High level conclusions

Fuzzers reach 45.54% of cyclomatic complexity.

Fuzzers reach 36.26% of all functions.

Fuzzer cjpeg_fuzzer_3_0_x is blocked:

The runtime code coverage of cjpeg_fuzzer_3_0_x covers 19.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer cjpeg_fuzzer_dev is blocked:

The runtime code coverage of cjpeg_fuzzer_dev covers 19.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer cjpeg_fuzzer is blocked:

The runtime code coverage of cjpeg_fuzzer covers 19.69% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

293 / 808

Cyclomatic complexity statically reachable by fuzzers

3393 / 7450

Runtime code coverage of functions

301 / 808

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: cjpeg_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	318	80.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	10	2.53%
lawngreen	50+	67	16.9%
All colors	395	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
136	252	select_file_type(jpeg_compress_struct*, _IO_FILE*)	call site: 00252	jpeg_start_compress
79	139	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00139	read_scan_script
36	42	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00042	fprintf
23	219	cjpeg_main	call site: 00219	fprintf
4	32	jpeg_default_colorspace	call site: 00032	jpeg_set_colorspace
4	83	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00083	fprintf
4	98	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00098	__isoc99_sscanf
4	110	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00110	__isoc99_sscanf
3	103	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00103	__isoc99_sscanf
2	29	jpeg_set_defaults	call site: 00029	jpeg_set_colorspace
2	88	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00088	fprintf
2	126	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00126

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

106

Reachable functions

132

Percentage of reachable functions covered

19.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/cjpeg.cc	1
libjpeg-turbo.main/fuzz/..cjpeg.c	4
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.maincdjpeg.c	5
libjpeg-turbo.mainrdswitch.c	9
libjpeg-turbo.mainjdatadst.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	4
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: cjpeg_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	313	80.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	10	2.56%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	67	17.1%
All colors	390	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
131	252	select_file_type(jpeg_compress_struct*, _IO_FILE*)	call site: 00252	jpeg_start_compress
79	139	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00139	read_scan_script
36	42	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00042	fprintf
23	219	cjpeg_main	call site: 00219	fprintf
4	32	jpeg_default_colorspace	call site: 00032	jpeg_set_colorspace
4	83	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00083	fprintf
4	98	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00098	__isoc99_sscanf
4	110	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00110	__isoc99_sscanf
3	103	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00103	__isoc99_sscanf
2	29	jpeg_set_defaults	call site: 00029	jpeg_set_colorspace
2	88	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00088	fprintf
2	126	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00126

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

106

Reachable functions

132

Percentage of reachable functions covered

19.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/cjpeg.cc	1
libjpeg-turbo.dev/fuzz/..cjpeg.c	4
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devcdjpeg.c	5
libjpeg-turbo.devrdswitch.c	9
libjpeg-turbo.devjdatadst.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	4
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: compress_lossless_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	166	54.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	139	45.5%
All colors	305	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	152	setCompDefaults	call site: 00152	jpeg_simple_progression
20	203	jinit_compress_master	call site: 00203	jsimd_set_rgb_gray
20	247	jinit_c_diff_controller	call site: 00247	jinit_forward_dct
17	276	jinit_compress_master	call site: 00276	jpeg_write_icc_profile
13	46	tj3Set	call site: 00046	snprintf
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	193	initial_setup	call site: 00193	using_std_huff_tables
7	38	tj3Set	call site: 00038	snprintf
7	69	tj3Set	call site: 00069	snprintf
7	229	jinit_compress_master	call site: 00229	j12init_color_converter
4	224	jinit_compress_master	call site: 00224	jsimd_set_h2v1_downsample
3	77	tj3Set	call site: 00077	snprintf

Runtime coverage analysis

Covered functions

164

Functions that are reachable but not covered

67

Reachable functions

121

Percentage of reachable functions covered

44.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress_lossless.cc	1
libjpeg-turbo.devturbojpeg.c	10
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: compress12_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	139	44.6%
gold	[1:9]	23	7.39%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	1.28%
lawngreen	50+	145	46.6%
All colors	311	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	239	jinit_compress_master	call site: 00239	jinit_forward_dct
17	282	jinit_compress_master	call site: 00282	jpeg_write_icc_profile
12	194	initial_setup	call site: 00194	jinit_color_converter
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	41	tj3Set	call site: 00041	snprintf
9	227	init_simd	call site: 00227	jinit_downsampler
8	59	tj3Set	call site: 00059	snprintf
7	69	tj3Set	call site: 00069	snprintf
6	175	jpeg_simple_progression	call site: 00175	fill_dc_scans
5	154	setCompDefaults	call site: 00154	jpeg_set_colorspace
3	77	tj3Set	call site: 00077	snprintf
3	97	tj3LoadImage12	call site: 00097	__errno_location

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

61

Reachable functions

121

Percentage of reachable functions covered

49.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress12.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress12_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	40.8%
gold	[1:9]	23	7.82%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	1.70%
lawngreen	50+	146	49.6%
All colors	294	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	234	init_simd	call site: 00234	jinit_downsampler
14	257	jinit_compress_master	call site: 00257	jsimd_can_fdct_islow
13	194	initial_setup	call site: 00194	j16init_color_converter
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
10	41	tj3Set	call site: 00041	snprintf
8	60	tj3Set	call site: 00060	snprintf
7	70	tj3Set	call site: 00070	snprintf
6	174	jpeg_simple_progression	call site: 00174	fill_dc_scans
5	153	setCompDefaults	call site: 00153	jpeg_set_colorspace
3	96	tj3LoadImage12	call site: 00096	__errno_location
3	149	jpeg_default_colorspace	call site: 00149	jpeg_enable_lossless
3	210	jinit_compress_master	call site: 00210	jinit_color_converter

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

58

Reachable functions

118

Percentage of reachable functions covered

50.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress12.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	124	39.7%
gold	[1:9]	21	6.73%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	167	53.5%
All colors	312	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	236	jinit_compress_master	call site: 00236	j12init_color_converter
17	283	jinit_compress_master	call site: 00283	jpeg_write_icc_profile
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	41	tj3Set	call site: 00041	snprintf
9	195	initial_setup	call site: 00195	using_std_huff_tables
8	59	tj3Set	call site: 00059	snprintf
7	69	tj3Set	call site: 00069	snprintf
6	176	jpeg_simple_progression	call site: 00176	fill_dc_scans
5	155	setCompDefaults	call site: 00155	jpeg_set_colorspace
5	267	jsimd_can_quantize	call site: 00267	jsimd_can_convsamp_float
3	77	tj3Set	call site: 00077	snprintf
3	98	tj3LoadImage8	call site: 00098	__errno_location

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

53

Reachable functions

121

Percentage of reachable functions covered

56.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress12_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	139	45.4%
gold	[1:9]	2	0.65%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	1.30%
lawngreen	50+	161	52.6%
All colors	306	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	234	jinit_compress_master	call site: 00234	jinit_forward_dct
17	277	jinit_compress_master	call site: 00277	jpeg_write_icc_profile
12	194	initial_setup	call site: 00194	jinit_color_converter
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	41	tj3Set	call site: 00041	snprintf
9	222	init_simd	call site: 00222	jinit_downsampler
8	59	tj3Set	call site: 00059	snprintf
7	69	tj3Set	call site: 00069	snprintf
6	175	jpeg_simple_progression	call site: 00175	fill_dc_scans
5	154	setCompDefaults	call site: 00154	jpeg_set_colorspace
3	77	tj3Set	call site: 00077	snprintf
3	97	tj3LoadImage12	call site: 00097	__errno_location

Runtime coverage analysis

Covered functions

188

Functions that are reachable but not covered

61

Reachable functions

121

Percentage of reachable functions covered

49.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress12.cc	1
libjpeg-turbo.devturbojpeg.c	10
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: cjpeg_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	319	80.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	10	2.52%
lawngreen	50+	67	16.9%
All colors	396	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
136	253	select_file_type(jpeg_compress_struct*, _IO_FILE*)	call site: 00253	jpeg_start_compress
80	139	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00139	read_scan_script
36	42	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00042	fprintf
23	220	cjpeg_main	call site: 00220	fprintf
4	32	jpeg_default_colorspace	call site: 00032	jpeg_set_colorspace
4	83	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00083	fprintf
4	98	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00098	__isoc99_sscanf
4	110	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00110	__isoc99_sscanf
3	103	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00103	__isoc99_sscanf
2	29	jpeg_set_defaults	call site: 00029	jpeg_set_colorspace
2	88	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00088	fprintf
2	126	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00126

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

106

Reachable functions

132

Percentage of reachable functions covered

19.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/cjpeg.cc	1
libjpeg-turbo.3.0.x/fuzz/../cjpeg.c	4
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	7
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/cdjpeg.c	5
libjpeg-turbo.3.0.x/rdswitch.c	9
libjpeg-turbo.3.0.x/jdatadst.c	2
libjpeg-turbo.3.0.x/jcapistd.c	4
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1
libjpeg-turbo.3.0.x/jcicc.c	1

Fuzzer: transform_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	37.9%
gold	[1:9]	1	0.31%
yellow	[10:29]	1	0.31%
greenyellow	[30:49]	1	0.31%
lawngreen	50+	195	61.1%
All colors	319	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	79	tj3Set	call site: 00079	snprintf
17	249	jcopy_markers_execute	call site: 00249	jpeg_write_icc_profile
15	268	tj3Transform	call site: 00268	do_crop_ext_reflect
14	227	jinit_c_master_control	call site: 00227	using_std_huff_tables
13	58	tj3Set	call site: 00058	snprintf
11	286	jtransform_execute_transform	call site: 00286	do_rot_180
8	139	tj3Transform	call site: 00139	jtransform_perfect_transform
5	195	jtransform_adjust_parameters	call site: 00195	adjust_quant
3	148	jtransform_request_workspace	call site: 00148	trim_right_edge
2	54	tj3Set	call site: 00054	snprintf
1	4	tj3Init	call site: 00004	_tjInitCompress
1	11	jinit_memory_mgr	call site: 00011	jpeg_mem_term

Runtime coverage analysis

Covered functions

211

Functions that are reachable but not covered

33

Reachable functions

123

Percentage of reachable functions covered

73.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/transform.cc	1
libjpeg-turbo.devturbojpeg.c	15
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	8
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	7
libjpeg-turbo.devjdmarker.c	3
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjdicc.c	2
libjpeg-turbo.devtransupp.c	30
libjpeg-turbo.devwrapper/../jutils.c	4
libjpeg-turbo.devjdtrans.c	2
libjpeg-turbo.devjdarith.c	1
libjpeg-turbo.devjdphuff.c	1
libjpeg-turbo.devjdhuff.c	1
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jdcoefct.c	2
libjpeg-turbo.devjctrans.c	4
libjpeg-turbo.devjcparam.c	11
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: compress_yuv_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	131	36.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	232	63.9%
All colors	363	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	281	jinit_compress_master	call site: 00281	jinit_color_converter
17	331	jinit_compress_master	call site: 00331	jpeg_write_icc_profile
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	41	tj3Set	call site: 00041	snprintf
9	67	tj3Set	call site: 00067	snprintf
9	210	initial_setup	call site: 00210	using_std_huff_tables
6	59	tj3Set	call site: 00059	snprintf
6	194	jpeg_simple_progression	call site: 00194	fill_dc_scans
5	167	jpeg_default_colorspace	call site: 00167	jpeg_enable_lossless
5	173	setCompDefaults	call site: 00173	jpeg_set_colorspace
5	315	jsimd_set_quantize	call site: 00315	jsimd_set_convsamp_float
3	77	tj3Set	call site: 00077	snprintf

Runtime coverage analysis

Covered functions

188

Functions that are reachable but not covered

54

Reachable functions

129

Percentage of reachable functions covered

58.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress_yuv.cc	1
libjpeg-turbo.devturbojpeg.c	18
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	1
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	3
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: transform_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	121	37.9%
gold	[1:9]	1	0.31%
yellow	[10:29]	2	0.62%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	195	61.1%
All colors	319	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	79	tj3Set	call site: 00079	snprintf
17	249	jcopy_markers_execute	call site: 00249	jpeg_write_icc_profile
15	268	tj3Transform	call site: 00268	do_crop_ext_reflect
14	227	jinit_c_master_control	call site: 00227	using_std_huff_tables
13	58	tj3Set	call site: 00058	snprintf
11	286	jtransform_execute_transform	call site: 00286	do_rot_180
8	139	tj3Transform	call site: 00139	jtransform_perfect_transform
5	195	jtransform_adjust_parameters	call site: 00195	adjust_quant
3	148	jtransform_request_workspace	call site: 00148	trim_right_edge
2	54	tj3Set	call site: 00054	snprintf
1	4	tj3Init	call site: 00004	_tjInitCompress
1	11	jinit_memory_mgr	call site: 00011	jpeg_mem_term

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

33

Reachable functions

123

Percentage of reachable functions covered

73.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/transform.cc	1
libjpeg-turbo.mainturbojpeg.c	15
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	8
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.maintransupp.c	30
libjpeg-turbo.mainwrapper/../jutils.c	4
libjpeg-turbo.mainjdtrans.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainjctrans.c	4
libjpeg-turbo.mainjcparam.c	11
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	124	40.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	183	59.6%
All colors	307	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	231	jinit_compress_master	call site: 00231	j12init_color_converter
17	278	jinit_compress_master	call site: 00278	jpeg_write_icc_profile
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	41	tj3Set	call site: 00041	snprintf
9	195	initial_setup	call site: 00195	using_std_huff_tables
8	59	tj3Set	call site: 00059	snprintf
7	69	tj3Set	call site: 00069	snprintf
6	176	jpeg_simple_progression	call site: 00176	fill_dc_scans
5	155	setCompDefaults	call site: 00155	jpeg_set_colorspace
5	262	jsimd_set_quantize	call site: 00262	jsimd_set_convsamp_float
3	77	tj3Set	call site: 00077	snprintf
3	98	tj3LoadImage8	call site: 00098	__errno_location

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

53

Reachable functions

121

Percentage of reachable functions covered

56.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress.cc	1
libjpeg-turbo.devturbojpeg.c	10
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: decompress_yuv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	31.4%
gold	[1:9]	21	6.28%
yellow	[10:29]	1	0.29%
greenyellow	[30:49]	2	0.59%
lawngreen	50+	205	61.3%
All colors	334	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	77	tj3Set	call site: 00077	snprintf
16	164	jpeg_core_output_dimensions	call site: 00164	jdiv_round_up
12	56	tj3Set	call site: 00056	snprintf
12	195	master_selection	call site: 00195	jinit_1pass_quantizer
10	148	jpeg_calc_output_dimensions	call site: 00148	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	239	jsimd_can_ycc_rgb	call site: 00239	build_ycc_rgb_table
4	71	tj3Set	call site: 00071	snprintf
2	16	jinit_memory_mgr	call site: 00016	jpeg_mem_dest_tj
2	27	_tjInitDecompress	call site: 00027	_tjInitCompress
2	139	tj3DecompressToYUVPlanes8	call site: 00139	jpeg_read_header
2	160	jpeg_core_output_dimensions	call site: 00160	jdiv_round_up

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

29

Reachable functions

120

Percentage of reachable functions covered

75.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/decompress_yuv.cc	1
libjpeg-turbo.mainturbojpeg.c	19
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	2
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.mainjdmaster.c	6
libjpeg-turbo.mainwrapper/../jutils.c	3
libjpeg-turbo.mainwrapper/../jdapistd.c	3
libjpeg-turbo.mainwrapper/../jquant1.c	8
libjpeg-turbo.mainwrapper/../jquant2.c	3
libjpeg-turbo.mainwrapper/../jdmerge.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	9
libjpeg-turbo.mainwrapper/../jdcolor.c	5
libjpeg-turbo.mainwrapper/../jdsample.c	3
libjpeg-turbo.mainwrapper/../jdpostct.c	3
libjpeg-turbo.mainwrapper/../jdlossls.c	3
libjpeg-turbo.mainjdlhuff.c	1
libjpeg-turbo.mainwrapper/../jddiffct.c	3
libjpeg-turbo.mainwrapper/../jddctmgr.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainwrapper/../jdmainct.c	4

Fuzzer: libjpeg_turbo_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	40.1%
gold	[1:9]	21	6.68%
yellow	[10:29]	3	0.95%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	164	52.2%
All colors	314	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	77	tj3Set	call site: 00077	snprintf
16	150	jpeg_core_output_dimensions	call site: 00150	jdiv_round_up
16	278	tj3Decompress8	call site: 00278	jpeg_skip_scanlines
12	56	tj3Set	call site: 00056	snprintf
12	171	master_selection	call site: 00171	jinit_1pass_quantizer
7	269	jpeg_start_decompress	call site: 00269	jpeg_crop_scanline
6	134	jpeg_calc_output_dimensions	call site: 00134	jdiv_round_up
6	142	jpeg_core_output_dimensions	call site: 00142	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	215	jsimd_can_ycc_rgb	call site: 00215	build_ycc_rgb_table
5	299	LLVMFuzzerTestOneInput	call site: 00299	jpeg12_skip_scanlines
4	71	tj3Set	call site: 00071	snprintf

Runtime coverage analysis

Covered functions

240

Functions that are reachable but not covered

31

Reachable functions

124

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/decompress.cc	1
libjpeg-turbo.mainturbojpeg.c	12
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	2
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	3
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.mainturbojpeg-mp.c	3
libjpeg-turbo.mainwrapper/../jdapistd.c	11
libjpeg-turbo.mainjdmaster.c	6
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jquant1.c	8
libjpeg-turbo.mainwrapper/../jquant2.c	3
libjpeg-turbo.mainwrapper/../jdmerge.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	9
libjpeg-turbo.mainwrapper/../jdcolor.c	5
libjpeg-turbo.mainwrapper/../jdsample.c	3
libjpeg-turbo.mainwrapper/../jdpostct.c	3
libjpeg-turbo.mainwrapper/../jdlossls.c	3
libjpeg-turbo.mainjdlhuff.c	1
libjpeg-turbo.mainwrapper/../jddiffct.c	3
libjpeg-turbo.mainwrapper/../jddctmgr.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainwrapper/../jdmainct.c	4
libjpeg-turbo.mainwrapper/../jdmainct.h	1
libjpeg-turbo.mainwrapper/../jdcoefct.h	1

Fuzzer: libjpeg_turbo_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	40.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.97%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	180	58.2%
All colors	309	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	77	tj3Set	call site: 00077	snprintf
16	150	jpeg_core_output_dimensions	call site: 00150	jdiv_round_up
16	273	tj3Decompress8	call site: 00273	jpeg_skip_scanlines
12	56	tj3Set	call site: 00056	snprintf
12	171	master_selection	call site: 00171	jinit_1pass_quantizer
7	264	jpeg_start_decompress	call site: 00264	jpeg_crop_scanline
6	134	jpeg_calc_output_dimensions	call site: 00134	jdiv_round_up
6	142	jpeg_core_output_dimensions	call site: 00142	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	210	jsimd_set_ycc_rgb	call site: 00210	build_ycc_rgb_table
5	294	LLVMFuzzerTestOneInput	call site: 00294	jpeg12_skip_scanlines
4	71	tj3Set	call site: 00071	snprintf

Runtime coverage analysis

Covered functions

235

Functions that are reachable but not covered

31

Reachable functions

124

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/decompress.cc	1
libjpeg-turbo.devturbojpeg.c	12
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	2
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	7
libjpeg-turbo.devjdmarker.c	3
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devjcomapi.c	3
libjpeg-turbo.devjdicc.c	2
libjpeg-turbo.devturbojpeg-mp.c	3
libjpeg-turbo.devwrapper/../jdapistd.c	11
libjpeg-turbo.devjdmaster.c	6
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jquant1.c	8
libjpeg-turbo.devwrapper/../jquant2.c	3
libjpeg-turbo.devwrapper/../jdmerge.c	3
libjpeg-turbo.dev/simd/jsimd.c	9
libjpeg-turbo.devwrapper/../jdcolor.c	5
libjpeg-turbo.devwrapper/../jdsample.c	3
libjpeg-turbo.devwrapper/../jdpostct.c	3
libjpeg-turbo.devwrapper/../jdlossls.c	3
libjpeg-turbo.devjdlhuff.c	1
libjpeg-turbo.devwrapper/../jddiffct.c	3
libjpeg-turbo.devwrapper/../jddctmgr.c	2
libjpeg-turbo.devjdarith.c	1
libjpeg-turbo.devjdphuff.c	1
libjpeg-turbo.devjdhuff.c	1
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jdcoefct.c	2
libjpeg-turbo.devwrapper/../jdmainct.c	4
libjpeg-turbo.devwrapper/../jdmainct.h	1
libjpeg-turbo.devwrapper/../jdcoefct.h	1

Fuzzer: transform_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	103	35.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.69%
greenyellow	[30:49]	1	0.34%
lawngreen	50+	181	63.0%
All colors	287	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	76	tj3Set	call site: 00076	snprintf
15	234	tj3Transform	call site: 00234	do_crop_ext_reflect
14	54	tj3Set	call site: 00054	snprintf
14	210	jinit_c_master_control	call site: 00210	using_std_huff_tables
11	252	jtransform_execute_transform	call site: 00252	do_rot_180
8	120	tj3Transform	call site: 00120	jtransform_perfect_transform
5	178	jtransform_adjust_parameters	call site: 00178	adjust_quant
3	129	jtransform_request_workspace	call site: 00129	trim_right_edge
2	50	tj3Set	call site: 00050	snprintf
1	4	tj3Init	call site: 00004	_tjInitCompress
1	11	jinit_memory_mgr	call site: 00011	jpeg_mem_term
1	16	jinit_memory_mgr	call site: 00016	__isoc99_sscanf

Runtime coverage analysis

Covered functions

209

Functions that are reachable but not covered

30

Reachable functions

115

Percentage of reachable functions covered

73.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/transform.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	12
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	6
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	3
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/transupp.c	30
libjpeg-turbo.3.0.x/jutils.c	4
libjpeg-turbo.3.0.x/jdtrans.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jctrans.c	4
libjpeg-turbo.3.0.x/jcparam.c	11
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	160	54.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	132	45.2%
All colors	292	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
25	209	jinit_compress_master	call site: 00209	jsimd_can_rgb_gray
22	38	tj3Set	call site: 00038	snprintf
16	192	initial_setup	call site: 00192	j16init_color_converter
16	255	jinit_compress_master	call site: 00255	jsimd_can_fdct_islow
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
8	244	jinit_compress_master	call site: 00244	j16init_c_diff_controller
7	70	tj3Set	call site: 00070	snprintf
4	235	jinit_compress_master	call site: 00235	jsimd_can_h2v1_downsample
3	93	tj3LoadImage8	call site: 00093	__errno_location
3	272	jinit_compress_master	call site: 00272	j12init_c_coef_controller
2	66	tj3Set	call site: 00066	snprintf

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

64

Reachable functions

118

Percentage of reachable functions covered

45.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress_lossless.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress12_lossless_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	172	56.3%
gold	[1:9]	2	0.65%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.98%
lawngreen	50+	128	41.9%
All colors	305	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
37	193	initial_setup	call site: 00193	jinit_color_converter
28	152	setCompDefaults	call site: 00152	jpeg_simple_progression
19	248	jinit_compress_master	call site: 00248	jinit_forward_dct
17	276	jinit_compress_master	call site: 00276	jpeg_write_icc_profile
13	46	tj3Set	call site: 00046	snprintf
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
7	38	tj3Set	call site: 00038	snprintf
7	69	tj3Set	call site: 00069	snprintf
7	240	jinit_compress_master	call site: 00240	jinit_c_diff_controller
4	233	jinit_compress_master	call site: 00233	j16init_color_converter
3	77	tj3Set	call site: 00077	snprintf
3	95	tj3LoadImage12	call site: 00095	__errno_location

Runtime coverage analysis

Covered functions

156

Functions that are reachable but not covered

67

Reachable functions

121

Percentage of reachable functions covered

44.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress12_lossless.cc	1
libjpeg-turbo.devturbojpeg.c	10
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: compress16_lossless_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	173	56.7%
gold	[1:9]	2	0.65%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.65%
lawngreen	50+	128	41.9%
All colors	305	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
40	193	initial_setup	call site: 00193	jinit_color_converter
28	152	setCompDefaults	call site: 00152	jpeg_simple_progression
18	249	jinit_compress_master	call site: 00249	jinit_forward_dct
17	276	jinit_compress_master	call site: 00276	jpeg_write_icc_profile
13	46	tj3Set	call site: 00046	snprintf
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
8	240	jinit_compress_master	call site: 00240	jinit_c_diff_controller
7	38	tj3Set	call site: 00038	snprintf
7	69	tj3Set	call site: 00069	snprintf
3	77	tj3Set	call site: 00077	snprintf
3	95	tj3LoadImage16	call site: 00095	__errno_location
3	268	jinit_compress_master	call site: 00268	j12init_c_coef_controller

Runtime coverage analysis

Covered functions

156

Functions that are reachable but not covered

67

Reachable functions

121

Percentage of reachable functions covered

44.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress16_lossless.cc	1
libjpeg-turbo.devturbojpeg.c	10
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: decompress_yuv_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	32.2%
gold	[1:9]	21	6.38%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	202	61.3%
All colors	329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	74	tj3Set	call site: 00074	snprintf
16	159	jpeg_core_output_dimensions	call site: 00159	jdiv_round_up
14	190	master_selection	call site: 00190	j12init_1pass_quantizer
13	52	tj3Set	call site: 00052	snprintf
10	143	jpeg_calc_output_dimensions	call site: 00143	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	231	master_selection	call site: 00231	build_rgb_y_table
4	68	tj3Set	call site: 00068	snprintf
2	16	jinit_memory_mgr	call site: 00016	jpeg_mem_dest_tj
2	27	_tjInitDecompress	call site: 00027	_tjInitCompress
2	134	tj3DecompressToYUVPlanes8	call site: 00134	jpeg_read_header
2	155	jpeg_core_output_dimensions	call site: 00155	jdiv_round_up

Runtime coverage analysis

Covered functions

210

Functions that are reachable but not covered

29

Reachable functions

117

Percentage of reachable functions covered

75.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/decompress_yuv.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	19
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	2
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jdmaster.c	6
libjpeg-turbo.3.0.x/jutils.c	3
libjpeg-turbo.3.0.x/jdapistd.c	3
libjpeg-turbo.3.0.x/jquant1.c	8
libjpeg-turbo.3.0.x/jquant2.c	3
libjpeg-turbo.3.0.x/jdmerge.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	9
libjpeg-turbo.3.0.x/jdcolor.c	5
libjpeg-turbo.3.0.x/jdsample.c	3
libjpeg-turbo.3.0.x/jdpostct.c	3
libjpeg-turbo.3.0.x/jdlossls.c	3
libjpeg-turbo.3.0.x/jdlhuff.c	1
libjpeg-turbo.3.0.x/jddiffct.c	3
libjpeg-turbo.3.0.x/jddctmgr.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jdmainct.c	4

Fuzzer: compress_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	171	55.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	139	44.8%
All colors	310	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	152	setCompDefaults	call site: 00152	jpeg_simple_progression
25	203	jinit_compress_master	call site: 00203	jsimd_can_rgb_gray
20	252	jinit_c_diff_controller	call site: 00252	jinit_forward_dct
17	281	jinit_compress_master	call site: 00281	jpeg_write_icc_profile
13	46	tj3Set	call site: 00046	snprintf
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	193	initial_setup	call site: 00193	using_std_huff_tables
7	38	tj3Set	call site: 00038	snprintf
7	69	tj3Set	call site: 00069	snprintf
7	234	jinit_compress_master	call site: 00234	j12init_color_converter
4	229	jinit_compress_master	call site: 00229	jsimd_can_h2v1_downsample
3	77	tj3Set	call site: 00077	snprintf

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

67

Reachable functions

121

Percentage of reachable functions covered

44.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress_lossless.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress12_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	159	54.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.68%
greenyellow	[30:49]	6	2.05%
lawngreen	50+	125	42.8%
All colors	292	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
33	208	jinit_compress_master	call site: 00208	jinit_color_converter
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
22	38	tj3Set	call site: 00038	snprintf
16	255	jinit_compress_master	call site: 00255	jsimd_can_fdct_islow
13	192	initial_setup	call site: 00192	j16init_color_converter
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
7	70	tj3Set	call site: 00070	snprintf
7	244	jinit_compress_master	call site: 00244	j16init_c_diff_controller
3	93	tj3LoadImage12	call site: 00093	__errno_location
3	272	jinit_compress_master	call site: 00272	j12init_c_coef_controller
2	66	tj3Set	call site: 00066	snprintf
2	147	jpeg_default_colorspace	call site: 00147	jpeg_set_colorspace

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

64

Reachable functions

118

Percentage of reachable functions covered

45.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress12_lossless.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress12_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	177	57.0%
gold	[1:9]	2	0.64%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.96%
lawngreen	50+	128	41.2%
All colors	310	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	193	initial_setup	call site: 00193	jinit_color_converter
28	152	setCompDefaults	call site: 00152	jpeg_simple_progression
19	253	jinit_compress_master	call site: 00253	jinit_forward_dct
17	281	jinit_compress_master	call site: 00281	jpeg_write_icc_profile
13	46	tj3Set	call site: 00046	snprintf
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
7	38	tj3Set	call site: 00038	snprintf
7	69	tj3Set	call site: 00069	snprintf
7	245	jinit_compress_master	call site: 00245	jinit_c_diff_controller
4	238	jinit_compress_master	call site: 00238	j16init_color_converter
3	77	tj3Set	call site: 00077	snprintf
3	95	tj3LoadImage12	call site: 00095	__errno_location

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

67

Reachable functions

121

Percentage of reachable functions covered

44.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress12_lossless.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_yuv_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	113	32.1%
gold	[1:9]	21	5.98%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	217	61.8%
All colors	351	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	286	jinit_compress_master	call site: 00286	jinit_color_converter
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
10	41	tj3Set	call site: 00041	snprintf
9	68	tj3Set	call site: 00068	snprintf
9	209	initial_setup	call site: 00209	using_std_huff_tables
6	60	tj3Set	call site: 00060	snprintf
6	193	jpeg_simple_progression	call site: 00193	fill_dc_scans
5	166	jpeg_default_colorspace	call site: 00166	jpeg_enable_lossless
5	172	setCompDefaults	call site: 00172	jpeg_set_colorspace
4	321	jsimd_can_quantize	call site: 00321	jsimd_can_convsamp_float
3	97	tj3LoadImage8	call site: 00097	__errno_location
3	328	jinit_compress_master	call site: 00328	j12init_c_coef_controller

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

51

Reachable functions

126

Percentage of reachable functions covered

59.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress_yuv.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	18
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	1
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	3
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress16_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	178	57.4%
gold	[1:9]	2	0.64%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.64%
lawngreen	50+	128	41.2%
All colors	310	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
45	193	initial_setup	call site: 00193	jinit_color_converter
28	152	setCompDefaults	call site: 00152	jpeg_simple_progression
18	254	jinit_compress_master	call site: 00254	jinit_forward_dct
17	281	jinit_compress_master	call site: 00281	jpeg_write_icc_profile
13	46	tj3Set	call site: 00046	snprintf
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
8	245	jinit_compress_master	call site: 00245	jinit_c_diff_controller
7	38	tj3Set	call site: 00038	snprintf
7	69	tj3Set	call site: 00069	snprintf
3	77	tj3Set	call site: 00077	snprintf
3	95	tj3LoadImage16	call site: 00095	__errno_location
3	273	jinit_compress_master	call site: 00273	j12init_c_coef_controller

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

67

Reachable functions

121

Percentage of reachable functions covered

44.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress16_lossless.cc	1
libjpeg-turbo.mainturbojpeg.c	10
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_yuv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	131	35.5%
gold	[1:9]	21	5.70%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	216	58.6%
All colors	368	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	286	jinit_compress_master	call site: 00286	jinit_color_converter
17	336	jinit_compress_master	call site: 00336	jpeg_write_icc_profile
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	41	tj3Set	call site: 00041	snprintf
9	67	tj3Set	call site: 00067	snprintf
9	210	initial_setup	call site: 00210	using_std_huff_tables
6	59	tj3Set	call site: 00059	snprintf
6	194	jpeg_simple_progression	call site: 00194	fill_dc_scans
5	167	jpeg_default_colorspace	call site: 00167	jpeg_enable_lossless
5	173	setCompDefaults	call site: 00173	jpeg_set_colorspace
5	320	jsimd_can_quantize	call site: 00320	jsimd_can_convsamp_float
3	77	tj3Set	call site: 00077	snprintf

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

54

Reachable functions

129

Percentage of reachable functions covered

58.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress_yuv.cc	1
libjpeg-turbo.mainturbojpeg.c	18
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	1
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	3
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress16_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	153	52.3%
gold	[1:9]	2	0.68%
yellow	[10:29]	4	1.36%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	133	45.5%
All colors	292	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
36	204	jinit_compress_master	call site: 00204	jinit_color_converter
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
22	38	tj3Set	call site: 00038	snprintf
16	255	jinit_compress_master	call site: 00255	jsimd_can_fdct_islow
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
9	192	initial_setup	call site: 00192	using_std_huff_tables
7	70	tj3Set	call site: 00070	snprintf
3	93	tj3LoadImage16	call site: 00093	__errno_location
3	251	j16init_c_diff_controller	call site: 00251	j12init_c_diff_controller
3	272	jinit_compress_master	call site: 00272	j12init_c_coef_controller
2	66	tj3Set	call site: 00066	snprintf
2	147	jpeg_default_colorspace	call site: 00147	jpeg_set_colorspace

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

64

Reachable functions

118

Percentage of reachable functions covered

45.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress16_lossless.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	36.2%
gold	[1:9]	21	7.11%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.67%
lawngreen	50+	165	55.9%
All colors	295	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	195	initial_setup	call site: 00195	j16init_color_converter
14	243	jinit_compress_master	call site: 00243	j16init_c_diff_controller
11	21	_tjInitCompress	call site: 00021	_tjInitCompress
10	41	tj3Set	call site: 00041	snprintf
8	60	tj3Set	call site: 00060	snprintf
7	70	tj3Set	call site: 00070	snprintf
6	175	jpeg_simple_progression	call site: 00175	fill_dc_scans
5	154	setCompDefaults	call site: 00154	jpeg_set_colorspace
4	268	jsimd_can_quantize	call site: 00268	jsimd_can_convsamp_float
3	97	tj3LoadImage8	call site: 00097	__errno_location
3	150	jpeg_default_colorspace	call site: 00150	jpeg_enable_lossless
3	275	jinit_compress_master	call site: 00275	j12init_c_coef_controller

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

50

Reachable functions

118

Percentage of reachable functions covered

57.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: libjpeg_turbo_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	40.7%
gold	[1:9]	22	7.11%
yellow	[10:29]	4	1.29%
greenyellow	[30:49]	2	0.64%
lawngreen	50+	155	50.1%
All colors	309	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	74	tj3Set	call site: 00074	snprintf
16	145	jpeg_core_output_dimensions	call site: 00145	jdiv_round_up
16	273	tj3Decompress8	call site: 00273	jpeg_skip_scanlines
13	52	tj3Set	call site: 00052	snprintf
12	166	master_selection	call site: 00166	j12init_1pass_quantizer
7	264	jpeg_start_decompress	call site: 00264	jpeg_crop_scanline
6	129	jpeg_calc_output_dimensions	call site: 00129	jdiv_round_up
6	137	jpeg_core_output_dimensions	call site: 00137	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	294	LLVMFuzzerTestOneInput	call site: 00294	jpeg12_skip_scanlines
4	68	tj3Set	call site: 00068	snprintf
3	209	j16init_color_deconverter	call site: 00209	build_ycc_rgb_table

Runtime coverage analysis

Covered functions

236

Functions that are reachable but not covered

31

Reachable functions

121

Percentage of reachable functions covered

74.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/decompress.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	12
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	2
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	3
libjpeg-turbo.3.0.x/turbojpeg-mp.c	3
libjpeg-turbo.3.0.x/jdapistd.c	11
libjpeg-turbo.3.0.x/jdmaster.c	6
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jquant1.c	8
libjpeg-turbo.3.0.x/jquant2.c	3
libjpeg-turbo.3.0.x/jdmerge.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	9
libjpeg-turbo.3.0.x/jdcolor.c	5
libjpeg-turbo.3.0.x/jdsample.c	3
libjpeg-turbo.3.0.x/jdpostct.c	3
libjpeg-turbo.3.0.x/jdlossls.c	3
libjpeg-turbo.3.0.x/jdlhuff.c	1
libjpeg-turbo.3.0.x/jddiffct.c	3
libjpeg-turbo.3.0.x/jddctmgr.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jdmainct.c	4
libjpeg-turbo.3.0.x/jdmainct.h	1
libjpeg-turbo.3.0.x/jdcoefct.h	1

Fuzzer: decompress_yuv_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	31.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.30%
greenyellow	[30:49]	3	0.91%
lawngreen	50+	220	66.8%
All colors	329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	77	tj3Set	call site: 00077	snprintf
16	164	jpeg_core_output_dimensions	call site: 00164	jdiv_round_up
12	56	tj3Set	call site: 00056	snprintf
12	195	master_selection	call site: 00195	jinit_1pass_quantizer
10	148	jpeg_calc_output_dimensions	call site: 00148	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	234	jsimd_set_ycc_rgb	call site: 00234	build_ycc_rgb_table
4	71	tj3Set	call site: 00071	snprintf
2	16	jinit_memory_mgr	call site: 00016	jpeg_mem_dest_tj
2	27	_tjInitDecompress	call site: 00027	_tjInitCompress
2	139	tj3DecompressToYUVPlanes8	call site: 00139	jpeg_read_header
2	160	jpeg_core_output_dimensions	call site: 00160	jdiv_round_up

Runtime coverage analysis

Covered functions

212

Functions that are reachable but not covered

29

Reachable functions

120

Percentage of reachable functions covered

75.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/decompress_yuv.cc	1
libjpeg-turbo.devturbojpeg.c	19
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	2
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	7
libjpeg-turbo.devjdmarker.c	3
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjdicc.c	2
libjpeg-turbo.devjdmaster.c	6
libjpeg-turbo.devwrapper/../jutils.c	3
libjpeg-turbo.devwrapper/../jdapistd.c	3
libjpeg-turbo.devwrapper/../jquant1.c	8
libjpeg-turbo.devwrapper/../jquant2.c	3
libjpeg-turbo.devwrapper/../jdmerge.c	3
libjpeg-turbo.dev/simd/jsimd.c	9
libjpeg-turbo.devwrapper/../jdcolor.c	5
libjpeg-turbo.devwrapper/../jdsample.c	3
libjpeg-turbo.devwrapper/../jdpostct.c	3
libjpeg-turbo.devwrapper/../jdlossls.c	3
libjpeg-turbo.devjdlhuff.c	1
libjpeg-turbo.devwrapper/../jddiffct.c	3
libjpeg-turbo.devwrapper/../jddctmgr.c	2
libjpeg-turbo.devjdarith.c	1
libjpeg-turbo.devjdphuff.c	1
libjpeg-turbo.devjdhuff.c	1
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jdcoefct.c	2
libjpeg-turbo.devwrapper/../jdmainct.c	4