128	68	53.12%
cdef_restoration_frame	51	20	39.21%
av1_set_size_dependent_vars	56	17	30.35%
av1_update_film_grain_parameters	36	12	33.33%
av1_finalize_encoded_frame	32	14	43.75%
highbd_set_var_fns	295	4	1.355%
construct_multi_layer_gf_structure	99	49	49.49%
set_multi_layer_params	49	7	14.28%
av1_highbd_fwd_txfm	66	36	54.54%
intra_rd_variance_factor	64	30	46.87%
rd_pick_filter_intra_sby	68	2	2.941%
intra_mode_info_cost_uv	40	19	47.5%
intra_mode_info_cost_y	56	26	46.42%
setup_block_rdmult	31	12	38.70%
encode_sb	113	58	51.32%
encode_b	113	49	43.36%
update_stats	230	21	9.130%
prune_partitions_after_none	42	11	26.19%
prune_partitions_after_split	31	11	35.48%
av1_prune_partitions_before_search	128	62	48.43%
av1_get_second_pass_params	177	91	51.41%
find_next_key_frame	152	32	21.05%
identify_regions	75	3	4.0%
calculate_gf_length	181	20	11.04%
define_gf_group	97	21	21.64%
av1_pick_filter_level	106	38	35.84%
rc_pick_q_and_bounds	59	18	30.50%
get_intra_q_and_bounds	68	15	22.05%
av1_fill_mode_rates	203	108	53.20%
rd_pick_intrabc_mode_sb	155	4	2.580%
set_mode_eval_params	66	21	31.81%
store_winner_mode_stats	35	5	14.28%
av1_set_speed_features_qindex_dependent	108	38	35.18%
calculate_next_superres_scale	70	19	27.14%
validate_size_scales	49	4	8.163%
av1_write_second_pass_per_frame_info	38	5	13.15%
av1_pick_uniform_tx_size_type_yrd	51	24	47.05%
get_tx_mask	142	74	52.11%
recon_intra	36	15	41.66%
choose_largest_tx_size	88	20	22.72%
x265::general_log(x265_paramconst*,charconst*,int,charconst*,...)	35	3	8.571%
x265::cpu_detect(bool)	159	9	5.660%
x265::Deblock::setEdgefilterPU(x265::CUDataconst*,unsignedint,int,unsignedchar*,unsignedint)	37	10	27.02%
x265::Deblock::getBoundaryStrength(x265::CUDataconst*,int,unsignedint,unsignedcharconst*)	46	5	10.86%
x265::Frame::create(x265_param*,float*)	91	25	27.47%
x265::Frame::destroy()	118	43	36.44%
x265::Lowres::create(x265_param*,x265::PicYuv*,unsignedint)	153	71	46.40%
x265::Lowres::destroy(x265_param*)	77	36	46.75%
x265_param_default_preset	249	44	17.67%
x265_param_parse	543	148	27.25%
x265::x265_print_params(x265_param*)	119	3	2.521%
x265::parseLambdaFile(x265_param*)	56	3	5.357%
x265::PicYuv::copyFromPicture(x265_pictureconst&,x265_paramconst&,int,int,bool)	185	99	53.51%
x265::x265_report_simd(x265_param*)	33	3	9.090%
unsignedintx265::Quant::rdoQuant<5u>(x265::CUDataconst&,short*,x265::TextType,unsignedint,bool)	583	309	53.00%
x265::Slice::setRefPicList(x265::PicList&,int)	84	9	10.71%
x265::ThreadPool::allocThreadPools(x265_param*,int&,bool)	155	67	43.22%
x265::Analysis::compressCTU(x265::CUData&,x265::Frame&,x265::CUGeomconst&,x265::Entropyconst&)	139	28	20.14%
x265::Analysis::calculateQpforCuSize(x265::CUDataconst&,x265::CUGeomconst&,int,double)	75	37	49.33%
x265_encoder_open_215	87	41	47.12%
x265_api_get_215	43	4	9.302%
x265::DPB::recycleUnreferenced()	58	11	18.96%
x265::DPB::prepareEncode(x265::Frame*)	171	47	27.48%
x265::DPB::decodingRefreshMarking(int,NalUnitType,int)	34	12	35.29%
x265::DPB::applyReferencePictureSet(x265::RPS*,int,int,bool,int)	33	9	27.27%
x265::Encoder::create()	331	98	29.60%
x265::Encoder::destroy()	102	46	45.09%
x265::Encoder::copyUserSEIMessages(x265::Frame*,x265_pictureconst*)	56	13	23.21%
x265::Encoder::encode(x265_pictureconst*,x265_picture*)	902	264	29.26%
x265::Encoder::printSummary()	60	3	5.0%
x265::Encoder::finishFrameStats(x265::Frame*,x265::FrameEncoder*,x265_frame_stats*,int,int)	176	63	35.79%
x265::Encoder::getStreamHeaders(x265::NALList&,x265::Entropy&,x265::Bitstream&)	78	27	34.61%
x265::Encoder::configure(x265_param*)	705	195	27.65%
x265::Entropy::codeProfileTier(x265::ProfileTierLevelconst&,int,int)	62	25	40.32%
x265::Entropy::codeSliceHeader(x265::Sliceconst&,x265::FrameData&,unsignedint,unsignedint,int,int)	101	42	41.58%
x265::Entropy::codeSaoOffset(x265::SaoCtuParamconst&,int)	31	9	29.03%
x265::Entropy::codePartSize(x265::CUDataconst&,unsignedint,unsignedint)	40	8	20.0%
x265::FrameEncoder::compressFrame(int)	680	200	29.41%
x265::FrameEncoder::initDecodedPictureHashSEI(int,int,int,int)	59	11	18.64%
x265::FrameEncoder::processRowEncoder(int,x265::ThreadLocalData&,int)	439	160	36.44%
x265::FrameEncoder::collectCTUStatistics(x265::CUDataconst&,x265::FrameStats*)	78	11	14.10%
x265::FrameFilter::processPostRow(int,int)	54	19	35.18%
x265::determineLevel(x265_paramconst&,x265::VPS&)	185	82	44.32%
x265::enforceLevel(x265_param&,x265::VPS&)	130	10	7.692%
x265_param_apply_profile	54	20	37.03%
x265::RateControl::init(x265::SPSconst&)	354	36	10.16%
x265::RateControl::rateControlStart(x265::Frame*,x265::RateControlEntry*,x265::Encoder*)	272	83	30.51%
x265::RateControl::rateEstimateQscale(x265::Frame*,x265::RateControlEntry*)	423	75	17.73%
x265::RateControl::clipQscale(x265::Frame*,x265::RateControlEntry*,double)	139	8	5.755%
x265::RateControl::rateControlEnd(x265::Frame*,long,x265::RateControlEntry*,int*)	156	78	50.0%
x265::RateControl::destroy()	53	14	26.41%
x265::SAO::generateChromaOffsets(x265::SaoCtuParam**,int,int)	85	43	50.58%
x265::LookaheadTLD::calcAdaptiveQuantFrame(x265::Frame*,x265_param*)	232	64	27.58%
x265::Lookahead::getEstimatedPictureCost(x265::Frame*)	100	26	26.0%
x265::Lookahead::slicetypeDecide()	617	139	22.52%
x265::CostEstimateGroup::estimateFrameCost(x265::LookaheadTLD&,int,int,int,bool)	71	9	12.67%

New fuzzers

The below fuzzers are templates and suggestions for how to target the set of optimal functions above

heif_enc.cc

Target file: /src/libheif/examples/heif_enc.cc
Target functions: do_encode_sequence

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target do_encode_sequence */
  UNKNOWN_TYPE unknown_0;
  UNKNOWN_TYPE unknown_1;
  UNKNOWN_TYPE unknown_2;
  UNKNOWN_TYPE unknown_3;
  do_encode_sequence(unknown_0, unknown_1, unknown_2, unknown_3);

  af_safe_gb_cleanup();
}

context.cc

Target file: /src/libheif/libheif/context.cc
Target functions: HeifContext::read

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target HeifContext::read */
  UNKNOWN_TYPE unknown_4;
  HeifContext::read(unknown_4);

  af_safe_gb_cleanup();
}

unc_image.cc

Target file: /src/libheif/libheif/image-items/unc_image.cc
Target functions: ImageItem_uncompressed::decode_compressed_image

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target ImageItem_uncompressed::decode_compressed_image */
  UNKNOWN_TYPE unknown_5;
  UNKNOWN_TYPE unknown_6;
  UNKNOWN_TYPE unknown_7;
  UNKNOWN_TYPE unknown_8;
  UNKNOWN_TYPE unknown_9;
  ImageItem_uncompressed::decode_compressed_image(unknown_5, unknown_6, unknown_7, unknown_8, unknown_9);

  af_safe_gb_cleanup();
}

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
/src/libheif/libheif/codecs/jpeg_enc.h	[]	[]
/src/libheif/libheif/box.h	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/sequences/seq_boxes.cc	[]	[]
/src/libheif/libheif/text.cc	[]	[]
/src/libheif/libheif/plugins_unix.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/jpeg2000_boxes.h	[]	[]
/src/libheif/tests/uncompressed_decode_rgb565.cc	[]	[]
/src/libheif/libheif/plugins/encoder_rav1e.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_component_interleave.cc	[]	[]
/src/libheif/libheif/file.cc	[]	[]
/src/libheif/examples/heif_gen_bayer.cc	[]	[]
/src/libheif/libheif/image-items/vvc.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder.h	[]	[]
/src/libheif/heifio/encoder_jpeg.h	[]	[]
/src/libheif/libheif/api_structs.h	[]	[]
/src/libheif/libheif/plugins/decoder_aom.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_legacybase.cc	[]	[]
/src/libheif/libheif/plugins/encoder_x265.cc	[]	[]
/src/libheif/libheif/sequences/track.h	[]	[]
/src/libheif/libheif/codecs/decoder.h	[]	[]
/src/libheif/libheif/image-items/hevc.h	[]	[]
/src/libheif/libheif/file_layout.cc	[]	[]
/src/libheif/tests/catch_amalgamated.hpp	[]	[]
/src/libheif/libheif/plugins/encoder_vvenc.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_regions.cc	[]	[]
/src/libheif/libheif/region.cc	[]	[]
/src/libheif/libheif/context.cc	['box_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	['box_fuzzer', 'file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/codecs/jpeg_boxes.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder_rgb_pixel_interleave.cc	[]	[]
/src/libheif/heifio/stubs.cc	[]	[]
/src/libheif/libheif/plugins/decoder_jpeg.cc	[]	[]
/src/libheif/tests/uncompressed_decode_rgb7.cc	[]	[]
/src/libheif/libheif/codecs/jpeg2000_dec.h	[]	[]
/src/libheif/libheif/plugins/encoder_aom.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_bytealign_component_interleave.cc	[]	[]
/src/libheif/libheif/nclx.h	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	['file_fuzzer']
/src/libheif/libheif/api/libheif/heif_uncompressed.cc	[]	[]
/src/libheif/examples/heif_enc.cc	['file_fuzzer']	[]
/src/libheif/libheif/plugins/nalu_utils.cc	[]	[]
/src/libheif/libheif/plugins/encoder_x264.cc	[]	[]
/src/libheif/tests/uncompressed_encode_multicomponent.cc	['file_fuzzer']	[]
/src/libheif/libheif/image-items/overlay.h	['file_fuzzer']	[]
/src/libheif/libheif/api/libheif/heif_image.cc	['file_fuzzer', 'encoder_fuzzer']	['file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/plugins/decoder_dav1d.cc	[]	[]
/src/libheif/libheif/plugins/encoder_kvazaar.cc	[]	[]
/src/libheif/libheif/codecs/encoder.cc	[]	[]
/src/libheif/libheif/sequences/chunk.h	[]	[]
/src/libheif/heifio/encoder_png.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_boxes.cc	[]	[]
/src/libheif/libheif/error.h	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/jpeg_dec.cc	[]	[]
/src/libheif/tests/tiffdecode.cc	[]	[]
/src/libheif/libheif/brands.cc	[]	[]
/src/libheif/libheif/codecs/vvc_dec.h	[]	[]
/src/libheif/libheif/color-conversion/colorconversion.h	['color_conversion_fuzzer', 'file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/common_utils.cc	['color_conversion_fuzzer', 'box_fuzzer', 'file_fuzzer']	[]
/src/libheif/libheif/codecs/hevc_boxes.h	[]	[]
/src/libheif/tests/uncompressed_decode_ycbcr422.cc	[]	[]
/src/libheif/libheif/logging.h	[]	[]
/src/libheif/libheif/codecs/avc_boxes.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_component_interleave.h	[]	[]
/src/libheif/libheif/image-items/vvc.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_aux_images.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/api/libheif/heif_image_handle.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/plugins/decoder_vvdec.cc	[]	[]
/src/libheif/heifio/encoder_tiff.cc	[]	[]
/src/libheif/heifio/encoder_png.h	[]	[]
/src/libheif/libheif/common_utils.h	['color_conversion_fuzzer', 'box_fuzzer', 'file_fuzzer']	[]
/src/libheif/libheif/pixelimage.h	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/heifio/encoder.cc	[]	[]
/src/libheif/libheif/sequences/track_metadata.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_metadata.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/mini.h	[]	[]
/src/libheif/libheif/plugins/encoder_uncompressed.cc	[]	[]
/src/libheif/libheif/sequences/track_visual.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/plugins/encoder_jpeg.cc	[]	[]
/src/libheif/libheif/codecs/encoder.h	[]	[]
/src/libheif/examples/SAI_datafile.cc	[]	[]
/src/libheif/libheif/plugins_windows.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/hevc_dec.h	[]	[]
/src/libheif/libheif/image-items/avc.cc	[]	[]
/src/libheif/libheif/file_layout.h	[]	[]
/src/libheif/libheif/api/libheif/heif_plugin.h	[]	[]
/src/libheif/tests/omaf.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_row_interleave.cc	[]	[]
/src/libheif/libheif/sequences/track.cc	['file_fuzzer']	[]
/src/libheif/libheif/omaf_boxes.cc	[]	[]
/src/libheif/libheif/codecs/hevc_boxes.cc	['file_fuzzer']	[]
/src/libheif/libheif/image-items/tiled.h	[]	[]
/src/libheif/libheif/codecs/avc_dec.h	[]	[]
/src/libheif/heifio/decoder_tiff.h	[]	[]
/src/libheif/libheif/plugin_registry.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/tests/uncompressed_decode_ycbcr.cc	[]	[]
/src/libheif/libheif/id_creator.h	[]	[]
/src/libheif/libheif/bitstream.cc	['color_conversion_fuzzer', 'box_fuzzer', 'file_fuzzer']	['color_conversion_fuzzer', 'box_fuzzer', 'file_fuzzer']
/src/libheif/libheif/image-items/overlay.cc	[]	[]
/src/libheif/libheif/codecs/avif_enc.cc	[]	[]
/src/libheif/libheif/bitstream.h	['color_conversion_fuzzer', 'box_fuzzer']	['color_conversion_fuzzer', 'box_fuzzer']
/src/libheif/libheif/codecs/uncompressed/unc_encoder_rgb_bytealign_pixel_interleave.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_context.cc	['file_fuzzer', 'encoder_fuzzer']	['file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/logging.cc	[]	[]
/src/libheif/examples/sdl.cc	[]	[]
/src/libheif/libheif/image-items/image_item.cc	['file_fuzzer']	[]
/src/libheif/libheif/region.h	[]	[]
/src/libheif/libheif/api/libheif/heif_brands.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/tests/encode_htj2k.cc	[]	[]
/src/libheif/libheif/codecs/vvc_boxes.h	[]	[]
/src/libheif/libheif/image-items/jpeg.h	[]	[]
/src/libheif/libheif/codecs/jpeg2000_dec.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_cxx.h	['file_fuzzer']	[]
/src/libheif/libheif/codecs/uncompressed/unc_enc.cc	[]	[]
/src/libheif/libheif/codecs/avc_dec.cc	[]	[]
/src/libheif/tests/uncompressed_decode_generic_compression.cc	[]	[]
/src/libheif/libheif/image-items/image_item.h	['file_fuzzer']	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_pixel_interleave.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder.cc	[]	[]
/src/libheif/libheif/mini.cc	[]	[]
/src/libheif/libheif/codecs/avc_enc.cc	[]	[]
/src/libheif/libheif/codecs/jpeg_enc.cc	[]	[]
/src/libheif/libheif/color-conversion/colorconversion.cc	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/api/libheif/heif_color.cc	['color_conversion_fuzzer', 'file_fuzzer']	['color_conversion_fuzzer', 'file_fuzzer']
/src/libheif/libheif/codecs/avif_dec.h	[]	[]
/src/libheif/libheif/plugins/decoder_ffmpeg.cc	[]	[]
/src/libheif/libheif/plugins/encoder_uvg266.cc	[]	[]
/src/libheif/libheif/plugins/decoder_webcodecs.cc	[]	[]
/src/libheif/libheif/nclx.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_legacybase.h	[]	[]
/src/libheif/heifio/encoder_y4m.cc	[]	[]
/src/libheif/libheif/codecs/vvc_enc.cc	[]	[]
/src/libheif/examples/common.cc	[]	[]
/src/libheif/libheif/image-items/unc_image.cc	[]	[]
/src/libheif/libheif/image-items/unc_image.h	[]	[]
/src/libheif/libheif/api/libheif/heif_decoding.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/sequences/chunk.cc	[]	[]
/src/libheif/libheif/color-conversion/monochrome.cc	[]	[]
/src/libheif/examples/benchmark.cc	[]	[]
/src/libheif/libheif/plugins/encoder_svt.cc	[]	[]
/src/libheif/tests/mini_decode.cc	[]	[]
/src/libheif/libheif/id_creator.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_tiling.cc	[]	[]
/src/libheif/libheif/error.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.h	[]	[]
/src/libheif/libheif/codecs/jpeg2000_enc.cc	[]	[]
/src/libheif/libheif/plugin_registry.h	[]	[]
/src/libheif/heifio/encoder_jpeg.cc	[]	[]
/src/libheif/libheif/codecs/hevc_enc.h	[]	[]
/src/libheif/libheif/security_limits.h	[]	[]
/src/libheif/libheif/codecs/avif_dec.cc	[]	[]
/src/libheif/libheif/codecs/vvc_dec.cc	[]	[]
/src/libheif/libheif/image-items/jpeg2000.cc	['file_fuzzer']	[]
/src/libheif/fuzzing/color_conversion_fuzzer.cc	['color_conversion_fuzzer']	['color_conversion_fuzzer']
/src/libheif/libheif/pixelimage.cc	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/api/libheif/heif_text.cc	[]	[]
/src/libheif/heifio/decoder_y4m.cc	['file_fuzzer']	[]
/src/libheif/libheif/api/libheif/heif_experimental.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_library.h	[]	[]
/src/libheif/libheif/codecs/avc_boxes.h	[]	[]
/src/libheif/libheif/api/libheif/heif_sequences.cc	[]	[]
/src/libheif/heifio/decoder_tiff.cc	[]	[]
/src/libheif/tests/uncompressed_decode_ycbcr420.cc	[]	[]
/src/libheif/libheif/codecs/hevc_enc.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_library.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/plugins_unix.h	[]	[]
/src/libheif/libheif/sequences/track_metadata.h	[]	[]
/src/libheif/tests/catch_amalgamated.cpp	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	['encoder_fuzzer']
/src/libheif/libheif/plugins/decoder_libde265.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/compression_brotli.cc	[]	[]
/src/libheif/libheif/omaf_boxes.h	[]	[]
/src/libheif/libheif/image-items/tiled.cc	[]	[]
/src/libheif/libheif/codecs/vvc_boxes.cc	[]	[]
/src/libheif/libheif/plugins/nalu_utils.h	[]	[]
/src/libheif/libheif/codecs/vvc_enc.h	[]	[]
/src/libheif/extra/getopt.c	[]	[]
/src/libheif/libheif/file.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_block_component_interleave.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_tai_timestamps.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_security.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/image-items/iden.cc	[]	[]
/src/libheif/libheif/plugins/decoder_openjpeg.cc	[]	[]
/src/libheif/libheif/codecs/avif_enc.h	[]	[]
/src/libheif/libheif/image-items/grid.h	[]	[]
/src/libheif/heifio/decoder_jpeg.cc	['file_fuzzer']	[]
/src/libheif/libheif/image-items/avif.cc	[]	[]
/src/libheif/libheif/color-conversion/rgb2rgb.cc	[]	[]
/src/libheif/libheif/plugins/encoder_openjpeg.cc	[]	[]
/src/libheif/heifio/decoder_png.cc	['file_fuzzer']	[]
/src/libheif/libheif/plugins/encoder_openjph.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_encoding.cc	['color_conversion_fuzzer', 'encoder_fuzzer']	['color_conversion_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/init.cc	['file_fuzzer', 'encoder_fuzzer']	['file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/api/libheif/heif_entity_groups.cc	[]	[]
/src/libheif/fuzzing/encoder_fuzzer.cc	['encoder_fuzzer']	['encoder_fuzzer']
/src/libheif/examples/sdl.hh	[]	[]
/src/libheif/examples/heif_dec.cc	[]	[]
/src/libheif/libheif/codecs/decoder.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/api/libheif/heif_items.cc	[]	[]
/src/libheif/libheif/image-items/jpeg2000.h	[]	[]
/src/libheif/libheif/codecs/avif_boxes.h	[]	[]
/src/libheif/libheif/color-conversion/alpha.cc	[]	[]
/src/libheif/libheif/plugins/encoder_mask.cc	[]	[]
/src/libheif/libheif/sequences/seq_boxes.h	[]	[]
/src/libheif/libheif/image-items/jpeg.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_enc.h	[]	[]
/src/libheif/libheif/image-items/grid.cc	[]	[]
/src/libheif/libheif/image-items/avc.h	[]	[]
/src/libheif/extra/getopt_long.c	[]	[]
/src/libheif/tests/uncompressed_encode.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder_component_interleave.cc	[]	[]
/src/libheif/libheif/context.h	[]	[]
/src/libheif/libheif/image-items/mask_image.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_block_pixel_interleave.cc	[]	[]
/src/libheif/libheif/image-items/avif.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_dec.cc	[]	[]
/src/libheif/libheif/plugins/decoder_uncompressed.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_row_interleave.h	[]	[]
/src/libheif/libheif/text.h	[]	[]
/src/libheif/libheif/codecs/jpeg_boxes.h	[]	[]
/src/libheif/tests/encode.cc	['encoder_fuzzer']	[]
/src/libheif/libheif/api/libheif/heif_emscripten.h	[]	[]
/src/libheif/examples/heif_test.cc	[]	[]
/src/libheif/tests/uncompressed_decode.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder.h	[]	[]
/src/libheif/libheif/plugins_windows.h	[]	[]
/src/libheif/tests/conversion.cc	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/jpeg2000_enc.h	[]	[]
/src/libheif/libheif/codecs/avif_boxes.cc	[]	[]
/src/libheif/fuzzing/box_fuzzer.cc	['box_fuzzer']	['box_fuzzer']
/src/libheif/libheif/security_limits.cc	['file_fuzzer', 'encoder_fuzzer']	['file_fuzzer', 'encoder_fuzzer']
/src/libheif/fuzzing/file_fuzzer.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/codecs/uncompressed/unc_codec.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_properties.cc	[]	[]
/src/libheif/libheif/plugins/decoder_openh264.cc	[]	[]
/src/libheif/libheif/image-items/hevc.cc	[]	[]
/src/libheif/libheif/compression_zlib.cc	[]	[]
/src/libheif/heifio/exif.cc	['file_fuzzer']	[]
/src/libheif/libheif/image-items/mask_image.h	[]	[]
/src/libheif/libheif/color-conversion/yuv2rgb.cc	[]	[]
/src/libheif/libheif/color-conversion/hdr_sdr.cc	[]	[]
/src/libheif/tests/uncompressed_decode_rgb16.cc	[]	[]
/src/libheif/libheif/codecs/jpeg2000_boxes.cc	[]	[]
/src/libheif/libheif/mdat_data.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_dec.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_pixel_interleave.cc	[]	[]
/src/libheif/libheif/color-conversion/rgb2yuv.cc	[]	[]
/src/libheif/libheif/sequences/track_visual.h	[]	[]
/src/libheif/gdk-pixbuf/pixbufloader-heif.c	[]	[]
/src/libheif/tests/uncompressed_decode_mono.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.cc	[]	[]
/src/libheif/tests/test_utils.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/uncompressed/unc_boxes.h	[]	[]
/src/libheif/libheif/codecs/hevc_dec.cc	[]	[]
/src/libheif/heifio/encoder_y4m.h	[]	[]
/src/libheif/libheif/color-conversion/chroma_sampling.cc	[]	[]
/src/libheif/libheif/codecs/avc_enc.h	[]	[]
/src/libheif/libheif/box.cc	['color_conversion_fuzzer', 'box_fuzzer', 'file_fuzzer']	['box_fuzzer', 'file_fuzzer']
/src/libheif/examples/heif_thumbnailer.cc	[]	[]
/src/libheif/libheif/codecs/jpeg_dec.h	[]	[]
/src/libheif/libheif/color-conversion/rgb2yuv_sharp.cc	[]	[]
/src/libheif/heifio/encoder.h	[]	[]
/src/libheif/examples/heif_view.cc	[]	[]
/src/libheif/libheif/image-items/iden.h	[]	[]
/src/libheif/heifio/encoder_tiff.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder_rgb_block_pixel_interleave.cc	[]	[]

Directories in report

Directory
/src/libheif/tests/
/src/libheif/libheif/plugins/
/src/libheif/libheif/codecs/
/src/libheif/heifio/
/src/libheif/gdk-pixbuf/
/src/libheif/examples/
/src/libheif/libheif/
/src/libheif/libheif/sequences/
/src/libheif/fuzzing/
/src/libheif/libheif/api/libheif/
/src/libheif/extra/
/src/libheif/libheif/image-items/
/src/libheif/libheif/codecs/uncompressed/
/src/libheif/libheif/color-conversion/

This section shows a list of 3rd party function calls and their relative coverage information. By static analysis of the target project code, all of the 3rd party function call and their caller information, including the source file and line number that initiate the call are captured. The caller source code file and line number are shown in column 2 while column 1 is the function name of the 3rd party function call. Each occurrent of the 3rd party function call will occuply a separate row. Column 3 of each row indicate if the 3rd party call in the source file line is unreachable. Column 4 lists all fuzzers that have covered that particular system call in that specific location (source file and line)during their dynamic fuzzing.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Covered by Fuzzers