High level conclusions

Fuzzer encoder_fuzzer is blocked:

The runtime code coverage of encoder_fuzzer covers 11.03% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer file_fuzzer is blocked:

The runtime code coverage of file_fuzzer covers 19.64% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer color_conversion_fuzzer is blocked:

The runtime code coverage of color_conversion_fuzzer covers 12.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer box_fuzzer is blocked:

The runtime code coverage of box_fuzzer covers 0.694% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 3.461% of cyclomatic complexity.

Fuzzers reach 2.317% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

130 / 5610

Cyclomatic complexity statically reachable by fuzzers

355 / 10256

Runtime code coverage of functions

98 / 5610

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: box_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	263	95.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	12	4.36%
All colors	275	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
251	17	LLVMFuzzerTestOneInput	call site: 00017	BoxHeader::parse_header
12	2	LLVMFuzzerTestOneInput	call site: 00002	HeifContext::reset_to_empty_heif

Runtime coverage analysis

Covered functions

536

Functions that are reachable but not covered

143

Reachable functions

144

Percentage of reachable functions covered

0.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/box_fuzzer.cc	11
libheif/context.cc	9
libheif/box.cc	121
libheif/common_utils.h	3

Fuzzer: color_conversion_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	501	89.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	55	9.87%
All colors	557	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
257	9	LLVMFuzzerTestOneInput	call site: 00009	Box::read
189	343	heif_color_conversion_options_ext_copy	call site: 00343	ColorConversionPipeline::construct_pipeline
13	283	LLVMFuzzerTestOneInput	call site: 00283	Catch::ReporterRegistry::create
12	299	LLVMFuzzerTestOneInput	call site: 00299	Box::read
10	320	LLVMFuzzerTestOneInput	call site: 00320	Box::read
8	535	LLVMFuzzerTestOneInput	call site: 00535
6	2	LLVMFuzzerTestOneInput	call site: 00002	BitstreamRange::prepare_read
4	268	LLVMFuzzerTestOneInput	call site: 00268	Box::read
1	332	LLVMFuzzerTestOneInput	call site: 00332
1	341	LLVMFuzzerTestOneInput	call site: 00341	heif_color_conversion_options_ext_copy

Runtime coverage analysis

Covered functions

203

Functions that are reachable but not covered

44

Reachable functions

50

Percentage of reachable functions covered

12.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/color_conversion_fuzzer.cc	31
libheif/bitstream.cc	8
libheif/bitstream.h	3
libheif/box.cc	121
libheif/common_utils.h	3
tests/catch_amalgamated.cpp	10
libheif/api/libheif/heif_encoding.cc	2
libheif/api/libheif/heif_color.cc	3
libheif/color-conversion/colorconversion.cc	84
libheif/pixelimage.cc	1
libheif/nclx.h	2
libheif/color-conversion/colorconversion.h	1
tests/conversion.cc	6

Fuzzer: file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1425	91.6%
gold	[1:9]	14	0.90%
yellow	[10:29]	10	0.64%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	105	6.75%
All colors	1554	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
468	223	heif_context_read_from_memory	call site: 00223	HeifContext::read_from_memory
369	1142	heif_context_get_image_handle	call site: 01142	load_image
132	732	heif_nclx_color_profile_alloc	call site: 00732	ColorConversionPipeline::construct_pipeline
101	70	heif_init	call site: 00070	list_all_potential_plugins_in_directory
89	970	heif_context_get_number_of_top_level_images	call site: 00970	heif_image_handle_get_metadata
67	2	heif_init	call site: 00002
30	1063	heif_image_handle_get_metadata	call site: 01063	heif_image_get_component_readonly
26	903	heif_image_add_plane_safe	call site: 00903	MemoryHandle::alloc
24	878	heif_image_create	call site: 00878	Catch::ReporterRegistry::create
19	712	heif_decode_image	call site: 00712	HeifContext::convert_to_output_colorspace
15	188	heif_main_brand	call site: 00188
11	1096	heif_image_handle_get_metadata	call site: 01096	Error::error_struct

Runtime coverage analysis

Covered functions

2521

Functions that are reachable but not covered

135

Reachable functions

168

Percentage of reachable functions covered

19.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/file_fuzzer.cc	40
libheif/init.cc	29
libheif/color-conversion/colorconversion.cc	84
libheif/plugin_registry.cc	33
libheif/plugins_windows.cc	8
libheif/plugins_unix.cc	12
libheif/api/libheif/heif_library.cc	2
libheif/api/libheif/heif_brands.cc	8
libheif/common_utils.h	3
libheif/api/libheif/heif_context.cc	17
libheif/api/libheif/heif_security.cc	1
libheif/context.cc	163
libheif/image-items/image_item.cc	22
libheif/common_utils.cc	1
libheif/image-items/overlay.h	1
libheif/image-items/image_item.h	3
libheif/image-items/jpeg2000.cc	7
libheif/codecs/decoder.cc	1
libheif/box.cc	11
libheif/codecs/hevc_boxes.cc	18
libheif/bitstream.cc	5
tests/catch_amalgamated.cpp	12
libheif/pixelimage.cc	18
tests/conversion.cc	6
libheif/nclx.h	2
libheif/box.h	2
libheif/sequences/track.cc	10
libheif/sequences/track_visual.cc	11
libheif/error.cc	7
libheif/error.h	2
tests/test_utils.cc	4
libheif/api/libheif/heif_decoding.cc	10
libheif/api/libheif/heif_color.cc	8
libheif/color-conversion/colorconversion.h	1
libheif/plugins/decoder_libde265.cc	11
libheif/api/libheif/heif_image.cc	23
libheif/security_limits.cc	4
libheif/pixelimage.h	7
libheif/api/libheif/heif_image_handle.cc	4
libheif/api/libheif/heif_metadata.cc	10
libheif/api/libheif/heif_cxx.h	5
tests/uncompressed_decode_rgb.cc	12
tests/uncompressed_encode_multicomponent.cc	10
libheif/api/libheif/heif_uncompressed.cc	8
examples/heif_enc.cc	17
heifio/decoder_png.cc	41
heifio/exif.cc	7
heifio/decoder_y4m.cc	13
heifio/decoder_raw.cc	16
heifio/decoder_jpeg.cc	39
libheif/api/libheif/heif_aux_images.cc	6

Fuzzer: encoder_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	314	84.1%
gold	[1:9]	1	0.26%
yellow	[10:29]	2	0.53%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	56	15.0%
All colors	373	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
169	4	heif_init	call site: 00004	list_all_potential_plugins_in_directory
49	206	heif_image_create	call site: 00206	MemoryHandle::alloc
27	316	heif_context_encode_image	call site: 00316	get_encoder_or_skip_test
19	296	heif_context_encode_image	call site: 00296	ImageExtraData::has_nclx_color_profile
14	257	heif_image_create	call site: 00257	Catch::ReporterRegistry::create
8	272	heif_image_add_plane	call site: 00272	Error::error_struct
7	284	heif_image_get_plane	call site: 00284	heif_image_get_plane
6	179	heif_get_encoder_descriptors	call site: 00179	load_plugins_if_not_initialized_yet
4	345	heif_context_encode_image	call site: 00345
4	357	LLVMFuzzerTestOneInput	call site: 00357	Error::error_struct
2	362	heif_context_write	call site: 00362	Catch::JsonUtils::appendCommaNewline
1	2	heif_context_alloc	call site: 00002	heif_init

Runtime coverage analysis

Covered functions

2314

Functions that are reachable but not covered

129

Reachable functions

145

Percentage of reachable functions covered

11.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzing/encoder_fuzzer.cc	22
libheif/api/libheif/heif_context.cc	10
libheif/init.cc	21
libheif/color-conversion/colorconversion.cc	35
libheif/plugin_registry.cc	33
libheif/plugins_windows.cc	8
libheif/plugins_unix.cc	12
libheif/api/libheif/heif_library.cc	2
libheif/api/libheif/heif_encoding.cc	24
libheif/api/libheif/heif_image.cc	14
tests/catch_amalgamated.cpp	8
libheif/plugins/decoder_libde265.cc	11
libheif/pixelimage.cc	9
libheif/security_limits.cc	4
libheif/error.cc	7
libheif/error.h	1
libheif/pixelimage.h	4
tests/conversion.cc	6
libheif/nclx.h	2
tests/encode.cc	6
tests/test_utils.cc	2
libheif/context.cc	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
do_encode_sequence	/src/libheif/examples/heif_enc.cc	4	['heif_context*', 'heif_encoder*', 'heif_encoding_options*', 'std::vector ']	9	0	92	22	26	542	0	671	631
HeifContext::read	/src/libheif/libheif/context.cc	1	['std::shared_ptr ']	6	0	7	2	1	184	1	235	231
ImageItem_uncompressed::decode_compressed_image	/src/libheif/libheif/image-items/unc_image.cc	5	['heif_decoding_options', 'bool', 'uint32_t', 'uint32_t', 'std::set ']	9	0	11	3	2	123	0	145	145

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

315 / 5610

Cyclomatic complexity statically reachable by fuzzers

1361 / 10256

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzzing/box_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

fuzzing/color_conversion_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'heif_color_conversion_options_ext_copy']

fuzzing/file_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['heif_context_read_from_memory', 'heif_context_get_image_handle', 'heif_nclx_color_profile_alloc', 'heif_init', 'heif_context_get_number_of_top_level_images', 'heif_image_handle_get_metadata', 'heif_image_add_plane_safe', 'heif_image_create', 'heif_decode_image']

fuzzing/encoder_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['heif_init', 'heif_image_create', 'heif_context_encode_image', 'heif_image_add_plane', 'heif_image_get_plane', 'heif_get_encoder_descriptors', 'LLVMFuzzerTestOneInput']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
heif_decoding_options_copy	38	4	10.52%	['file_fuzzer']
Decoder::get_decoded_frame(heif_decoding_optionsconst&,unsignedlong*,heif_security_limitsconst*)	34	17	50.0%
fill_uncC_and_cmpd_from_profile(std::__1::shared_ptr const&,std::__1::shared_ptr &)	231	30	12.98%
UncompressedImageCodec::check_header_validity(std::__1::optional const>,std::__1::shared_ptr const&,std::__1::shared_ptr const&)	49	21	42.85%
UncompressedImageCodec::decode_uncompressed_image(HeifContextconst*,unsignedint,std::__1::shared_ptr &)	52	16	30.76%
ImageItem_Tiled::initialize_decoder()	96	8	8.333%
HeifPixelImage::get_primary_component()const	40	11	27.50%
HeifPixelImage::get_visual_image_bits_per_pixel()const	33	16	48.48%
HeifPixelImage::rotate_ccw(int,heif_security_limitsconst*)	75	37	49.33%
HeifPixelImage::mirror_inplace(heif_transform_mirror_direction,heif_security_limitsconst*)	49	15	30.61%
HeifPixelImage::scale_nearest_neighbor(std::__1::shared_ptr &,unsignedint,unsignedint,heif_security_limitsconst*)const	139	41	29.49%
libde265_v1_decode_next_image2(void*,heif_image**,unsignedlong*,heif_security_limitsconst*)	54	17	31.48%
Track::load(std::__1::shared_ptr const&)	246	104	42.27%
Track::init_sample_timing_table()	54	17	31.48%
Track_Visual::load(std::__1::shared_ptr const&)	37	9	24.32%
decoder_get_frame	96	45	46.87%
av1_find_mv_refs	35	13	37.14%
av1_setup_skip_mode_allowed	61	8	13.11%
add_ref_mv_candidate	53	28	52.83%
av1_dist_wtd_comp_weight_assign	38	8	21.05%
dec_calc_subpel_params	66	30	45.45%
read_tx_size_vartx	55	29	52.72%
decode_reconstruct_tx	43	22	51.16%
av1_decoder_remove	47	25	53.19%
decoder_context::read_slice_NAL(bitreader&,NAL_unit*,nal_header&)	49	20	40.81%
decoder_context::process_slice_segment_header(slice_segment_header*,de265_error*,long,nal_header*,void*)	91	24	26.37%
decoded_picture_buffer::new_image(std::__1::shared_ptr ,decoder_context*,long,void*,bool)	47	16	34.04%
Box_iloc::append_data(unsignedint,std::__1::vector >const&,unsignedchar)	50	21	42.0%
Box_iloc::write_mdat_after_iloc(StreamWriter&)	53	29	54.71%
fill_av1C_configuration_from_stream(Box_av1C::configuration*,unsignedcharconst*,int)	188	72	38.29%
HeifContext::write(StreamWriter&)	75	31	41.33%
HeifContext::encode_image(std::__1::shared_ptr const&,heif_encoder*,heif_encoding_optionsconst&,heif_image_input_class)	58	28	48.27%
HeifFile::add_orientation_properties(unsignedint,heif_orientation)	48	11	22.91%
ImageExtraData::generate_property_boxes(bool)const	44	15	34.09%
HeifPixelImage::extend_padding_to_size(unsignedint,unsignedint,bool,heif_security_limitsconst*)	53	29	54.71%
aom_set_parameter_integer(void*,charconst*,int)	32	14	43.75%
aom_set_parameter_string(void*,charconst*,charconst*)	40	15	37.5%
aom_start_sequence_encoding_intern(void*,heif_imageconst*,heif_image_input_class,unsignedint,unsignedint,heif_sequence_encoding_optionsconst*,bool)	148	81	54.72%
x265_set_parameter_string(void*,charconst*,charconst*)	39	20	51.28%
x265_start_sequence_encoding_intern(void*,heif_imageconst*,heif_image_input_class,unsignedint,unsignedint,heif_sequence_encoding_optionsconst*,bool)	218	103	47.24%
aom_codec_get_cx_data	35	17	48.57%
reset	34	18	52.94%
av1_loop_restoration_dealloc	40	19	47.5%
av1_quantize_b_facade	63	24	38.09%
quantize_fp_helper_c	36	14	38.88%
av1_write_sequence_header_obu	62	21	33.87%
write_sequence_header	54	16	29.62%
write_color_config	57	25	43.85%
write_uncompressed_header_obu	255	73	28.62%
encode_loopfilter	43	20	46.51%
encode_restoration_mode	65	3	4.615%
write_modes_sb	91	44	48.35%
write_delta_q_params	38	4	10.52%
write_tokens_b	37	11	29.72%
av1_write_metadata_array	38	6	15.78%
av1_find_cnn_layer_output_size	37	14	37.83%
av1_cnn_convolve	56	22	39.28%
av1_configure_buffer_updates	53	13	24.52%
av1_update_ref_frame_map	77	18	23.37%
av1_get_refresh_frame_flags	116	7	6.034%
av1_get_ref_frames	59	32	54.23%
choose_frame_source	44	17	38.63%
adjust_frame_rate	37	17	45.94%
denoise_and_encode	116	37	31.89%
encode_rd_sb	71	37	52.11%
init_ref_frame_space	83	41	49.39%
encode_frame_internal	289	128	44.29%
setup_prune_ref_frame_mask	46	6	13.04%
av1_get_tpl_stats_sb	55	4	7.272%
av1_get_q_for_deltaq_objective	85	22	25.88%
av1_set_cost_upd_freq	60	30	50.0%
av1_dropout_qcoeff_num	64	9	14.06%
av1_receive_raw_frame	52	18	34.61%
av1_apply_encoding_flags	64	29	45.31%
set_tile_info	46	19	41.30%
set_bitstream_level_tier	50	14	28.00%
encode_frame_to_data_rate	204	85	41.66%
encode_with_recode_loop_and_filter	69	31	44.92%
encode_without_recode	128	68	53.12%
cdef_restoration_frame	51	20	39.21%
av1_set_size_dependent_vars	56	17	30.35%
av1_update_film_grain_parameters	36	12	33.33%
av1_finalize_encoded_frame	32	14	43.75%
highbd_set_var_fns	295	4	1.355%
construct_multi_layer_gf_structure	99	49	49.49%
set_multi_layer_params	49	7	14.28%
av1_highbd_fwd_txfm	66	36	54.54%
intra_rd_variance_factor	38	4	10.52%
rd_pick_filter_intra_sby	68	2	2.941%
intra_mode_info_cost_uv	40	19	47.5%
intra_mode_info_cost_y	56	26	46.42%
setup_block_rdmult	31	12	38.70%
encode_sb	113	58	51.32%
encode_b	113	49	43.36%
update_stats	230	27	11.73%
prune_partitions_after_none	42	11	26.19%
prune_partitions_after_split	31	11	35.48%
av1_prune_partitions_before_search	128	62	48.43%
av1_get_second_pass_params	177	91	51.41%
find_next_key_frame	152	32	21.05%
identify_regions	75	3	4.0%
calculate_gf_length	181	20	11.04%
define_gf_group	97	21	21.64%
av1_pick_filter_level	106	38	35.84%
rc_pick_q_and_bounds	59	18	30.50%
get_intra_q_and_bounds	68	15	22.05%
av1_fill_mode_rates	203	108	53.20%
rd_pick_intrabc_mode_sb	155	4	2.580%
set_mode_eval_params	66	21	31.81%
store_winner_mode_stats	54	5	9.259%
av1_set_speed_features_qindex_dependent	108	38	35.18%
calculate_next_superres_scale	70	19	27.14%
validate_size_scales	49	4	8.163%
av1_write_second_pass_per_frame_info	38	5	13.15%
av1_pick_uniform_tx_size_type_yrd	51	24	47.05%
get_tx_mask	142	74	52.11%
recon_intra	36	15	41.66%
choose_largest_tx_size	88	20	22.72%
x265::general_log(x265_paramconst*,charconst*,int,charconst*,...)	35	3	8.571%
x265::cpu_detect(bool)	159	9	5.660%
x265::Deblock::setEdgefilterPU(x265::CUDataconst*,unsignedint,int,unsignedchar*,unsignedint)	37	10	27.02%
x265::Deblock::getBoundaryStrength(x265::CUDataconst*,int,unsignedint,unsignedcharconst*)	46	5	10.86%
x265::Frame::create(x265_param*,float*)	93	27	29.03%
x265::Frame::destroy()	123	48	39.02%
x265::Lowres::create(x265_param*,x265::PicYuv*,unsignedint)	153	71	46.40%
x265::Lowres::destroy(x265_param*)	77	36	46.75%
x265_param_default_preset	249	44	17.67%
x265_param_parse	544	148	27.20%
x265::x265_print_params(x265_param*)	121	3	2.479%
x265::parseLambdaFile(x265_param*)	56	3	5.357%
x265::PicYuv::copyFromPicture(x265_pictureconst&,x265_paramconst&,int,int,bool)	185	99	53.51%
x265::x265_report_simd(x265_param*)	33	3	9.090%
unsignedintx265::Quant::rdoQuant<5u>(x265::CUDataconst&,short*,x265::TextType,unsignedint,bool)	583	309	53.00%
x265::Slice::setRefPicList(x265::PicList&,int)	84	9	10.71%
x265::ThreadPool::allocThreadPools(x265_param*,int&,bool)	191	82	42.93%
x265::Analysis::compressCTU(x265::CUData&,x265::Frame&,x265::CUGeomconst&,x265::Entropyconst&)	139	28	20.14%
x265::Analysis::calculateQpforCuSize(x265::CUDataconst&,x265::CUGeomconst&,int,double)	75	37	49.33%
x265_encoder_open_216	87	41	47.12%
x265_api_get_216	43	4	9.302%
x265::DPB::recycleUnreferenced()	64	11	17.18%
x265::DPB::prepareEncode(x265::Frame*)	171	47	27.48%
x265::DPB::decodingRefreshMarking(int,NalUnitType,int)	34	12	35.29%
x265::DPB::applyReferencePictureSet(x265::RPS*,int,int,bool,int)	33	9	27.27%
x265::Encoder::create()	362	103	28.45%
x265::Encoder::destroy()	107	47	43.92%
x265::Encoder::copyUserSEIMessages(x265::Frame*,x265_pictureconst*)	56	13	23.21%
x265::Encoder::encode(x265_pictureconst*,x265_picture*)	902	264	29.26%
x265::Encoder::printSummary()	60	3	5.0%
x265::Encoder::finishFrameStats(x265::Frame*,x265::FrameEncoder*,x265_frame_stats*,int,int)	178	63	35.39%
x265::Encoder::getStreamHeaders(x265::NALList&,x265::Entropy&,x265::Bitstream&)	78	27	34.61%
x265::Encoder::configure(x265_param*)	705	195	27.65%
x265::Entropy::codeProfileTier(x265::ProfileTierLevelconst&,int,int)	62	25	40.32%
x265::Entropy::codeSliceHeader(x265::Sliceconst&,x265::FrameData&,unsignedint,unsignedint,int,int)	101	42	41.58%
x265::Entropy::codeSaoOffset(x265::SaoCtuParamconst&,int)	31	9	29.03%
x265::Entropy::codePartSize(x265::CUDataconst&,unsignedint,unsignedint)	44	12	27.27%
x265::FrameEncoder::compressFrame(int)	692	207	29.91%
x265::FrameEncoder::initDecodedPictureHashSEI(int,int,int,int)	59	11	18.64%
x265::FrameEncoder::processRowEncoder(int,x265::ThreadLocalData&,int)	462	166	35.93%
x265::FrameEncoder::collectCTUStatistics(x265::CUDataconst&,x265::FrameStats*)	78	11	14.10%
x265::FrameFilter::processPostRow(int,int)	54	19	35.18%
x265::determineLevel(x265_paramconst&,x265::VPS&)	185	82	44.32%
x265::enforceLevel(x265_param&,x265::VPS&)	130	10	7.692%
x265_param_apply_profile	54	20	37.03%
x265::RateControl::init(x265::SPSconst&)	359	41	11.42%
x265::RateControl::rateControlStart(x265::Frame*,x265::RateControlEntry*,x265::Encoder*)	279	83	29.74%
x265::RateControl::rateEstimateQscale(x265::Frame*,x265::RateControlEntry*)	432	75	17.36%
x265::RateControl::clipQscale(x265::Frame*,x265::RateControlEntry*,double)	139	8	5.755%
x265::RateControl::rateControlEnd(x265::Frame*,long,x265::RateControlEntry*,int*)	160	82	51.24%
x265::RateControl::destroy()	53	14	26.41%
x265::RDCost::setQP(x265::Sliceconst&,int)	34	17	50.0%
x265::SAO::generateChromaOffsets(x265::SaoCtuParam**,int,int)	85	43	50.58%
x265::LookaheadTLD::calcAdaptiveQuantFrame(x265::Frame*,x265_param*)	232	64	27.58%
x265::Lookahead::getEstimatedPictureCost(x265::Frame*)	100	26	26.0%
x265::Lookahead::slicetypeDecide()	617	139	22.52%
x265::CostEstimateGroup::estimateFrameCost(x265::LookaheadTLD&,int,int,int,bool)	71	9	12.67%

New fuzzers

The below fuzzers are templates and suggestions for how to target the set of optimal functions above

heif_enc.cc

Target file: /src/libheif/examples/heif_enc.cc
Target functions: do_encode_sequence

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target do_encode_sequence */
  UNKNOWN_TYPE unknown_0;
  UNKNOWN_TYPE unknown_1;
  UNKNOWN_TYPE unknown_2;
  UNKNOWN_TYPE unknown_3;
  do_encode_sequence(unknown_0, unknown_1, unknown_2, unknown_3);

  af_safe_gb_cleanup();
}

context.cc

Target file: /src/libheif/libheif/context.cc
Target functions: HeifContext::read

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target HeifContext::read */
  UNKNOWN_TYPE unknown_4;
  HeifContext::read(unknown_4);

  af_safe_gb_cleanup();
}

unc_image.cc

Target file: /src/libheif/libheif/image-items/unc_image.cc
Target functions: ImageItem_uncompressed::decode_compressed_image

#include "ada_fuzz_header.h"

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  af_safe_gb_init(data, size);

  /* target ImageItem_uncompressed::decode_compressed_image */
  UNKNOWN_TYPE unknown_5;
  UNKNOWN_TYPE unknown_6;
  UNKNOWN_TYPE unknown_7;
  UNKNOWN_TYPE unknown_8;
  UNKNOWN_TYPE unknown_9;
  ImageItem_uncompressed::decode_compressed_image(unknown_5, unknown_6, unknown_7, unknown_8, unknown_9);

  af_safe_gb_cleanup();
}

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
/src/libheif/tests/catch_amalgamated.cpp	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	['encoder_fuzzer']
/src/libheif/libheif/plugins/decoder_aom.cc	[]	[]
/src/libheif/examples/heif_thumbnailer.cc	[]	[]
/src/libheif/libheif/codecs/jpeg_boxes.cc	[]	[]
/src/libheif/libheif/image-items/unc_image.h	[]	[]
/src/libheif/libheif/sequences/chunk.h	[]	[]
/src/libheif/tests/conversion.cc	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/tests/tiffdecode.cc	[]	[]
/src/libheif/libheif/file_layout.h	[]	[]
/src/libheif/libheif/codecs/hevc_enc.cc	[]	[]
/src/libheif/heifio/decoder_tiff.h	[]	[]
/src/libheif/libheif/image-items/jpeg2000.cc	['file_fuzzer']	[]
/src/libheif/libheif/common_utils.cc	['file_fuzzer']	[]
/src/libheif/libheif/brands.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_dec.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_block_pixel_interleave.cc	[]	[]
/src/libheif/libheif/codecs/encoder.h	[]	[]
/src/libheif/libheif/image-items/jpeg.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_context.cc	['file_fuzzer', 'encoder_fuzzer']	['file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/plugins/decoder_vvdec.cc	[]	[]
/src/libheif/libheif/image-items/grid.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder.cc	[]	[]
/src/libheif/libheif/image-items/avif.h	[]	[]
/src/libheif/libheif/api/libheif/heif_uncompressed.cc	['file_fuzzer']	[]
/src/libheif/libheif/codecs/jpeg2000_boxes.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder.cc	[]	[]
/src/libheif/libheif/image-items/iden.h	[]	[]
/src/libheif/libheif/api/libheif/heif_brands.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/heifio/stubs.cc	[]	[]
/src/libheif/libheif/codecs/hevc_boxes.cc	['file_fuzzer']	[]
/src/libheif/libheif/image-items/avif.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_image.cc	['file_fuzzer', 'encoder_fuzzer']	['file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/color-conversion/hdr_sdr.cc	[]	[]
/src/libheif/libheif/plugins_unix.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/color-conversion/rgb2yuv_sharp.cc	[]	[]
/src/libheif/libheif/codecs/decoder.h	[]	[]
/src/libheif/libheif/image-items/hevc.cc	[]	[]
/src/libheif/examples/heif_test.cc	[]	[]
/src/libheif/libheif/color-conversion/monochrome.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder_rgb_block_pixel_interleave.cc	[]	[]
/src/libheif/tests/uncompressed_decode_rgb7.cc	[]	[]
/src/libheif/libheif/plugins/encoder_rav1e.cc	[]	[]
/src/libheif/libheif/mdat_data.h	[]	[]
/src/libheif/libheif/image-items/image_item.h	['file_fuzzer']	[]
/src/libheif/libheif/init.cc	['file_fuzzer', 'encoder_fuzzer']	['file_fuzzer', 'encoder_fuzzer']
/src/libheif/tests/catch_amalgamated.hpp	[]	[]
/src/libheif/libheif/plugin_registry.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/avc_boxes.cc	[]	[]
/src/libheif/libheif/plugins_windows.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/jpeg_dec.h	[]	[]
/src/libheif/libheif/common_utils.h	['box_fuzzer', 'color_conversion_fuzzer', 'file_fuzzer']	[]
/src/libheif/libheif/bitstream.cc	['color_conversion_fuzzer', 'file_fuzzer']	['color_conversion_fuzzer', 'file_fuzzer']
/src/libheif/libheif/image-items/jpeg2000.h	[]	[]
/src/libheif/libheif/api/libheif/heif_experimental.cc	[]	[]
/src/libheif/libheif/region.cc	[]	[]
/src/libheif/libheif/sequences/seq_boxes.h	[]	[]
/src/libheif/libheif/error.h	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/tests/encode_htj2k.cc	[]	[]
/src/libheif/libheif/codecs/hevc_dec.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_text.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_component_interleave.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_image_handle.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/codecs/uncompressed/unc_encoder_component_interleave.cc	[]	[]
/src/libheif/fuzzing/box_fuzzer.cc	['box_fuzzer']	['box_fuzzer']
/src/libheif/fuzzing/color_conversion_fuzzer.cc	['color_conversion_fuzzer']	['color_conversion_fuzzer']
/src/libheif/extra/getopt_long.c	[]	[]
/src/libheif/libheif/api/libheif/heif_security.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/codecs/vvc_dec.h	[]	[]
/src/libheif/examples/benchmark.cc	[]	[]
/src/libheif/tests/uncompressed_decode_ycbcr.cc	[]	[]
/src/libheif/libheif/plugins/nalu_utils.h	[]	[]
/src/libheif/libheif/api/libheif/heif_cxx.h	['file_fuzzer']	[]
/src/libheif/libheif/codecs/hevc_enc.h	[]	[]
/src/libheif/tests/uncompressed_encode_multicomponent.cc	['file_fuzzer']	[]
/src/libheif/gdk-pixbuf/pixbufloader-heif.c	[]	[]
/src/libheif/heifio/encoder.h	[]	[]
/src/libheif/tests/mini_decode.cc	[]	[]
/src/libheif/libheif/image-items/avc.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_decoding.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/compression.cc	[]	[]
/src/libheif/heifio/encoder_png.h	[]	[]
/src/libheif/examples/heif_dec.cc	[]	[]
/src/libheif/libheif/security_limits.h	[]	[]
/src/libheif/libheif/compression_zlib.cc	[]	[]
/src/libheif/libheif/codecs/vvc_enc.h	[]	[]
/src/libheif/libheif/image-items/grid.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder_rgb_pixel_interleave.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_entity_groups.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_legacybase.cc	[]	[]
/src/libheif/libheif/pixelimage.h	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/uncompressed/unc_dec.cc	[]	[]
/src/libheif/libheif/image-items/mask_image.h	[]	[]
/src/libheif/libheif/nclx.cc	[]	[]
/src/libheif/libheif/plugins_windows.h	[]	[]
/src/libheif/tests/encode.cc	['encoder_fuzzer']	[]
/src/libheif/examples/SAI_datafile.cc	[]	[]
/src/libheif/libheif/text.h	[]	[]
/src/libheif/libheif/codecs/avc_dec.h	[]	[]
/src/libheif/libheif/api/libheif/heif_plugin.h	[]	[]
/src/libheif/examples/vmt.cc	[]	[]
/src/libheif/libheif/image-items/image_item.cc	['file_fuzzer']	[]
/src/libheif/heifio/encoder_tiff.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_emscripten.h	[]	[]
/src/libheif/heifio/encoder_png.cc	[]	[]
/src/libheif/libheif/codecs/avc_enc.h	[]	[]
/src/libheif/examples/sdl.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_color.cc	['color_conversion_fuzzer', 'file_fuzzer']	['color_conversion_fuzzer', 'file_fuzzer']
/src/libheif/libheif/box.h	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/plugins/decoder_ffmpeg.cc	[]	[]
/src/libheif/extra/getopt.c	[]	[]
/src/libheif/libheif/codecs/avif_dec.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_metadata.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/heifio/decoder_tiff.cc	[]	[]
/src/libheif/libheif/text.cc	[]	[]
/src/libheif/libheif/plugins_unix.h	[]	[]
/src/libheif/libheif/plugins/decoder_dav1d.cc	[]	[]
/src/libheif/tests/uncompressed_decode.cc	[]	[]
/src/libheif/tests/uncompressed_decode_mono.cc	[]	[]
/src/libheif/libheif/plugins/encoder_x265.cc	[]	[]
/src/libheif/libheif/image-items/hevc.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_codec.cc	[]	[]
/src/libheif/libheif/context.cc	['box_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	['box_fuzzer', 'file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/sequences/track.cc	['file_fuzzer']	[]
/src/libheif/libheif/api/libheif/heif_library.h	[]	[]
/src/libheif/libheif/omaf_boxes.cc	[]	[]
/src/libheif/libheif/codecs/avc_boxes.h	[]	[]
/src/libheif/libheif/image-items/unc_image.cc	[]	[]
/src/libheif/libheif/codecs/avif_boxes.h	[]	[]
/src/libheif/libheif/api/libheif/heif_properties.cc	[]	[]
/src/libheif/libheif/sequences/track_visual.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/image-items/overlay.h	['file_fuzzer']	[]
/src/libheif/libheif/sequences/track_metadata.cc	[]	[]
/src/libheif/libheif/file.h	[]	[]
/src/libheif/libheif/image-items/avc.h	[]	[]
/src/libheif/libheif/plugins/encoder_uvg266.cc	[]	[]
/src/libheif/libheif/image-items/jpeg.h	[]	[]
/src/libheif/libheif/region.h	[]	[]
/src/libheif/libheif/context.h	[]	[]
/src/libheif/heifio/encoder_y4m.cc	[]	[]
/src/libheif/heifio/exif.cc	['file_fuzzer']	[]
/src/libheif/libheif/security_limits.cc	['file_fuzzer', 'encoder_fuzzer']	['file_fuzzer', 'encoder_fuzzer']
/src/libheif/heifio/decoder_png.cc	['file_fuzzer']	[]
/src/libheif/libheif/nclx.h	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	['file_fuzzer']
/src/libheif/libheif/codecs/jpeg_enc.cc	[]	[]
/src/libheif/libheif/color-conversion/rgb2rgb.cc	[]	[]
/src/libheif/libheif/color-conversion/chroma_sampling.cc	[]	[]
/src/libheif/libheif/file_layout.cc	[]	[]
/src/libheif/libheif/plugins/encoder_openjph.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_enc.h	[]	[]
/src/libheif/libheif/codecs/avif_enc.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.cc	[]	[]
/src/libheif/tests/uncompressed_decode_ycbcr422.cc	[]	[]
/src/libheif/examples/sdl.hh	[]	[]
/src/libheif/libheif/plugins/encoder_kvazaar.cc	[]	[]
/src/libheif/libheif/plugins/decoder_webcodecs.cc	[]	[]
/src/libheif/heifio/decoder_raw.cc	['file_fuzzer']	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder_rgb_bytealign_pixel_interleave.cc	[]	[]
/src/libheif/libheif/mini.cc	[]	[]
/src/libheif/tests/uncompressed_decode_ycbcr420.cc	[]	[]
/src/libheif/libheif/color-conversion/yuv2rgb.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_enc.cc	[]	[]
/src/libheif/libheif/plugins/decoder_jpeg.cc	[]	[]
/src/libheif/heifio/encoder_y4m.h	[]	[]
/src/libheif/libheif/image-items/mask_image.cc	[]	[]
/src/libheif/libheif/box.cc	['box_fuzzer', 'color_conversion_fuzzer', 'file_fuzzer']	['box_fuzzer', 'file_fuzzer']
/src/libheif/libheif/sequences/chunk.cc	[]	[]
/src/libheif/libheif/id_creator.h	[]	[]
/src/libheif/libheif/codecs/jpeg2000_enc.cc	[]	[]
/src/libheif/libheif/image-items/tiled.h	[]	[]
/src/libheif/libheif/color-conversion/colorconversion.cc	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/image-items/overlay.cc	[]	[]
/src/libheif/libheif/codecs/avif_boxes.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_component_interleave.h	[]	[]
/src/libheif/libheif/codecs/vvc_enc.cc	[]	[]
/src/libheif/fuzzing/encoder_fuzzer.cc	['encoder_fuzzer']	['encoder_fuzzer']
/src/libheif/libheif/plugins/encoder_mask.cc	[]	[]
/src/libheif/libheif/plugins/encoder_openjpeg.cc	[]	[]
/src/libheif/libheif/error.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/id_creator.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_block_component_interleave.cc	[]	[]
/src/libheif/libheif/image-items/iden.cc	[]	[]
/src/libheif/libheif/sequences/seq_boxes.cc	[]	[]
/src/libheif/libheif/codecs/vvc_dec.cc	[]	[]
/src/libheif/libheif/color-conversion/colorconversion.h	['color_conversion_fuzzer', 'file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/plugins/encoder_uncompressed.cc	[]	[]
/src/libheif/tests/test_utils.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/codecs/jpeg_dec.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.h	[]	[]
/src/libheif/libheif/plugin_registry.h	[]	[]
/src/libheif/libheif/api/libheif/heif_aux_images.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/plugins/decoder_libde265.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/logging.h	[]	[]
/src/libheif/tests/uncompressed_decode_rgb565.cc	[]	[]
/src/libheif/libheif/plugins/encoder_jpeg.cc	[]	[]
/src/libheif/heifio/decoder_jpeg.cc	['file_fuzzer']	[]
/src/libheif/libheif/color-conversion/bayer_bilinear.cc	[]	[]
/src/libheif/libheif/plugins/encoder_x264.cc	[]	[]
/src/libheif/libheif/codecs/jpeg2000_boxes.h	[]	[]
/src/libheif/examples/heif_view.cc	[]	[]
/src/libheif/libheif/file.cc	[]	[]
/src/libheif/libheif/codecs/vvc_boxes.h	[]	[]
/src/libheif/libheif/codecs/hevc_boxes.h	[]	[]
/src/libheif/libheif/plugins/encoder_svt.cc	[]	[]
/src/libheif/libheif/codecs/avif_enc.cc	[]	[]
/src/libheif/libheif/bitstream.h	['color_conversion_fuzzer']	['color_conversion_fuzzer']
/src/libheif/libheif/logging.cc	[]	[]
/src/libheif/heifio/decoder_y4m.cc	['file_fuzzer']	[]
/src/libheif/tests/uncompressed_decode_generic_compression.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_encoding.cc	['color_conversion_fuzzer', 'encoder_fuzzer']	['color_conversion_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/sequences/track.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_encoder.h	[]	[]
/src/libheif/libheif/plugins/decoder_openjpeg.cc	[]	[]
/src/libheif/libheif/plugins/nalu_utils.cc	[]	[]
/src/libheif/libheif/codecs/avif_dec.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_row_interleave.cc	[]	[]
/src/libheif/libheif/codecs/avc_dec.cc	[]	[]
/src/libheif/libheif/plugins/decoder_uncompressed.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_sequences.cc	[]	[]
/src/libheif/heifio/encoder.cc	[]	[]
/src/libheif/libheif/pixelimage.cc	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']	['color_conversion_fuzzer', 'file_fuzzer', 'encoder_fuzzer']
/src/libheif/libheif/codecs/uncompressed/unc_decoder_pixel_interleave.cc	[]	[]
/src/libheif/examples/common.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_pixel_interleave.h	[]	[]
/src/libheif/libheif/codecs/encoder.cc	[]	[]
/src/libheif/libheif/codecs/decoder.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/codecs/uncompressed/unc_boxes.cc	[]	[]
/src/libheif/examples/heif_enc.cc	['file_fuzzer']	[]
/src/libheif/libheif/api/libheif/heif_library.cc	['file_fuzzer', 'encoder_fuzzer']	[]
/src/libheif/libheif/image-items/vvc.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_row_interleave.h	[]	[]
/src/libheif/libheif/api/libheif/heif_regions.cc	[]	[]
/src/libheif/libheif/plugins/encoder_aom.cc	[]	[]
/src/libheif/libheif/image-items/vvc.h	[]	[]
/src/libheif/libheif/sequences/track_visual.h	[]	[]
/src/libheif/libheif/color-conversion/rgb2yuv.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_bytealign_component_interleave.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_items.cc	[]	[]
/src/libheif/examples/heif_gen_bayer.cc	[]	[]
/src/libheif/libheif/api/libheif/heif_tiling.cc	[]	[]
/src/libheif/libheif/codecs/avc_enc.cc	[]	[]
/src/libheif/libheif/codecs/hevc_dec.h	[]	[]
/src/libheif/heifio/encoder_jpeg.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_boxes.h	[]	[]
/src/libheif/libheif/mini.h	[]	[]
/src/libheif/libheif/codecs/jpeg_enc.h	[]	[]
/src/libheif/libheif/omaf_boxes.h	[]	[]
/src/libheif/libheif/sequences/track_metadata.h	[]	[]
/src/libheif/libheif/api/libheif/heif_tai_timestamps.cc	[]	[]
/src/libheif/fuzzing/file_fuzzer.cc	['file_fuzzer']	['file_fuzzer']
/src/libheif/libheif/codecs/jpeg_boxes.h	[]	[]
/src/libheif/libheif/codecs/jpeg2000_dec.h	[]	[]
/src/libheif/libheif/api_structs.h	[]	[]
/src/libheif/tests/omaf.cc	[]	[]
/src/libheif/heifio/encoder_jpeg.cc	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder.h	[]	[]
/src/libheif/libheif/codecs/vvc_boxes.cc	[]	[]
/src/libheif/libheif/color-conversion/alpha.cc	[]	[]
/src/libheif/libheif/codecs/jpeg2000_dec.cc	[]	[]
/src/libheif/libheif/plugins/decoder_openh264.cc	[]	[]
/src/libheif/tests/uncompressed_encode.cc	[]	[]
/src/libheif/heifio/encoder_tiff.h	[]	[]
/src/libheif/libheif/plugins/encoder_vvenc.cc	[]	[]
/src/libheif/libheif/compression_brotli.cc	[]	[]
/src/libheif/tests/uncompressed_decode_rgb16.cc	[]	[]
/src/libheif/libheif/codecs/jpeg2000_enc.h	[]	[]
/src/libheif/libheif/codecs/uncompressed/unc_decoder_legacybase.h	[]	[]
/src/libheif/libheif/image-items/tiled.cc	[]	[]

Directories in report

Directory
/src/libheif/heifio/
/src/libheif/extra/
/src/libheif/libheif/api/libheif/
/src/libheif/libheif/color-conversion/
/src/libheif/gdk-pixbuf/
/src/libheif/libheif/codecs/
/src/libheif/libheif/plugins/
/src/libheif/examples/
/src/libheif/libheif/sequences/
/src/libheif/libheif/
/src/libheif/tests/
/src/libheif/fuzzing/
/src/libheif/libheif/codecs/uncompressed/
/src/libheif/libheif/image-items/

This section shows a list of 3rd party function calls and their relative coverage information. By static analysis of the target project code, all of the 3rd party function call and their caller information, including the source file and line number that initiate the call are captured. The caller source code file and line number are shown in column 2 while column 1 is the function name of the 3rd party function call. Each occurrent of the 3rd party function call will occuply a separate row. Column 3 of each row indicate if the 3rd party call in the source file line is unreachable. Column 4 lists all fuzzers that have covered that particular system call in that specific location (source file and line)during their dynamic fuzzing.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Covered by Fuzzers