High level conclusions

Fuzzers reach 44.71% of cyclomatic complexity.

Fuzzers reach 37.48% of all functions.

Fuzzer cjpeg_fuzzer is blocked:

The runtime code coverage of cjpeg_fuzzer covers 19.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer cjpeg_fuzzer_3_0_x is blocked:

The runtime code coverage of cjpeg_fuzzer_3_0_x covers 19.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

274 / 731

Cyclomatic complexity statically reachable by fuzzers

3188 / 7129

Runtime code coverage of functions

365 / 731

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: cjpeg_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	319	80.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	10	2.52%
lawngreen	50+	67	16.9%
All colors	396	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
18	18	6 : View List ['malloc', 'ftell', 'fopen', 'fread', 'fseek', 'exit']	685	959	cjpeg_main	call site: 00227	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:730
14	365	4 : View List ['keymatch', '__isoc99_sscanf', 'jpeg_set_colorspace', 'exit']	374	725	parse_switches(jpeg_compress_struct*,int,char**,int,int)	call site: 00000	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:323
6	6	1 : View List ['usage()']	703	977	cjpeg_main	call site: 00037	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:702
2	4	2 : View List ['out_of_memory', 'jpeg_get_small']	2	4	alloc_small	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:318
2	2	1 : View List ['read_stdin']	693	967	cjpeg_main	call site: 00219	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:709
0	2	1 : View List ['jpeg_mem_term']	14	16	jinit_memory_mgr	call site: 00009	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1227
0	0	None	703	1307	cjpeg_main	call site: 00004	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:651
0	0	None	703	977	cjpeg_main	call site: 00037	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:679
0	0	None	689	963	cjpeg_main	call site: 00223	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:720
0	0	None	374	725	parse_switches(jpeg_compress_struct*,int,char**,int,int)	call site: 00000	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:341
0	0	None	374	725	parse_switches(jpeg_compress_struct*,int,char**,int,int)	call site: 00000	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:347
0	0	None	374	725	parse_switches(jpeg_compress_struct*,int,char**,int,int)	call site: 00000	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:349

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

106

Reachable functions

132

Percentage of reachable functions covered

19.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/cjpeg.cc	1
libjpeg-turbo.3.0.x/fuzz/../cjpeg.c	4
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	7
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/cdjpeg.c	5
libjpeg-turbo.3.0.x/rdswitch.c	9
libjpeg-turbo.3.0.x/jdatadst.c	2
libjpeg-turbo.3.0.x/jcapistd.c	4
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1
libjpeg-turbo.3.0.x/jcicc.c	1

Fuzzer: cjpeg_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	318	80.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	10	2.53%
lawngreen	50+	67	16.9%
All colors	395	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	374	725	parse_switches(jpeg_compress_struct*,int,char**,int,int)	call site: 00000	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:379
0	0	None	2	2	select_file_type(jpeg_compress_struct*,_IO_FILE*)	call site: 00000	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:97
0	0	None	0	40	jpeg_set_defaults	call site: 00016	/src/libjpeg-turbo.3.0.x/jcparam.c:189
0	0	None	0	36	std_huff_tables	call site: 00023	/src/libjpeg-turbo.3.0.x/jstdhuff.c:128
0	0	None	0	32	jpeg_CreateCompress	call site: 00006	/src/libjpeg-turbo.3.0.x/jcapimin.c:41
0	0	None	0	32	jpeg_CreateCompress	call site: 00006	/src/libjpeg-turbo.3.0.x/jcapimin.c:43
0	0	None	0	5	jpeg_default_colorspace	call site: 00030	/src/libjpeg-turbo.3.0.x/jcparam.c:304
0	0	None	0	2	jpeg_add_quant_table	call site: 00020	/src/libjpeg-turbo.3.0.x/jcparam.c:44
0	0	None	0	2	jpeg_add_quant_table	call site: 00020	/src/libjpeg-turbo.3.0.x/jcparam.c:47
0	0	None	0	0	keymatch	call site: 00038	/src/libjpeg-turbo.3.0.x/cdjpeg.c:103
0	0	None	0	0	keymatch	call site: 00040	/src/libjpeg-turbo.3.0.x/cdjpeg.c:112
0	0	None	0	0	select_file_type(jpeg_compress_struct*,_IO_FILE*)	call site: 00000	/src/libjpeg-turbo.3.0.x/fuzz/../cjpeg.c:99

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

106

Reachable functions

132

Percentage of reachable functions covered

19.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/cjpeg.cc	1
libjpeg-turbo.main/fuzz/..cjpeg.c	4
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.maincdjpeg.c	5
libjpeg-turbo.mainrdswitch.c	9
libjpeg-turbo.mainjdatadst.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	4
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	159	54.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	133	45.5%
All colors	292	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
71	71	3 : View List ['j16init_downsampler', 'j16init_color_converter', 'j16init_c_prep_controller']	218	240	jinit_compress_master	call site: 00184	/src/libjpeg-turbo.3.0.x/jcinit.c:43
71	71	3 : View List ['j12init_color_converter', 'j12init_downsampler', 'j12init_c_prep_controller']	218	240	jinit_compress_master	call site: 00204	/src/libjpeg-turbo.3.0.x/jcinit.c:52
57	57	1 : View List ['validate_script']	76	106	jinit_c_master_control	call site: 00184	/src/libjpeg-turbo.3.0.x/jcmaster.c:723
53	53	1 : View List ['jsimd_can_rgb_gray']	53	53	jinit_color_converter	call site: 00209	/src/libjpeg-turbo.3.0.x/jccolor.c:617
28	28	1 : View List ['do_sarray_io']	30	30	access_virt_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:940
27	88	3 : View List ['jpeg_set_quality', 'jpeg_set_colorspace', 'jpeg_simple_progression']	27	88	setCompDefaults	call site: 00129	/src/libjpeg-turbo.3.0.x/turbojpeg.c:344
20	20	1 : View List ['emit_dac']	20	44	write_scan_header	call site: 00000	/src/libjpeg-turbo.3.0.x/jcmarker.c:569
9	9	1 : View List ['j16init_c_diff_controller']	21	29	jinit_compress_master	call site: 00244	/src/libjpeg-turbo.3.0.x/jcinit.c:81
9	9	1 : View List ['j12init_c_diff_controller']	21	29	jinit_compress_master	call site: 00245	/src/libjpeg-turbo.3.0.x/jcinit.c:84
8	8	1 : View List ['j12init_c_coef_controller']	20	28	jinit_compress_master	call site: 00272	/src/libjpeg-turbo.3.0.x/jcinit.c:120
8	8	2 : View List ['__errno_location', 'strerror']	10	25	tj3LoadImage8	call site: 00093	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:327
6	6	1 : View List ['j12init_c_main_controller']	6	8	jinit_compress_master	call site: 00277	/src/libjpeg-turbo.3.0.x/jcinit.c:134

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

64

Reachable functions

118

Percentage of reachable functions covered

45.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress_lossless.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress_yuv_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	112	31.9%
gold	[1:9]	21	5.98%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	218	62.1%
All colors	351	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
36	36	7 : View List ['jinit_c_diff_controller', 'jinit_lhuff_encoder', 'jinit_lossless_compressor', 'j16init_c_diff_controller', 'j16init_lossless_compressor', 'j12init_lossless_compressor', 'j12init_c_diff_controller']	48	56	jinit_compress_master	call site: 00296	/src/libjpeg-turbo.3.0.x/jcinit.c:64
16	16	1 : View List ['do_barray_io']	16	18	access_virt_barray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1024
8	8	1 : View List ['j12init_c_coef_controller']	20	28	jinit_compress_master	call site: 00328	/src/libjpeg-turbo.3.0.x/jcinit.c:120
8	8	2 : View List ['__errno_location', 'strerror']	10	25	tj3LoadImage8	call site: 00097	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:327
8	8	1 : View List ['fill_scans']	8	20	jpeg_simple_progression	call site: 00182	/src/libjpeg-turbo.3.0.x/jcparam.c:523
7	7	1 : View List ['jpeg_enable_lossless']	7	7	setCompDefaults	call site: 00150	/src/libjpeg-turbo.3.0.x/turbojpeg.c:344
6	6	1 : View List ['j16init_c_main_controller']	6	8	jinit_compress_master	call site: 00332	/src/libjpeg-turbo.3.0.x/jcinit.c:128
6	6	1 : View List ['j12init_c_main_controller']	6	8	jinit_compress_master	call site: 00333	/src/libjpeg-turbo.3.0.x/jcinit.c:134
3	3	1 : View List ['j12init_forward_dct']	23	48	jinit_compress_master	call site: 00309	/src/libjpeg-turbo.3.0.x/jcinit.c:97
2	4	2 : View List ['out_of_memory', 'jpeg_get_small']	2	4	alloc_small	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:318
2	2	1 : View List ['out_of_memory']	2	109	alloc_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:461

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

51

Reachable functions

126

Percentage of reachable functions covered

59.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress_yuv.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	18
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	1
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	3
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress12_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	40.4%
gold	[1:9]	23	7.82%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	1.70%
lawngreen	50+	147	50.0%
All colors	294	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
189	189	3 : View List ['jinit_c_prep_controller', 'jinit_downsampler', 'jinit_color_converter']	330	358	jinit_compress_master	call site: 00206	/src/libjpeg-turbo.3.0.x/jcinit.c:52
71	71	3 : View List ['j16init_downsampler', 'j16init_color_converter', 'j16init_c_prep_controller']	212	240	jinit_compress_master	call site: 00186	/src/libjpeg-turbo.3.0.x/jcinit.c:43
36	36	7 : View List ['jinit_c_diff_controller', 'jinit_lhuff_encoder', 'jinit_lossless_compressor', 'j16init_c_diff_controller', 'j16init_lossless_compressor', 'j12init_lossless_compressor', 'j12init_c_diff_controller']	48	56	jinit_compress_master	call site: 00242	/src/libjpeg-turbo.3.0.x/jcinit.c:64
16	16	1 : View List ['do_barray_io']	16	18	access_virt_barray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1024
8	8	2 : View List ['__errno_location', 'strerror']	10	25	tj3LoadImage12	call site: 00096	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:327
8	8	1 : View List ['fill_scans']	8	20	jpeg_simple_progression	call site: 00163	/src/libjpeg-turbo.3.0.x/jcparam.c:523
7	7	1 : View List ['jpeg_enable_lossless']	7	7	setCompDefaults	call site: 00131	/src/libjpeg-turbo.3.0.x/turbojpeg.c:344
6	6	1 : View List ['j16init_c_main_controller']	6	8	jinit_compress_master	call site: 00278	/src/libjpeg-turbo.3.0.x/jcinit.c:128
4	4	1 : View List ['create_context_buffer']	4	4	j12init_c_prep_controller	call site: 00210	/src/libjpeg-turbo.3.0.x/jcprepct.c:343
2	4	2 : View List ['out_of_memory', 'jpeg_get_small']	2	4	alloc_small	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:318
2	2	1 : View List ['out_of_memory']	2	109	alloc_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:461

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

58

Reachable functions

118

Percentage of reachable functions covered

50.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress12.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress12_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	138	44.3%
gold	[1:9]	21	6.75%
yellow	[10:29]	2	0.64%
greenyellow	[30:49]	4	1.28%
lawngreen	50+	146	46.9%
All colors	311	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
71	71	3 : View List ['j16init_downsampler', 'j16init_color_converter', 'j16init_c_prep_controller']	212	240	jinit_compress_master	call site: 00186	/src/libjpeg-turbo.3.0.x/jcinit.c:43
36	36	7 : View List ['jinit_c_diff_controller', 'jinit_lhuff_encoder', 'jinit_lossless_compressor', 'j16init_c_diff_controller', 'j16init_lossless_compressor', 'j12init_lossless_compressor', 'j12init_c_diff_controller']	48	56	jinit_compress_master	call site: 00242	/src/libjpeg-turbo.3.0.x/jcinit.c:64
8	8	1 : View List ['fill_scans']	8	20	jpeg_simple_progression	call site: 00164	/src/libjpeg-turbo.3.0.x/jcparam.c:523
2	2	1 : View List ['fill_scans']	2	2	fill_dc_scans	call site: 00165	/src/libjpeg-turbo.3.0.x/jcparam.c:454
0	7	1 : View List ['jpeg_default_colorspace']	8	55	jpeg_simple_progression	call site: 00163	/src/libjpeg-turbo.3.0.x/jcparam.c:488
0	0	1 : View List ['emit_restart.1496']	458	473	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:709
0	0	None	24	24	start_pass_fdctmgr	call site: 00000	/src/libjpeg-turbo.3.0.x/jcdctmgr.c:248
0	0	None	8	55	jpeg_simple_progression	call site: 00163	/src/libjpeg-turbo.3.0.x/jcparam.c:484
0	0	None	8	48	jpeg_simple_progression	call site: 00164	/src/libjpeg-turbo.3.0.x/jcparam.c:495
0	0	None	0	543	jpeg_start_compress	call site: 00183	/src/libjpeg-turbo.3.0.x/jcapistd.c:46
0	0	None	0	494	encode_mcu	call site: 00000	/src/libjpeg-turbo.3.0.x/jcarith.c:753

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

61

Reachable functions

121

Percentage of reachable functions covered

49.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress12.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	35.9%
gold	[1:9]	21	7.11%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.67%
lawngreen	50+	166	56.2%
All colors	295	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
71	71	3 : View List ['j16init_downsampler', 'j16init_color_converter', 'j16init_c_prep_controller']	130	240	jinit_compress_master	call site: 00187	/src/libjpeg-turbo.3.0.x/jcinit.c:43
71	71	3 : View List ['j12init_color_converter', 'j12init_downsampler', 'j12init_c_prep_controller']	130	240	jinit_compress_master	call site: 00207	/src/libjpeg-turbo.3.0.x/jcinit.c:52
36	36	7 : View List ['jinit_c_diff_controller', 'jinit_lhuff_encoder', 'jinit_lossless_compressor', 'j16init_c_diff_controller', 'j16init_lossless_compressor', 'j12init_lossless_compressor', 'j12init_c_diff_controller']	48	56	jinit_compress_master	call site: 00243	/src/libjpeg-turbo.3.0.x/jcinit.c:64
16	16	1 : View List ['do_barray_io']	16	18	access_virt_barray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1024
8	8	1 : View List ['j12init_c_coef_controller']	20	28	jinit_compress_master	call site: 00275	/src/libjpeg-turbo.3.0.x/jcinit.c:120
8	8	2 : View List ['__errno_location', 'strerror']	10	25	tj3LoadImage8	call site: 00097	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:327
8	8	1 : View List ['fill_scans']	8	20	jpeg_simple_progression	call site: 00164	/src/libjpeg-turbo.3.0.x/jcparam.c:523
7	7	1 : View List ['jpeg_enable_lossless']	7	7	setCompDefaults	call site: 00132	/src/libjpeg-turbo.3.0.x/turbojpeg.c:344
6	6	1 : View List ['j16init_c_main_controller']	6	8	jinit_compress_master	call site: 00279	/src/libjpeg-turbo.3.0.x/jcinit.c:128
6	6	1 : View List ['j12init_c_main_controller']	6	8	jinit_compress_master	call site: 00280	/src/libjpeg-turbo.3.0.x/jcinit.c:134
3	3	1 : View List ['j12init_forward_dct']	23	48	jinit_compress_master	call site: 00256	/src/libjpeg-turbo.3.0.x/jcinit.c:97

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

50

Reachable functions

118

Percentage of reachable functions covered

57.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress_yuv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	130	35.3%
gold	[1:9]	21	5.70%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	217	58.9%
All colors	368	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
36	36	7 : View List ['jinit_c_diff_controller', 'jinit_lhuff_encoder', 'jinit_lossless_compressor', 'j16init_c_diff_controller', 'j16init_lossless_compressor', 'j12init_lossless_compressor', 'j12init_c_diff_controller']	48	56	jinit_compress_master	call site: 00296	/src/libjpeg-turbo.3.0.x/jcinit.c:64
8	8	1 : View List ['j12init_c_coef_controller']	20	28	jinit_compress_master	call site: 00328	/src/libjpeg-turbo.3.0.x/jcinit.c:120
8	8	1 : View List ['fill_scans']	8	20	jpeg_simple_progression	call site: 00183	/src/libjpeg-turbo.3.0.x/jcparam.c:523
6	12	2 : View List ['jinit_c_main_controller', 'j12init_c_main_controller']	6	14	jinit_compress_master	call site: 00332	/src/libjpeg-turbo.3.0.x/jcinit.c:128
2	2	1 : View List ['jsimd_h2v2_downsample_sse2']	2	2	jsimd_h2v2_downsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:348
2	2	1 : View List ['jsimd_h2v1_downsample_sse2']	2	2	jsimd_h2v1_downsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:367
2	2	1 : View List ['jsimd_convsamp_sse2']	2	2	jsimd_convsamp	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:718
2	2	1 : View List ['jsimd_fdct_islow_sse2']	2	2	jsimd_fdct_islow	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:790
2	2	1 : View List ['jsimd_quantize_sse2']	2	2	jsimd_quantize	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:854
2	2	1 : View List ['fill_scans']	2	2	fill_dc_scans	call site: 00184	/src/libjpeg-turbo.3.0.x/jcparam.c:454
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v2_downsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:345

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

54

Reachable functions

129

Percentage of reachable functions covered

58.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress_yuv.cc	1
libjpeg-turbo.mainturbojpeg.c	18
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	1
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	3
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress16_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	152	52.0%
gold	[1:9]	2	0.68%
yellow	[10:29]	4	1.36%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	134	45.8%
All colors	292	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
57	57	1 : View List ['validate_script']	76	106	jinit_c_master_control	call site: 00184	/src/libjpeg-turbo.3.0.x/jcmaster.c:723
28	28	1 : View List ['do_sarray_io']	30	30	access_virt_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:940
27	88	3 : View List ['jpeg_set_quality', 'jpeg_set_colorspace', 'jpeg_simple_progression']	27	88	setCompDefaults	call site: 00129	/src/libjpeg-turbo.3.0.x/turbojpeg.c:344
20	20	1 : View List ['emit_dac']	20	44	write_scan_header	call site: 00000	/src/libjpeg-turbo.3.0.x/jcmarker.c:569
18	18	2 : View List ['jinit_c_diff_controller', 'j12init_c_diff_controller']	30	38	jinit_compress_master	call site: 00244	/src/libjpeg-turbo.3.0.x/jcinit.c:81
8	8	1 : View List ['j12init_c_coef_controller']	20	28	jinit_compress_master	call site: 00272	/src/libjpeg-turbo.3.0.x/jcinit.c:120
8	8	2 : View List ['__errno_location', 'strerror']	10	25	tj3LoadImage16	call site: 00093	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:327
6	6	1 : View List ['j12init_c_main_controller']	6	8	jinit_compress_master	call site: 00277	/src/libjpeg-turbo.3.0.x/jcinit.c:134
4	4	2 : View List ['jinit_lossless_compressor', 'j12init_lossless_compressor']	34	54	jinit_compress_master	call site: 00240	/src/libjpeg-turbo.3.0.x/jcinit.c:67
3	3	1 : View List ['j12init_forward_dct']	40	48	jinit_compress_master	call site: 00253	/src/libjpeg-turbo.3.0.x/jcinit.c:97
3	3	1 : View List ['jinit_arith_encoder']	31	39	jinit_compress_master	call site: 00255	/src/libjpeg-turbo.3.0.x/jcinit.c:102
3	3	1 : View List ['jinit_phuff_encoder']	31	39	jinit_compress_master	call site: 00270	/src/libjpeg-turbo.3.0.x/jcinit.c:109

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

64

Reachable functions

118

Percentage of reachable functions covered

45.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress16_lossless.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: transform_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	37.6%
gold	[1:9]	1	0.31%
yellow	[10:29]	1	0.31%
greenyellow	[30:49]	1	0.31%
lawngreen	50+	196	61.4%
All colors	319	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
50	50	3 : View List ['do_crop_ext_zero', 'do_crop_ext_flat', 'do_crop_ext_reflect']	50	50	jtransform_execute_transform	call site: 00268	/src/libjpeg-turbo.3.0.x/transupp.c:2173
8	8	1 : View List ['jtransform_perfect_transform']	20	40	jtransform_request_workspace	call site: 00139	/src/libjpeg-turbo.3.0.x/transupp.c:1527
0	7	1 : View List ['jpeg_default_colorspace']	0	55	jpeg_simple_progression	call site: 00202	/src/libjpeg-turbo.3.0.x/jcparam.c:488
0	0	1 : View List ['emit_restart.1496']	458	473	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:709
0	0	None	12	32	jtransform_request_workspace	call site: 00141	/src/libjpeg-turbo.3.0.x/transupp.c:1587
0	0	None	12	32	jtransform_request_workspace	call site: 00141	/src/libjpeg-turbo.3.0.x/transupp.c:1589
0	0	None	12	32	jtransform_request_workspace	call site: 00141	/src/libjpeg-turbo.3.0.x/transupp.c:1591
0	0	None	12	32	jtransform_request_workspace	call site: 00141	/src/libjpeg-turbo.3.0.x/transupp.c:1597
0	0	None	12	32	jtransform_request_workspace	call site: 00141	/src/libjpeg-turbo.3.0.x/transupp.c:1610
0	0	None	12	32	jtransform_request_workspace	call site: 00141	/src/libjpeg-turbo.3.0.x/transupp.c:1616
0	0	None	12	32	jtransform_request_workspace	call site: 00141	/src/libjpeg-turbo.3.0.x/transupp.c:1630

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

33

Reachable functions

123

Percentage of reachable functions covered

73.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/transform.cc	1
libjpeg-turbo.mainturbojpeg.c	15
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	8
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.maintransupp.c	30
libjpeg-turbo.mainwrapper/../jutils.c	4
libjpeg-turbo.mainjdtrans.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainjctrans.c	4
libjpeg-turbo.mainjcparam.c	11
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress12_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	138	44.3%
gold	[1:9]	23	7.39%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	1.28%
lawngreen	50+	146	46.9%
All colors	311	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
71	71	3 : View List ['j16init_downsampler', 'j16init_color_converter', 'j16init_c_prep_controller']	212	240	jinit_compress_master	call site: 00186	/src/libjpeg-turbo.3.0.x/jcinit.c:43
36	36	7 : View List ['jinit_c_diff_controller', 'jinit_lhuff_encoder', 'jinit_lossless_compressor', 'j16init_c_diff_controller', 'j16init_lossless_compressor', 'j12init_lossless_compressor', 'j12init_c_diff_controller']	48	56	jinit_compress_master	call site: 00242	/src/libjpeg-turbo.3.0.x/jcinit.c:64
8	8	1 : View List ['fill_scans']	8	20	jpeg_simple_progression	call site: 00164	/src/libjpeg-turbo.3.0.x/jcparam.c:523
2	2	1 : View List ['fill_scans']	2	2	fill_dc_scans	call site: 00165	/src/libjpeg-turbo.3.0.x/jcparam.c:454
0	7	1 : View List ['jpeg_default_colorspace']	8	55	jpeg_simple_progression	call site: 00163	/src/libjpeg-turbo.3.0.x/jcparam.c:488
0	0	1 : View List ['emit_restart.1496']	458	473	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:709
0	0	None	24	24	start_pass_fdctmgr	call site: 00000	/src/libjpeg-turbo.3.0.x/jcdctmgr.c:248
0	0	None	8	55	jpeg_simple_progression	call site: 00163	/src/libjpeg-turbo.3.0.x/jcparam.c:484
0	0	None	8	48	jpeg_simple_progression	call site: 00164	/src/libjpeg-turbo.3.0.x/jcparam.c:495
0	0	None	0	543	jpeg_start_compress	call site: 00183	/src/libjpeg-turbo.3.0.x/jcapistd.c:46
0	0	None	0	494	encode_mcu	call site: 00000	/src/libjpeg-turbo.3.0.x/jcarith.c:753

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

61

Reachable functions

121

Percentage of reachable functions covered

49.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress12.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: libjpeg_turbo_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	40.1%
gold	[1:9]	21	6.68%
yellow	[10:29]	3	0.95%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	164	52.2%
All colors	314	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
114	114	4 : View List ['jinit_1pass_quantizer', 'j12init_2pass_quantizer', 'j12init_1pass_quantizer', 'jinit_2pass_quantizer']	114	656	master_selection	call site: 00171	/src/libjpeg-turbo.3.0.x/jdmaster.c:555
2	24	3 : View List ['_setjmp', 'jpeg16_read_scanlines', 'jpeg_finish_decompress']	2	31	tj3Decompress16	call site: 00306	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:223
2	2	1 : View List ['jsimd_h2v2_upsample_sse2']	2	2	jsimd_h2v2_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:424
2	2	1 : View List ['jsimd_h2v1_upsample_sse2']	2	2	jsimd_h2v1_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:439
2	2	1 : View List ['jsimd_h2v2_fancy_upsample_sse2']	2	2	jsimd_h2v2_fancy_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:496
2	2	1 : View List ['jsimd_h2v1_fancy_upsample_sse2']	2	2	jsimd_h2v1_fancy_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:513
2	2	1 : View List ['jsimd_idct_islow_sse2']	2	2	jsimd_idct_islow	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:1011
0	72	1 : View List ['jinit_merged_upsampler']	0	202	master_selection	call site: 00184	/src/libjpeg-turbo.3.0.x/jdmaster.c:612
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v2_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:421
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v1_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:436
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v2_fancy_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:493
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v1_fancy_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:510

Runtime coverage analysis

Covered functions

240

Functions that are reachable but not covered

31

Reachable functions

124

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/decompress.cc	1
libjpeg-turbo.mainturbojpeg.c	12
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	2
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	3
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.mainturbojpeg-mp.c	3
libjpeg-turbo.mainwrapper/../jdapistd.c	11
libjpeg-turbo.mainjdmaster.c	6
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jquant1.c	8
libjpeg-turbo.mainwrapper/../jquant2.c	3
libjpeg-turbo.mainwrapper/../jdmerge.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	9
libjpeg-turbo.mainwrapper/../jdcolor.c	5
libjpeg-turbo.mainwrapper/../jdsample.c	3
libjpeg-turbo.mainwrapper/../jdpostct.c	3
libjpeg-turbo.mainwrapper/../jdlossls.c	3
libjpeg-turbo.mainjdlhuff.c	1
libjpeg-turbo.mainwrapper/../jddiffct.c	3
libjpeg-turbo.mainwrapper/../jddctmgr.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainwrapper/../jdmainct.c	4
libjpeg-turbo.mainwrapper/../jdmainct.h	1
libjpeg-turbo.mainwrapper/../jdcoefct.h	1

Fuzzer: compress16_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	177	57.0%
gold	[1:9]	2	0.64%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.64%
lawngreen	50+	129	41.6%
All colors	310	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
20	20	1 : View List ['emit_dac']	20	44	write_scan_header	call site: 00000	/src/libjpeg-turbo.3.0.x/jcmarker.c:569
9	9	1 : View List ['j12init_c_diff_controller']	21	29	jinit_compress_master	call site: 00246	/src/libjpeg-turbo.3.0.x/jcinit.c:84
8	8	1 : View List ['j12init_c_coef_controller']	20	28	jinit_compress_master	call site: 00273	/src/libjpeg-turbo.3.0.x/jcinit.c:120
3	3	1 : View List ['jinit_arith_encoder']	31	39	jinit_compress_master	call site: 00270	/src/libjpeg-turbo.3.0.x/jcinit.c:102
3	3	1 : View List ['jinit_phuff_encoder']	31	39	jinit_compress_master	call site: 00271	/src/libjpeg-turbo.3.0.x/jcinit.c:109
2	2	1 : View List ['j12init_lossless_compressor']	32	52	jinit_compress_master	call site: 00242	/src/libjpeg-turbo.3.0.x/jcinit.c:69
0	71	3 : View List ['j16init_downsampler', 'j16init_color_converter', 'j16init_c_prep_controller']	147	240	jinit_compress_master	call site: 00185	/src/libjpeg-turbo.3.0.x/jcinit.c:43
0	9	1 : View List ['j16init_c_diff_controller']	12	29	jinit_compress_master	call site: 00245	/src/libjpeg-turbo.3.0.x/jcinit.c:81
0	2	1 : View List ['j16init_lossless_compressor']	30	52	jinit_compress_master	call site: 00241	/src/libjpeg-turbo.3.0.x/jcinit.c:67
0	0	None	30	47	jinit_compress_master	call site: 00244	/src/libjpeg-turbo.3.0.x/jcinit.c:74
0	0	None	0	543	jpeg_start_compress	call site: 00182	/src/libjpeg-turbo.3.0.x/jcapistd.c:46
0	0	None	0	78	write_frame_header	call site: 00000	/src/libjpeg-turbo.3.0.x/jcmarker.c:506

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

67

Reachable functions

121

Percentage of reachable functions covered

44.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress16_lossless.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	39.4%
gold	[1:9]	21	6.73%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	168	53.8%
All colors	312	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
71	260	6 : View List ['j12init_downsampler', 'j12init_c_prep_controller', 'jinit_c_prep_controller', 'jinit_downsampler', 'jinit_color_converter', 'j12init_color_converter']	130	429	jinit_compress_master	call site: 00187	/src/libjpeg-turbo.3.0.x/jcinit.c:43
36	36	7 : View List ['jinit_c_diff_controller', 'jinit_lhuff_encoder', 'jinit_lossless_compressor', 'j16init_c_diff_controller', 'j16init_lossless_compressor', 'j12init_lossless_compressor', 'j12init_c_diff_controller']	48	56	jinit_compress_master	call site: 00243	/src/libjpeg-turbo.3.0.x/jcinit.c:64
8	8	1 : View List ['j12init_c_coef_controller']	20	28	jinit_compress_master	call site: 00275	/src/libjpeg-turbo.3.0.x/jcinit.c:120
8	8	1 : View List ['fill_scans']	8	20	jpeg_simple_progression	call site: 00165	/src/libjpeg-turbo.3.0.x/jcparam.c:523
2	2	1 : View List ['jsimd_h2v2_downsample_sse2']	2	2	jsimd_h2v2_downsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:348
2	2	1 : View List ['jsimd_h2v1_downsample_sse2']	2	2	jsimd_h2v1_downsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:367
2	2	1 : View List ['jsimd_convsamp_sse2']	2	2	jsimd_convsamp	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:718
2	2	1 : View List ['jsimd_fdct_islow_sse2']	2	2	jsimd_fdct_islow	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:790
2	2	1 : View List ['jsimd_quantize_sse2']	2	2	jsimd_quantize	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:854
2	2	1 : View List ['fill_scans']	2	2	fill_dc_scans	call site: 00166	/src/libjpeg-turbo.3.0.x/jcparam.c:454
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v2_downsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:345

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

53

Reachable functions

121

Percentage of reachable functions covered

56.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: decompress_yuv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	31.4%
gold	[1:9]	21	6.28%
yellow	[10:29]	1	0.29%
greenyellow	[30:49]	3	0.89%
lawngreen	50+	204	61.0%
All colors	334	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
114	114	4 : View List ['jinit_1pass_quantizer', 'j12init_2pass_quantizer', 'j12init_1pass_quantizer', 'jinit_2pass_quantizer']	125	656	master_selection	call site: 00195	/src/libjpeg-turbo.3.0.x/jdmaster.c:555
11	83	2 : View List ['jinit_merged_upsampler', 'j12init_merged_upsampler']	11	213	master_selection	call site: 00207	/src/libjpeg-turbo.3.0.x/jdmaster.c:610
2	2	1 : View List ['jsimd_h2v2_upsample_sse2']	2	2	jsimd_h2v2_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:424
2	2	1 : View List ['jsimd_h2v1_upsample_sse2']	2	2	jsimd_h2v1_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:439
2	2	1 : View List ['jsimd_idct_islow_sse2']	2	2	jsimd_idct_islow	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:1011
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v2_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:421
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v1_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:436
0	47	1 : View List ['init_simd']	4	51	jsimd_idct_islow	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:1008
0	47	1 : View List ['init_simd']	0	47	jsimd_ycc_rgb_convert	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:252
0	47	1 : View List ['init_simd']	0	47	jsimd_h2v2_merged_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:572
0	47	1 : View List ['init_simd']	0	47	jsimd_h2v1_merged_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:623
0	2	1 : View List ['jcopy_sample_rows']	0	2	merged_2v_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/jdmerge.c:232

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

29

Reachable functions

120

Percentage of reachable functions covered

75.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/decompress_yuv.cc	1
libjpeg-turbo.mainturbojpeg.c	19
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	2
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.mainjdmaster.c	6
libjpeg-turbo.mainwrapper/../jutils.c	3
libjpeg-turbo.mainwrapper/../jdapistd.c	3
libjpeg-turbo.mainwrapper/../jquant1.c	8
libjpeg-turbo.mainwrapper/../jquant2.c	3
libjpeg-turbo.mainwrapper/../jdmerge.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	9
libjpeg-turbo.mainwrapper/../jdcolor.c	5
libjpeg-turbo.mainwrapper/../jdsample.c	3
libjpeg-turbo.mainwrapper/../jdpostct.c	3
libjpeg-turbo.mainwrapper/../jdlossls.c	3
libjpeg-turbo.mainjdlhuff.c	1
libjpeg-turbo.mainwrapper/../jddiffct.c	3
libjpeg-turbo.mainwrapper/../jddctmgr.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainwrapper/../jdmainct.c	4

Fuzzer: compress12_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	40.4%
gold	[1:9]	23	7.82%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	1.70%
lawngreen	50+	147	50.0%
All colors	294	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
189	189	3 : View List ['jinit_c_prep_controller', 'jinit_downsampler', 'jinit_color_converter']	330	358	jinit_compress_master	call site: 00206	/src/libjpeg-turbo.3.0.x/jcinit.c:52
71	71	3 : View List ['j16init_downsampler', 'j16init_color_converter', 'j16init_c_prep_controller']	212	240	jinit_compress_master	call site: 00186	/src/libjpeg-turbo.3.0.x/jcinit.c:43
36	36	7 : View List ['jinit_c_diff_controller', 'jinit_lhuff_encoder', 'jinit_lossless_compressor', 'j16init_c_diff_controller', 'j16init_lossless_compressor', 'j12init_lossless_compressor', 'j12init_c_diff_controller']	48	56	jinit_compress_master	call site: 00242	/src/libjpeg-turbo.3.0.x/jcinit.c:64
16	16	1 : View List ['do_barray_io']	16	18	access_virt_barray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1024
8	8	2 : View List ['__errno_location', 'strerror']	10	25	tj3LoadImage12	call site: 00096	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:327
8	8	1 : View List ['fill_scans']	8	20	jpeg_simple_progression	call site: 00163	/src/libjpeg-turbo.3.0.x/jcparam.c:523
7	7	1 : View List ['jpeg_enable_lossless']	7	7	setCompDefaults	call site: 00131	/src/libjpeg-turbo.3.0.x/turbojpeg.c:344
6	6	1 : View List ['j16init_c_main_controller']	6	8	jinit_compress_master	call site: 00278	/src/libjpeg-turbo.3.0.x/jcinit.c:128
4	4	1 : View List ['create_context_buffer']	4	4	j12init_c_prep_controller	call site: 00210	/src/libjpeg-turbo.3.0.x/jcprepct.c:343
2	4	2 : View List ['out_of_memory', 'jpeg_get_small']	2	4	alloc_small	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:318
2	2	1 : View List ['out_of_memory']	2	109	alloc_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:461

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

58

Reachable functions

118

Percentage of reachable functions covered

50.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress12.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: libjpeg_turbo_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	40.7%
gold	[1:9]	22	7.11%
yellow	[10:29]	4	1.29%
greenyellow	[30:49]	2	0.64%
lawngreen	50+	155	50.1%
All colors	309	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
122	122	1 : View List ['jpeg_crop_scanline']	248	284	tj3Decompress8	call site: 00125	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:199
114	114	4 : View List ['jinit_1pass_quantizer', 'j12init_2pass_quantizer', 'j12init_1pass_quantizer', 'jinit_2pass_quantizer']	114	656	master_selection	call site: 00166	/src/libjpeg-turbo.3.0.x/jdmaster.c:555
51	51	1 : View List ['jpeg12_crop_scanline']	177	213	tj3Decompress12	call site: 00294	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:199
28	28	1 : View List ['do_sarray_io']	28	30	access_virt_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:940
16	16	1 : View List ['do_barray_io']	16	18	access_virt_barray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1024
2	4	2 : View List ['out_of_memory', 'jpeg_get_small']	2	4	alloc_small	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:318
2	2	1 : View List ['out_of_memory']	2	109	alloc_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:461
2	2	1 : View List ['out_of_memory']	2	2	alloc_large	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:394
2	2	1 : View List ['jsimd_h2v2_upsample_sse2']	2	2	jsimd_h2v2_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:424
2	2	1 : View List ['jsimd_h2v1_upsample_sse2']	2	2	jsimd_h2v1_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:439
2	2	1 : View List ['jsimd_h2v2_fancy_upsample_sse2']	2	2	jsimd_h2v2_fancy_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:496
2	2	1 : View List ['jsimd_h2v1_fancy_upsample_sse2']	2	2	jsimd_h2v1_fancy_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:513

Runtime coverage analysis

Covered functions

236

Functions that are reachable but not covered

31

Reachable functions

121

Percentage of reachable functions covered

74.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/decompress.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	12
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	2
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	3
libjpeg-turbo.3.0.x/turbojpeg-mp.c	3
libjpeg-turbo.3.0.x/jdapistd.c	11
libjpeg-turbo.3.0.x/jdmaster.c	6
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jquant1.c	8
libjpeg-turbo.3.0.x/jquant2.c	3
libjpeg-turbo.3.0.x/jdmerge.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	9
libjpeg-turbo.3.0.x/jdcolor.c	5
libjpeg-turbo.3.0.x/jdsample.c	3
libjpeg-turbo.3.0.x/jdpostct.c	3
libjpeg-turbo.3.0.x/jdlossls.c	3
libjpeg-turbo.3.0.x/jdlhuff.c	1
libjpeg-turbo.3.0.x/jddiffct.c	3
libjpeg-turbo.3.0.x/jddctmgr.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jdmainct.c	4
libjpeg-turbo.3.0.x/jdmainct.h	1
libjpeg-turbo.3.0.x/jdcoefct.h	1

Fuzzer: decompress_yuv_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	32.2%
gold	[1:9]	21	6.38%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.30%
lawngreen	50+	201	61.0%
All colors	329	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
114	114	4 : View List ['jinit_1pass_quantizer', 'j12init_2pass_quantizer', 'j12init_1pass_quantizer', 'jinit_2pass_quantizer']	125	656	master_selection	call site: 00190	/src/libjpeg-turbo.3.0.x/jdmaster.c:555
28	28	1 : View List ['do_sarray_io']	28	30	access_virt_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:940
16	16	1 : View List ['do_barray_io']	16	18	access_virt_barray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1024
11	11	1 : View List ['j12init_merged_upsampler']	11	141	master_selection	call site: 00202	/src/libjpeg-turbo.3.0.x/jdmaster.c:612
3	3	1 : View List ['alloc_funny_pointers']	3	3	j12init_d_main_controller	call site: 00286	/src/libjpeg-turbo.3.0.x/jdmainct.c:450
2	4	2 : View List ['out_of_memory', 'jpeg_get_small']	2	4	alloc_small	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:318
2	2	1 : View List ['out_of_memory']	2	109	alloc_sarray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:461
2	2	1 : View List ['out_of_memory']	2	2	alloc_large	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:394
2	2	1 : View List ['jsimd_h2v2_upsample_sse2']	2	2	jsimd_h2v2_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:424
2	2	1 : View List ['jsimd_h2v1_upsample_sse2']	2	2	jsimd_h2v1_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:439
2	2	1 : View List ['jsimd_idct_islow_sse2']	2	2	jsimd_idct_islow	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:1011
0	47	1 : View List ['init_simd']	4	51	jsimd_h2v2_upsample	call site: 00000	/src/libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c:421

Runtime coverage analysis

Covered functions

210

Functions that are reachable but not covered

29

Reachable functions

117

Percentage of reachable functions covered

75.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/decompress_yuv.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	19
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	2
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jdmaster.c	6
libjpeg-turbo.3.0.x/jutils.c	3
libjpeg-turbo.3.0.x/jdapistd.c	3
libjpeg-turbo.3.0.x/jquant1.c	8
libjpeg-turbo.3.0.x/jquant2.c	3
libjpeg-turbo.3.0.x/jdmerge.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	9
libjpeg-turbo.3.0.x/jdcolor.c	5
libjpeg-turbo.3.0.x/jdsample.c	3
libjpeg-turbo.3.0.x/jdpostct.c	3
libjpeg-turbo.3.0.x/jdlossls.c	3
libjpeg-turbo.3.0.x/jdlhuff.c	1
libjpeg-turbo.3.0.x/jddiffct.c	3
libjpeg-turbo.3.0.x/jddctmgr.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jdmainct.c	4

Fuzzer: compress_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	170	54.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	140	45.1%
All colors	310	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
71	260	6 : View List ['j12init_downsampler', 'j12init_c_prep_controller', 'jinit_c_prep_controller', 'jinit_downsampler', 'jinit_color_converter', 'j12init_color_converter']	218	429	jinit_compress_master	call site: 00185	/src/libjpeg-turbo.3.0.x/jcinit.c:43
20	20	1 : View List ['emit_dac']	20	44	write_scan_header	call site: 00000	/src/libjpeg-turbo.3.0.x/jcmarker.c:569
9	18	2 : View List ['jinit_c_diff_controller', 'j12init_c_diff_controller']	21	38	jinit_compress_master	call site: 00245	/src/libjpeg-turbo.3.0.x/jcinit.c:81
8	8	1 : View List ['j12init_c_coef_controller']	20	28	jinit_compress_master	call site: 00273	/src/libjpeg-turbo.3.0.x/jcinit.c:120
3	3	1 : View List ['jinit_arith_encoder']	31	39	jinit_compress_master	call site: 00270	/src/libjpeg-turbo.3.0.x/jcinit.c:102
3	3	1 : View List ['jinit_phuff_encoder']	31	39	jinit_compress_master	call site: 00271	/src/libjpeg-turbo.3.0.x/jcinit.c:109
2	4	2 : View List ['jinit_lossless_compressor', 'j12init_lossless_compressor']	32	54	jinit_compress_master	call site: 00241	/src/libjpeg-turbo.3.0.x/jcinit.c:67
0	0	None	30	47	jinit_compress_master	call site: 00244	/src/libjpeg-turbo.3.0.x/jcinit.c:74
0	0	None	0	599	tj3Compress8	call site: 00129	/src/libjpeg-turbo.3.0.x/turbojpeg-mp.c:109
0	0	None	0	543	jpeg_start_compress	call site: 00182	/src/libjpeg-turbo.3.0.x/jcapistd.c:46
0	0	None	0	78	write_frame_header	call site: 00000	/src/libjpeg-turbo.3.0.x/jcmarker.c:506
0	0	None	0	56	write_scan_header	call site: 00000	/src/libjpeg-turbo.3.0.x/jcmarker.c:586

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

67

Reachable functions

121

Percentage of reachable functions covered

44.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress_lossless.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: transform_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	102	35.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.69%
greenyellow	[30:49]	1	0.34%
lawngreen	50+	182	63.4%
All colors	287	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
458	458	1 : View List ['encode_one_block']	458	458	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:717
50	50	3 : View List ['do_crop_ext_zero', 'do_crop_ext_flat', 'do_crop_ext_reflect']	50	50	jtransform_execute_transform	call site: 00234	/src/libjpeg-turbo.3.0.x/transupp.c:2173
16	16	1 : View List ['do_barray_io']	16	18	access_virt_barray	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1024
8	8	1 : View List ['jtransform_perfect_transform']	20	40	jtransform_request_workspace	call site: 00120	/src/libjpeg-turbo.3.0.x/transupp.c:1527
2	4	2 : View List ['out_of_memory', 'jpeg_get_small']	2	4	alloc_small	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:318
2	2	1 : View List ['out_of_memory']	2	2	alloc_large	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:394
0	7	1 : View List ['jpeg_default_colorspace']	19	49	jinit_c_master_control	call site: 00208	/src/libjpeg-turbo.3.0.x/jcmaster.c:740
0	7	1 : View List ['jpeg_default_colorspace']	0	55	jpeg_simple_progression	call site: 00185	/src/libjpeg-turbo.3.0.x/jcparam.c:488
0	2	1 : View List ['jpeg_mem_term']	14	16	jinit_memory_mgr	call site: 00011	/src/libjpeg-turbo.3.0.x/jmemmgr.c:1227
0	2	1 : View List ['fill_scans']	0	2	fill_dc_scans	call site: 00187	/src/libjpeg-turbo.3.0.x/jcparam.c:454
0	0	1 : View List ['emit_restart.1496']	458	473	encode_mcu_huff	call site: 00000	/src/libjpeg-turbo.3.0.x/jchuff.c:709
0	0	None	56	97	realize_virt_arrays	call site: 00000	/src/libjpeg-turbo.3.0.x/jmemmgr.c:736

Runtime coverage analysis

Covered functions

209

Functions that are reachable but not covered

30

Reachable functions

115

Percentage of reachable functions covered

73.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/transform.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	12
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	6
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	3
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/transupp.c	30
libjpeg-turbo.3.0.x/jutils.c	4
libjpeg-turbo.3.0.x/jdtrans.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jctrans.c	4
libjpeg-turbo.3.0.x/jcparam.c	11
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jcmarker.c	1