High level conclusions

Fuzzers reach 44.68% of cyclomatic complexity.

Fuzzers reach 36.70% of all functions.

Fuzzer cjpeg_fuzzer is blocked:

The runtime code coverage of cjpeg_fuzzer covers 21.09% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer cjpeg_fuzzer_dev is blocked:

The runtime code coverage of cjpeg_fuzzer_dev covers 21.09% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer cjpeg_fuzzer_3_0_x is blocked:

The runtime code coverage of cjpeg_fuzzer_3_0_x covers 21.09% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

301 / 820

Cyclomatic complexity statically reachable by fuzzers

3322 / 7434

Runtime code coverage of functions

359 / 820

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: cjpeg_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	315	80.7%
gold	[1:9]	10	2.56%
yellow	[10:29]	5	1.28%
greenyellow	[30:49]	34	8.71%
lawngreen	50+	26	6.66%
All colors	390	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
134	248	select_file_type(jpeg_compress_struct*, _IO_FILE*)	call site: 00248	jpeg_start_compress
101	138	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00138	read_scan_script
36	41	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00041	fprintf
4	31	jpeg_default_colorspace	call site: 00031	jpeg_set_colorspace
4	82	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00082	fprintf
4	97	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00097	__isoc99_sscanf
4	109	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00109	__isoc99_sscanf
3	102	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00102	__isoc99_sscanf
2	28	jpeg_set_defaults	call site: 00028	jpeg_set_colorspace
2	87	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00087	fprintf
2	125	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00125
2	134	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00134

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

101

Reachable functions

128

Percentage of reachable functions covered

21.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/cjpeg.cc	1
libjpeg-turbo.3.0.x/fuzz/../cjpeg.c	4
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	7
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/cdjpeg.c	4
libjpeg-turbo.3.0.x/rdswitch.c	9
libjpeg-turbo.3.0.x/jdatadst.c	2
libjpeg-turbo.3.0.x/jcapistd.c	4
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1
libjpeg-turbo.3.0.x/jcicc.c	1

Fuzzer: compress_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	160	55.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	126	44.0%
All colors	286	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	144	setCompDefaults	call site: 00144	jpeg_simple_progression
25	203	jinit_compress_master	call site: 00203	jsimd_can_rgb_gray
22	36	tj3Set	call site: 00036	snprintf
16	186	initial_setup	call site: 00186	j16init_color_converter
16	249	jinit_compress_master	call site: 00249	jsimd_can_fdct_islow
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
8	238	jinit_compress_master	call site: 00238	j16init_c_diff_controller
7	68	tj3Set	call site: 00068	snprintf
4	229	jinit_compress_master	call site: 00229	jsimd_can_h2v1_downsample
3	88	_tj3LoadImageFromFileHandle8	call site: 00088	__errno_location
3	266	jinit_compress_master	call site: 00266	j12init_c_coef_controller
2	64	tj3Set	call site: 00064	snprintf

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

61

Reachable functions

115

Percentage of reachable functions covered

46.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress_lossless.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress16_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	153	53.4%
gold	[1:9]	2	0.69%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	1.39%
lawngreen	50+	127	44.4%
All colors	286	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
36	198	jinit_compress_master	call site: 00198	jinit_color_converter
28	144	setCompDefaults	call site: 00144	jpeg_simple_progression
22	36	tj3Set	call site: 00036	snprintf
16	249	jinit_compress_master	call site: 00249	jsimd_can_fdct_islow
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	186	initial_setup	call site: 00186	using_std_huff_tables
7	68	tj3Set	call site: 00068	snprintf
3	88	_tj3LoadImageFromFileHandle16	call site: 00088	__errno_location
3	245	j16init_c_diff_controller	call site: 00245	j12init_c_diff_controller
3	266	jinit_compress_master	call site: 00266	j12init_c_coef_controller
2	64	tj3Set	call site: 00064	snprintf
2	141	jpeg_default_colorspace	call site: 00141	jpeg_set_colorspace

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

61

Reachable functions

115

Percentage of reachable functions covered

46.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress16_lossless.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	107	37.0%
gold	[1:9]	21	7.26%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.69%
lawngreen	50+	159	55.0%
All colors	289	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	189	initial_setup	call site: 00189	j16init_color_converter
14	237	jinit_compress_master	call site: 00237	j16init_c_diff_controller
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
10	39	tj3Set	call site: 00039	snprintf
8	58	tj3Set	call site: 00058	snprintf
7	68	tj3Set	call site: 00068	snprintf
6	169	jpeg_simple_progression	call site: 00169	fill_dc_scans
5	148	setCompDefaults	call site: 00148	jpeg_set_colorspace
4	262	jsimd_can_quantize	call site: 00262	jsimd_can_convsamp_float
3	92	_tj3LoadImageFromFileHandle8	call site: 00092	__errno_location
3	144	jpeg_default_colorspace	call site: 00144	jpeg_enable_lossless
3	269	jinit_compress_master	call site: 00269	j12init_c_coef_controller

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

47

Reachable functions

115

Percentage of reachable functions covered

59.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	154	50.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	154	50.0%
All colors	308	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
25	201	jinit_compress_master	call site: 00201	jsimd_can_rgb_gray
20	250	jinit_c_diff_controller	call site: 00250	jinit_forward_dct
13	44	tj3Set	call site: 00044	snprintf
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	191	initial_setup	call site: 00191	using_std_huff_tables
7	36	tj3Set	call site: 00036	snprintf
7	67	tj3Set	call site: 00067	snprintf
7	232	jinit_compress_master	call site: 00232	j12init_color_converter
4	227	jinit_compress_master	call site: 00227	jsimd_can_h2v1_downsample
3	75	tj3Set	call site: 00075	snprintf
3	90	_tj3LoadImageFromFileHandle8	call site: 00090	__errno_location

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

61

Reachable functions

119

Percentage of reachable functions covered

48.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress_lossless.cc	1
libjpeg-turbo.mainturbojpeg.c	11
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_yuv_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	113	32.7%
gold	[1:9]	21	6.08%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	211	61.1%
All colors	345	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	280	jinit_compress_master	call site: 00280	jinit_color_converter
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
10	39	tj3Set	call site: 00039	snprintf
9	66	tj3Set	call site: 00066	snprintf
9	203	initial_setup	call site: 00203	using_std_huff_tables
6	58	tj3Set	call site: 00058	snprintf
6	187	jpeg_simple_progression	call site: 00187	fill_dc_scans
5	160	jpeg_default_colorspace	call site: 00160	jpeg_enable_lossless
5	166	setCompDefaults	call site: 00166	jpeg_set_colorspace
4	315	jsimd_can_quantize	call site: 00315	jsimd_can_convsamp_float
3	92	_tj3LoadImageFromFileHandle8	call site: 00092	__errno_location
3	322	jinit_compress_master	call site: 00322	j12init_c_coef_controller

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

48

Reachable functions

123

Percentage of reachable functions covered

60.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress_yuv.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	18
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	1
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	3
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: transform_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	103	31.4%
gold	[1:9]	1	0.30%
yellow	[10:29]	2	0.61%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	221	67.5%
All colors	327	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	79	tj3Set	call site: 00079	snprintf
15	272	tj3Transform	call site: 00272	do_crop_ext_reflect
14	231	jinit_c_master_control	call site: 00231	using_std_huff_tables
13	58	tj3Set	call site: 00058	snprintf
10	290	jtransform_execute_transform	call site: 00290	do_rot_180
8	143	tj3Transform	call site: 00143	jtransform_perfect_transform
5	199	jtransform_adjust_parameters	call site: 00199	adjust_quant
3	152	jtransform_request_workspace	call site: 00152	trim_right_edge
2	54	tj3Set	call site: 00054	snprintf
1	4	tj3Init	call site: 00004	_tjInitCompress
1	11	jinit_memory_mgr	call site: 00011	jpeg_mem_term
1	16	jinit_memory_mgr	call site: 00016	__isoc99_sscanf

Runtime coverage analysis

Covered functions

220

Functions that are reachable but not covered

30

Reachable functions

125

Percentage of reachable functions covered

76.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/transform.cc	1
libjpeg-turbo.mainturbojpeg.c	17
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	8
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.maintransupp.c	30
libjpeg-turbo.mainwrapper/../jutils.c	4
libjpeg-turbo.mainjdtrans.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainjctrans.c	4
libjpeg-turbo.mainjcparam.c	11
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress16_lossless_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	156	51.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	147	48.5%
All colors	303	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
40	191	initial_setup	call site: 00191	jinit_color_converter
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
18	247	jinit_compress_master	call site: 00247	jinit_forward_dct
13	44	tj3Set	call site: 00044	snprintf
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
8	238	jinit_compress_master	call site: 00238	jinit_c_diff_controller
7	36	tj3Set	call site: 00036	snprintf
7	67	tj3Set	call site: 00067	snprintf
3	75	tj3Set	call site: 00075	snprintf
3	90	_tj3LoadImageFromFileHandle16	call site: 00090	__errno_location
3	266	jinit_compress_master	call site: 00266	j12init_c_coef_controller
2	63	tj3Set	call site: 00063	snprintf

Runtime coverage analysis

Covered functions

162

Functions that are reachable but not covered

61

Reachable functions

119

Percentage of reachable functions covered

48.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress16_lossless.cc	1
libjpeg-turbo.devturbojpeg.c	11
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: compress12_lossless_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	159	55.5%
gold	[1:9]	2	0.69%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	2.09%
lawngreen	50+	119	41.6%
All colors	286	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
33	202	jinit_compress_master	call site: 00202	jinit_color_converter
28	144	setCompDefaults	call site: 00144	jpeg_simple_progression
22	36	tj3Set	call site: 00036	snprintf
16	249	jinit_compress_master	call site: 00249	jsimd_can_fdct_islow
13	186	initial_setup	call site: 00186	j16init_color_converter
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
7	68	tj3Set	call site: 00068	snprintf
7	238	jinit_compress_master	call site: 00238	j16init_c_diff_controller
3	88	_tj3LoadImageFromFileHandle12	call site: 00088	__errno_location
3	266	jinit_compress_master	call site: 00266	j12init_c_coef_controller
2	64	tj3Set	call site: 00064	snprintf
2	141	jpeg_default_colorspace	call site: 00141	jpeg_set_colorspace

Runtime coverage analysis

Covered functions

157

Functions that are reachable but not covered

61

Reachable functions

115

Percentage of reachable functions covered

46.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress12_lossless.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: decompress_libjpeg_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	43	22.8%
gold	[1:9]	1	0.53%
yellow	[10:29]	1	0.53%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	143	76.0%
All colors	188	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	47	jpeg_core_output_dimensions	call site: 00047	jdiv_round_up
14	31	jpeg_calc_output_dimensions	call site: 00031	jdiv_round_up
4	99	init_simd	call site: 00099	jsimd_set_h2v1_merged_upsample
3	80	master_selection	call site: 00080	jinit_merged_upsampler
1	5	jinit_memory_mgr	call site: 00005	jpeg_mem_term
1	10	jinit_memory_mgr	call site: 00010	__isoc99_sscanf
1	104	master_selection	call site: 00104	build_rgb_y_table
1	107	jsimd_set_ycc_rgb	call site: 00107	build_ycc_rgb_table
1	161	jpeg_start_decompress	call site: 00161	jpeg_abort_decompress
1	172	jpeg_skip_scanlines	call site: 00172	read_and_discard_scanlines

Runtime coverage analysis

Covered functions

246

Functions that are reachable but not covered

13

Reachable functions

105

Percentage of reachable functions covered

87.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/decompress_libjpeg.cc	2
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjdapimin.c	9
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdmarker.c	4
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjcomapi.c	3
libjpeg-turbo.devjdatasrc.c	1
libjpeg-turbo.devwrapper/../jdapistd.c	8
libjpeg-turbo.devjdmaster.c	6
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jquant1.c	8
libjpeg-turbo.devwrapper/../jquant2.c	3
libjpeg-turbo.devwrapper/../jdmerge.c	3
libjpeg-turbo.dev/simd/jsimd.c	9
libjpeg-turbo.devwrapper/../jdcolor.c	5
libjpeg-turbo.devwrapper/../jdsample.c	3
libjpeg-turbo.devwrapper/../jdpostct.c	3
libjpeg-turbo.devwrapper/../jdlossls.c	3
libjpeg-turbo.devjdlhuff.c	1
libjpeg-turbo.devwrapper/../jddiffct.c	3
libjpeg-turbo.devwrapper/../jddctmgr.c	2
libjpeg-turbo.devjdarith.c	1
libjpeg-turbo.devjdphuff.c	1
libjpeg-turbo.devjdhuff.c	1
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jdcoefct.c	2
libjpeg-turbo.devwrapper/../jdmainct.c	4
libjpeg-turbo.devwrapper/../jdmainct.h	1
libjpeg-turbo.devwrapper/../jdcoefct.h	1

Fuzzer: libjpeg_turbo_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	32.2%
gold	[1:9]	24	7.45%
yellow	[10:29]	2	0.62%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	192	59.6%
All colors	322	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	77	tj3Set	call site: 00077	snprintf
16	150	jpeg_core_output_dimensions	call site: 00150	jdiv_round_up
12	56	tj3Set	call site: 00056	snprintf
12	171	master_selection	call site: 00171	jinit_1pass_quantizer
6	142	jpeg_core_output_dimensions	call site: 00142	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
4	71	tj3Set	call site: 00071	snprintf
4	136	jpeg_core_output_dimensions	call site: 00136	jdiv_round_up
4	215	jsimd_can_ycc_rgb	call site: 00215	build_ycc_rgb_table
3	273	jpeg_crop_scanline	call site: 00273	jinit_upsampler
2	16	jinit_memory_mgr	call site: 00016	jpeg_mem_dest_tj
2	27	_tjInitDecompress	call site: 00027	_tjInitCompress

Runtime coverage analysis

Covered functions

258

Functions that are reachable but not covered

25

Reachable functions

126

Percentage of reachable functions covered

80.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/decompress.cc	1
libjpeg-turbo.mainturbojpeg.c	14
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	2
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	3
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.mainturbojpeg-mp.c	3
libjpeg-turbo.mainwrapper/../jdapistd.c	11
libjpeg-turbo.mainjdmaster.c	6
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jquant1.c	8
libjpeg-turbo.mainwrapper/../jquant2.c	3
libjpeg-turbo.mainwrapper/../jdmerge.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	9
libjpeg-turbo.mainwrapper/../jdcolor.c	5
libjpeg-turbo.mainwrapper/../jdsample.c	3
libjpeg-turbo.mainwrapper/../jdpostct.c	3
libjpeg-turbo.mainwrapper/../jdlossls.c	3
libjpeg-turbo.mainjdlhuff.c	1
libjpeg-turbo.mainwrapper/../jddiffct.c	3
libjpeg-turbo.mainwrapper/../jddctmgr.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainwrapper/../jdmainct.c	4
libjpeg-turbo.mainwrapper/../jdmainct.h	1
libjpeg-turbo.mainwrapper/../jdcoefct.h	1

Fuzzer: cjpeg_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	312	81.0%
gold	[1:9]	10	2.59%
yellow	[10:29]	3	0.77%
greenyellow	[30:49]	34	8.83%
lawngreen	50+	26	6.75%
All colors	385	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
129	248	select_file_type(jpeg_compress_struct*, _IO_FILE*)	call site: 00248	jpeg_start_compress
101	138	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00138	read_scan_script
36	41	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00041	fprintf
4	31	jpeg_default_colorspace	call site: 00031	jpeg_set_colorspace
4	82	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00082	fprintf
4	97	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00097	__isoc99_sscanf
4	109	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00109	__isoc99_sscanf
4	123	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00123	__isoc99_sscanf
3	102	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00102	__isoc99_sscanf
2	28	jpeg_set_defaults	call site: 00028	jpeg_set_colorspace
2	87	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00087	fprintf
2	134	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00134

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

101

Reachable functions

128

Percentage of reachable functions covered

21.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/cjpeg.cc	1
libjpeg-turbo.dev/fuzz/..cjpeg.c	4
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devcdjpeg.c	4
libjpeg-turbo.devrdswitch.c	9
libjpeg-turbo.devjdatadst.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	4
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: compress_yuv_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	125	35.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	232	64.9%
All colors	357	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	275	jinit_compress_master	call site: 00275	jinit_color_converter
17	325	jinit_compress_master	call site: 00325	jpeg_write_icc_profile
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	39	tj3Set	call site: 00039	snprintf
9	65	tj3Set	call site: 00065	snprintf
9	204	initial_setup	call site: 00204	using_std_huff_tables
6	57	tj3Set	call site: 00057	snprintf
5	161	jpeg_default_colorspace	call site: 00161	jpeg_enable_lossless
5	167	setCompDefaults	call site: 00167	jpeg_set_colorspace
5	309	jsimd_set_quantize	call site: 00309	jsimd_set_convsamp_float
3	75	tj3Set	call site: 00075	snprintf
3	93	_tj3LoadImageFromFileHandle8	call site: 00093	__errno_location

Runtime coverage analysis

Covered functions

190

Functions that are reachable but not covered

50

Reachable functions

126

Percentage of reachable functions covered

60.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress_yuv.cc	1
libjpeg-turbo.devturbojpeg.c	18
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	1
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	3
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: decompress_yuv_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	103	30.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.29%
greenyellow	[30:49]	2	0.59%
lawngreen	50+	229	68.3%
All colors	335	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	77	tj3Set	call site: 00077	snprintf
16	164	jpeg_core_output_dimensions	call site: 00164	jdiv_round_up
12	56	tj3Set	call site: 00056	snprintf
12	195	master_selection	call site: 00195	jinit_1pass_quantizer
6	152	jpeg_core_output_dimensions	call site: 00152	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	234	jsimd_set_ycc_rgb	call site: 00234	build_ycc_rgb_table
4	71	tj3Set	call site: 00071	snprintf
2	16	jinit_memory_mgr	call site: 00016	jpeg_mem_dest_tj
2	27	_tjInitDecompress	call site: 00027	_tjInitCompress
2	139	tj3DecompressToYUVPlanes8	call site: 00139	jpeg_read_header
2	148	jpeg_calc_output_dimensions	call site: 00148	jdiv_round_up

Runtime coverage analysis

Covered functions

219

Functions that are reachable but not covered

29

Reachable functions

122

Percentage of reachable functions covered

76.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/decompress_yuv.cc	1
libjpeg-turbo.devturbojpeg.c	21
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	2
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	7
libjpeg-turbo.devjdmarker.c	3
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjdicc.c	2
libjpeg-turbo.devjdmaster.c	6
libjpeg-turbo.devwrapper/../jutils.c	3
libjpeg-turbo.devwrapper/../jdapistd.c	3
libjpeg-turbo.devwrapper/../jquant1.c	8
libjpeg-turbo.devwrapper/../jquant2.c	3
libjpeg-turbo.devwrapper/../jdmerge.c	3
libjpeg-turbo.dev/simd/jsimd.c	9
libjpeg-turbo.devwrapper/../jdcolor.c	5
libjpeg-turbo.devwrapper/../jdsample.c	3
libjpeg-turbo.devwrapper/../jdpostct.c	3
libjpeg-turbo.devwrapper/../jdlossls.c	3
libjpeg-turbo.devjdlhuff.c	1
libjpeg-turbo.devwrapper/../jddiffct.c	3
libjpeg-turbo.devwrapper/../jddctmgr.c	2
libjpeg-turbo.devjdarith.c	1
libjpeg-turbo.devjdphuff.c	1
libjpeg-turbo.devjdhuff.c	1
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jdcoefct.c	2
libjpeg-turbo.devwrapper/../jdmainct.c	4

Fuzzer: decompress_yuv_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	106	31.8%
gold	[1:9]	21	6.30%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.30%
lawngreen	50+	205	61.5%
All colors	333	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	74	tj3Set	call site: 00074	snprintf
16	159	jpeg_core_output_dimensions	call site: 00159	jdiv_round_up
14	190	master_selection	call site: 00190	j12init_1pass_quantizer
13	52	tj3Set	call site: 00052	snprintf
10	143	jpeg_calc_output_dimensions	call site: 00143	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	231	master_selection	call site: 00231	build_rgb_y_table
4	68	tj3Set	call site: 00068	snprintf
2	16	jinit_memory_mgr	call site: 00016	jpeg_mem_dest_tj
2	27	_tjInitDecompress	call site: 00027	_tjInitCompress
2	134	tj3DecompressToYUVPlanes8	call site: 00134	jpeg_read_header
2	155	jpeg_core_output_dimensions	call site: 00155	jdiv_round_up

Runtime coverage analysis

Covered functions

211

Functions that are reachable but not covered

29

Reachable functions

118

Percentage of reachable functions covered

75.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/decompress_yuv.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	20
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	2
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jdmaster.c	6
libjpeg-turbo.3.0.x/jutils.c	3
libjpeg-turbo.3.0.x/jdapistd.c	3
libjpeg-turbo.3.0.x/jquant1.c	8
libjpeg-turbo.3.0.x/jquant2.c	3
libjpeg-turbo.3.0.x/jdmerge.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	9
libjpeg-turbo.3.0.x/jdcolor.c	5
libjpeg-turbo.3.0.x/jdsample.c	3
libjpeg-turbo.3.0.x/jdpostct.c	3
libjpeg-turbo.3.0.x/jdlossls.c	3
libjpeg-turbo.3.0.x/jdlhuff.c	1
libjpeg-turbo.3.0.x/jddiffct.c	3
libjpeg-turbo.3.0.x/jddctmgr.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jdmainct.c	4

Fuzzer: compress12_lossless_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	155	51.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.99%
lawngreen	50+	145	47.8%
All colors	303	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
37	191	initial_setup	call site: 00191	jinit_color_converter
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
19	246	jinit_compress_master	call site: 00246	jinit_forward_dct
13	44	tj3Set	call site: 00044	snprintf
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
7	36	tj3Set	call site: 00036	snprintf
7	67	tj3Set	call site: 00067	snprintf
7	238	jinit_compress_master	call site: 00238	jinit_c_diff_controller
4	231	jinit_compress_master	call site: 00231	j16init_color_converter
3	75	tj3Set	call site: 00075	snprintf
3	90	_tj3LoadImageFromFileHandle12	call site: 00090	__errno_location
3	266	jinit_compress_master	call site: 00266	j12init_c_coef_controller

Runtime coverage analysis

Covered functions

162

Functions that are reachable but not covered

61

Reachable functions

119

Percentage of reachable functions covered

48.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress12_lossless.cc	1
libjpeg-turbo.devturbojpeg.c	11
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: libjpeg_turbo_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	40.5%
gold	[1:9]	22	7.07%
yellow	[10:29]	4	1.28%
greenyellow	[30:49]	2	0.64%
lawngreen	50+	157	50.4%
All colors	311	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	74	tj3Set	call site: 00074	snprintf
16	145	jpeg_core_output_dimensions	call site: 00145	jdiv_round_up
16	273	tj3Decompress8	call site: 00273	jpeg_skip_scanlines
13	52	tj3Set	call site: 00052	snprintf
12	166	master_selection	call site: 00166	j12init_1pass_quantizer
7	264	jpeg_start_decompress	call site: 00264	jpeg_crop_scanline
6	129	jpeg_calc_output_dimensions	call site: 00129	jdiv_round_up
6	137	jpeg_core_output_dimensions	call site: 00137	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	294	LLVMFuzzerTestOneInput	call site: 00294	jpeg12_skip_scanlines
4	68	tj3Set	call site: 00068	snprintf
3	209	j16init_color_deconverter	call site: 00209	build_ycc_rgb_table

Runtime coverage analysis

Covered functions

237

Functions that are reachable but not covered

31

Reachable functions

122

Percentage of reachable functions covered

74.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/decompress.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	13
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	2
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	3
libjpeg-turbo.3.0.x/turbojpeg-mp.c	3
libjpeg-turbo.3.0.x/jdapistd.c	11
libjpeg-turbo.3.0.x/jdmaster.c	6
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jquant1.c	8
libjpeg-turbo.3.0.x/jquant2.c	3
libjpeg-turbo.3.0.x/jdmerge.c	3
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	9
libjpeg-turbo.3.0.x/jdcolor.c	5
libjpeg-turbo.3.0.x/jdsample.c	3
libjpeg-turbo.3.0.x/jdpostct.c	3
libjpeg-turbo.3.0.x/jdlossls.c	3
libjpeg-turbo.3.0.x/jdlhuff.c	1
libjpeg-turbo.3.0.x/jddiffct.c	3
libjpeg-turbo.3.0.x/jddctmgr.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jdmainct.c	4
libjpeg-turbo.3.0.x/jdmainct.h	1
libjpeg-turbo.3.0.x/jdcoefct.h	1

Fuzzer: compress_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	33.4%
gold	[1:9]	21	6.75%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	186	59.8%
All colors	311	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	235	jinit_compress_master	call site: 00235	j12init_color_converter
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	194	initial_setup	call site: 00194	using_std_huff_tables
8	57	tj3Set	call site: 00057	snprintf
7	67	tj3Set	call site: 00067	snprintf
6	175	jpeg_simple_progression	call site: 00175	fill_dc_scans
5	39	tj3Set	call site: 00039	snprintf
5	266	jsimd_can_quantize	call site: 00266	jsimd_can_convsamp_float
3	75	tj3Set	call site: 00075	snprintf
3	94	_tj3LoadImageFromFileHandle8	call site: 00094	__errno_location
3	150	jpeg_default_colorspace	call site: 00150	jpeg_enable_lossless
3	159	setCompDefaults	call site: 00159	jpeg_set_colorspace

Runtime coverage analysis

Covered functions

214

Functions that are reachable but not covered

47

Reachable functions

119

Percentage of reachable functions covered

60.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress.cc	1
libjpeg-turbo.mainturbojpeg.c	11
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: transform_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	102	35.0%
gold	[1:9]	1	0.34%
yellow	[10:29]	1	0.34%
greenyellow	[30:49]	1	0.34%
lawngreen	50+	186	63.9%
All colors	291	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	76	tj3Set	call site: 00076	snprintf
15	234	tj3Transform	call site: 00234	do_crop_ext_reflect
14	54	tj3Set	call site: 00054	snprintf
14	210	jinit_c_master_control	call site: 00210	using_std_huff_tables
11	252	jtransform_execute_transform	call site: 00252	do_rot_180
8	120	tj3Transform	call site: 00120	jtransform_perfect_transform
5	178	jtransform_adjust_parameters	call site: 00178	adjust_quant
3	129	jtransform_request_workspace	call site: 00129	trim_right_edge
2	50	tj3Set	call site: 00050	snprintf
1	4	tj3Init	call site: 00004	_tjInitCompress
1	11	jinit_memory_mgr	call site: 00011	jpeg_mem_term
1	16	jinit_memory_mgr	call site: 00016	__isoc99_sscanf

Runtime coverage analysis

Covered functions

210

Functions that are reachable but not covered

30

Reachable functions

116

Percentage of reachable functions covered

74.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/transform.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	13
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	6
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	7
libjpeg-turbo.3.0.x/jdmarker.c	3
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/transupp.c	30
libjpeg-turbo.3.0.x/jutils.c	4
libjpeg-turbo.3.0.x/jdtrans.c	2
libjpeg-turbo.3.0.x/jdarith.c	1
libjpeg-turbo.3.0.x/jdphuff.c	1
libjpeg-turbo.3.0.x/jdhuff.c	1
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jdcoefct.c	2
libjpeg-turbo.3.0.x/jctrans.c	4
libjpeg-turbo.3.0.x/jcparam.c	11
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: compress16_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	161	52.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.64%
lawngreen	50+	145	47.0%
All colors	308	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
45	191	initial_setup	call site: 00191	jinit_color_converter
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
18	252	jinit_compress_master	call site: 00252	jinit_forward_dct
13	44	tj3Set	call site: 00044	snprintf
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
8	243	jinit_compress_master	call site: 00243	jinit_c_diff_controller
7	36	tj3Set	call site: 00036	snprintf
7	67	tj3Set	call site: 00067	snprintf
3	75	tj3Set	call site: 00075	snprintf
3	90	_tj3LoadImageFromFileHandle16	call site: 00090	__errno_location
3	271	jinit_compress_master	call site: 00271	j12init_c_coef_controller
2	63	tj3Set	call site: 00063	snprintf

Runtime coverage analysis

Covered functions

163

Functions that are reachable but not covered

61

Reachable functions

119

Percentage of reachable functions covered

48.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress16_lossless.cc	1
libjpeg-turbo.mainturbojpeg.c	11
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress12_fuzzer_3_0_x

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	41.6%
gold	[1:9]	23	7.98%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	1.73%
lawngreen	50+	140	48.6%
All colors	288	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	228	init_simd	call site: 00228	jinit_downsampler
14	251	jinit_compress_master	call site: 00251	jsimd_can_fdct_islow
13	188	initial_setup	call site: 00188	j16init_color_converter
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
10	39	tj3Set	call site: 00039	snprintf
8	58	tj3Set	call site: 00058	snprintf
7	68	tj3Set	call site: 00068	snprintf
6	168	jpeg_simple_progression	call site: 00168	fill_dc_scans
5	147	setCompDefaults	call site: 00147	jpeg_set_colorspace
3	91	_tj3LoadImageFromFileHandle12	call site: 00091	__errno_location
3	143	jpeg_default_colorspace	call site: 00143	jpeg_enable_lossless
3	204	jinit_compress_master	call site: 00204	jinit_color_converter

Runtime coverage analysis

Covered functions

193

Functions that are reachable but not covered

55

Reachable functions

115

Percentage of reachable functions covered

52.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.3.0.x/fuzz/compress12.cc	1
libjpeg-turbo.3.0.x/turbojpeg.c	10
libjpeg-turbo.3.0.x/jerror.c	1
libjpeg-turbo.3.0.x/jcapimin.c	5
libjpeg-turbo.3.0.x/jmemmgr.c	1
libjpeg-turbo.3.0.x/jmemnobs.c	3
libjpeg-turbo.3.0.x/jdatadst-tj.c	1
libjpeg-turbo.3.0.x/jdapimin.c	2
libjpeg-turbo.3.0.x/jdmarker.c	2
libjpeg-turbo.3.0.x/jdinput.c	1
libjpeg-turbo.3.0.x/jdatasrc-tj.c	1
libjpeg-turbo.3.0.x/turbojpeg-mp.c	2
libjpeg-turbo.3.0.x/rdbmp.c	1
libjpeg-turbo.3.0.x/rdppm.c	1
libjpeg-turbo.3.0.x/jcomapi.c	4
libjpeg-turbo.3.0.x/jcparam.c	12
libjpeg-turbo.3.0.x/jstdhuff.c	2
libjpeg-turbo.3.0.x/jcapistd.c	2
libjpeg-turbo.3.0.x/jcinit.c	1
libjpeg-turbo.3.0.x/jcmaster.c	4
libjpeg-turbo.3.0.x/jutils.c	2
libjpeg-turbo.3.0.x/jccolor.c	3
libjpeg-turbo.3.0.x/jcsample.c	3
libjpeg-turbo.3.0.x/jcprepct.c	4
libjpeg-turbo.3.0.x/simd/x86_64/jsimd.c	12
libjpeg-turbo.3.0.x/jclossls.c	3
libjpeg-turbo.3.0.x/jclhuff.c	1
libjpeg-turbo.3.0.x/jcdiffct.c	3
libjpeg-turbo.3.0.x/jcdctmgr.c	2
libjpeg-turbo.3.0.x/jcarith.c	1
libjpeg-turbo.3.0.x/jcphuff.c	1
libjpeg-turbo.3.0.x/jchuff.c	1
libjpeg-turbo.3.0.x/jccoefct.c	2
libjpeg-turbo.3.0.x/jcmainct.c	3
libjpeg-turbo.3.0.x/jcmarker.c	1

Fuzzer: cjpeg_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	317	81.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	13	3.33%
greenyellow	[30:49]	34	8.71%
lawngreen	50+	26	6.66%
All colors	390	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
134	248	select_file_type(jpeg_compress_struct*, _IO_FILE*)	call site: 00248	jpeg_start_compress
101	138	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00138	read_scan_script
36	41	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00041	fprintf
4	31	jpeg_default_colorspace	call site: 00031	jpeg_set_colorspace
4	82	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00082	fprintf
4	97	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00097	__isoc99_sscanf
4	109	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00109	__isoc99_sscanf
4	123	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00123	__isoc99_sscanf
3	102	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00102	__isoc99_sscanf
2	28	jpeg_set_defaults	call site: 00028	jpeg_set_colorspace
2	87	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00087	fprintf
2	134	parse_switches(jpeg_compress_struct*, int, char**, int, int)	call site: 00134

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

101

Reachable functions

128

Percentage of reachable functions covered

21.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/cjpeg.cc	1
libjpeg-turbo.main/fuzz/..cjpeg.c	4
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.maincdjpeg.c	4
libjpeg-turbo.mainrdswitch.c	9
libjpeg-turbo.mainjdatadst.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	4
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: libjpeg_turbo_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	32.8%
gold	[1:9]	4	1.26%
yellow	[10:29]	1	0.31%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	208	65.6%
All colors	317	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	77	tj3Set	call site: 00077	snprintf
16	150	jpeg_core_output_dimensions	call site: 00150	jdiv_round_up
12	56	tj3Set	call site: 00056	snprintf
12	171	master_selection	call site: 00171	jinit_1pass_quantizer
6	142	jpeg_core_output_dimensions	call site: 00142	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
4	71	tj3Set	call site: 00071	snprintf
4	136	jpeg_core_output_dimensions	call site: 00136	jdiv_round_up
4	210	jsimd_set_ycc_rgb	call site: 00210	build_ycc_rgb_table
3	268	jpeg_crop_scanline	call site: 00268	jinit_upsampler
2	16	jinit_memory_mgr	call site: 00016	jpeg_mem_dest_tj
2	27	_tjInitDecompress	call site: 00027	_tjInitCompress

Runtime coverage analysis

Covered functions

253

Functions that are reachable but not covered

25

Reachable functions

126

Percentage of reachable functions covered

80.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/decompress.cc	1
libjpeg-turbo.devturbojpeg.c	14
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	2
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	7
libjpeg-turbo.devjdmarker.c	3
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devjcomapi.c	3
libjpeg-turbo.devjdicc.c	2
libjpeg-turbo.devturbojpeg-mp.c	3
libjpeg-turbo.devwrapper/../jdapistd.c	11
libjpeg-turbo.devjdmaster.c	6
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jquant1.c	8
libjpeg-turbo.devwrapper/../jquant2.c	3
libjpeg-turbo.devwrapper/../jdmerge.c	3
libjpeg-turbo.dev/simd/jsimd.c	9
libjpeg-turbo.devwrapper/../jdcolor.c	5
libjpeg-turbo.devwrapper/../jdsample.c	3
libjpeg-turbo.devwrapper/../jdpostct.c	3
libjpeg-turbo.devwrapper/../jdlossls.c	3
libjpeg-turbo.devjdlhuff.c	1
libjpeg-turbo.devwrapper/../jddiffct.c	3
libjpeg-turbo.devwrapper/../jddctmgr.c	2
libjpeg-turbo.devjdarith.c	1
libjpeg-turbo.devjdphuff.c	1
libjpeg-turbo.devjdhuff.c	1
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jdcoefct.c	2
libjpeg-turbo.devwrapper/../jdmainct.c	4
libjpeg-turbo.devwrapper/../jdmainct.h	1
libjpeg-turbo.devwrapper/../jdcoefct.h	1

Fuzzer: compress12_lossless_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	160	51.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.97%
lawngreen	50+	145	47.0%
All colors	308	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	191	initial_setup	call site: 00191	jinit_color_converter
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
19	251	jinit_compress_master	call site: 00251	jinit_forward_dct
13	44	tj3Set	call site: 00044	snprintf
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
7	36	tj3Set	call site: 00036	snprintf
7	67	tj3Set	call site: 00067	snprintf
7	243	jinit_compress_master	call site: 00243	jinit_c_diff_controller
4	236	jinit_compress_master	call site: 00236	j16init_color_converter
3	75	tj3Set	call site: 00075	snprintf
3	90	_tj3LoadImageFromFileHandle12	call site: 00090	__errno_location
3	271	jinit_compress_master	call site: 00271	j12init_c_coef_controller

Runtime coverage analysis

Covered functions

163

Functions that are reachable but not covered

61

Reachable functions

119

Percentage of reachable functions covered

48.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress12_lossless.cc	1
libjpeg-turbo.mainturbojpeg.c	11
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_yuv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	125	34.5%
gold	[1:9]	21	5.80%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	216	59.6%
All colors	362	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	280	jinit_compress_master	call site: 00280	jinit_color_converter
17	330	jinit_compress_master	call site: 00330	jpeg_write_icc_profile
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	39	tj3Set	call site: 00039	snprintf
9	65	tj3Set	call site: 00065	snprintf
9	204	initial_setup	call site: 00204	using_std_huff_tables
6	57	tj3Set	call site: 00057	snprintf
5	161	jpeg_default_colorspace	call site: 00161	jpeg_enable_lossless
5	167	setCompDefaults	call site: 00167	jpeg_set_colorspace
5	314	jsimd_can_quantize	call site: 00314	jsimd_can_convsamp_float
3	75	tj3Set	call site: 00075	snprintf
3	93	_tj3LoadImageFromFileHandle8	call site: 00093	__errno_location

Runtime coverage analysis

Covered functions

198

Functions that are reachable but not covered

50

Reachable functions

126

Percentage of reachable functions covered

60.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress_yuv.cc	1
libjpeg-turbo.mainturbojpeg.c	18
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	1
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	3
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress_lossless_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	149	49.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	154	50.8%
All colors	303	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	150	setCompDefaults	call site: 00150	jpeg_simple_progression
20	201	jinit_compress_master	call site: 00201	jsimd_set_rgb_gray
20	245	jinit_c_diff_controller	call site: 00245	jinit_forward_dct
13	44	tj3Set	call site: 00044	snprintf
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	191	initial_setup	call site: 00191	using_std_huff_tables
7	36	tj3Set	call site: 00036	snprintf
7	67	tj3Set	call site: 00067	snprintf
7	227	jinit_compress_master	call site: 00227	j12init_color_converter
4	222	jinit_compress_master	call site: 00222	jsimd_set_h2v1_downsample
3	75	tj3Set	call site: 00075	snprintf
3	90	_tj3LoadImageFromFileHandle8	call site: 00090	__errno_location

Runtime coverage analysis

Covered functions

170

Functions that are reachable but not covered

61

Reachable functions

119

Percentage of reachable functions covered

48.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress_lossless.cc	1
libjpeg-turbo.devturbojpeg.c	11
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: compress12_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	39.6%
gold	[1:9]	21	6.77%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	1.29%
lawngreen	50+	162	52.2%
All colors	310	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	238	jinit_compress_master	call site: 00238	jinit_forward_dct
12	162	setCompDefaults	call site: 00162	jpeg_default_colorspace
12	193	initial_setup	call site: 00193	jinit_color_converter
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	226	init_simd	call site: 00226	jinit_downsampler
8	57	tj3Set	call site: 00057	snprintf
7	67	tj3Set	call site: 00067	snprintf
5	39	tj3Set	call site: 00039	snprintf
3	75	tj3Set	call site: 00075	snprintf
3	93	_tj3LoadImageFromFileHandle12	call site: 00093	__errno_location
3	149	jpeg_default_colorspace	call site: 00149	jpeg_enable_lossless
3	158	setCompDefaults	call site: 00158	jpeg_set_colorspace

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

55

Reachable functions

119

Percentage of reachable functions covered

53.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/compress12.cc	1
libjpeg-turbo.mainturbojpeg.c	11
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	7
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	2
libjpeg-turbo.mainjdmarker.c	2
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainturbojpeg-mp.c	2
libjpeg-turbo.mainrdbmp.c	1
libjpeg-turbo.mainwrapper/../rdppm.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjcparam.c	12
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jcapistd.c	2
libjpeg-turbo.mainjcinit.c	1
libjpeg-turbo.mainjcmaster.c	4
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jccolor.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	12
libjpeg-turbo.mainwrapper/../jcsample.c	3
libjpeg-turbo.mainwrapper/../jcprepct.c	4
libjpeg-turbo.mainwrapper/../jclossls.c	3
libjpeg-turbo.mainjclhuff.c	1
libjpeg-turbo.mainwrapper/../jcdiffct.c	3
libjpeg-turbo.mainwrapper/../jcdctmgr.c	2
libjpeg-turbo.mainjcarith.c	1
libjpeg-turbo.mainjcphuff.c	1
libjpeg-turbo.mainjchuff.c	1
libjpeg-turbo.mainwrapper/../jccoefct.c	2
libjpeg-turbo.mainwrapper/../jcmainct.c	3
libjpeg-turbo.mainjcmarker.c	1
libjpeg-turbo.mainjcicc.c	1

Fuzzer: compress12_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	123	40.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	1.31%
lawngreen	50+	178	58.3%
All colors	305	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	233	jinit_compress_master	call site: 00233	jinit_forward_dct
12	162	setCompDefaults	call site: 00162	jpeg_default_colorspace
12	193	initial_setup	call site: 00193	jinit_color_converter
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	221	init_simd	call site: 00221	jinit_downsampler
8	57	tj3Set	call site: 00057	snprintf
7	67	tj3Set	call site: 00067	snprintf
5	39	tj3Set	call site: 00039	snprintf
3	75	tj3Set	call site: 00075	snprintf
3	93	_tj3LoadImageFromFileHandle12	call site: 00093	__errno_location
3	149	jpeg_default_colorspace	call site: 00149	jpeg_enable_lossless
3	158	setCompDefaults	call site: 00158	jpeg_set_colorspace

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

55

Reachable functions

119

Percentage of reachable functions covered

53.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress12.cc	1
libjpeg-turbo.devturbojpeg.c	11
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: decompress_libjpeg_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	43	22.2%
gold	[1:9]	22	11.3%
yellow	[10:29]	1	0.51%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	127	65.8%
All colors	193	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	47	jpeg_core_output_dimensions	call site: 00047	jdiv_round_up
14	31	jpeg_calc_output_dimensions	call site: 00031	jdiv_round_up
4	104	init_simd	call site: 00104	jsimd_can_h2v1_merged_upsample
3	80	master_selection	call site: 00080	jinit_merged_upsampler
1	5	jinit_memory_mgr	call site: 00005	jpeg_mem_term
1	10	jinit_memory_mgr	call site: 00010	__isoc99_sscanf
1	109	master_selection	call site: 00109	build_rgb_y_table
1	112	jsimd_can_ycc_rgb	call site: 00112	build_ycc_rgb_table
1	166	jpeg_start_decompress	call site: 00166	jpeg_abort_decompress
1	177	jpeg_skip_scanlines	call site: 00177	read_and_discard_scanlines

Runtime coverage analysis

Covered functions

247

Functions that are reachable but not covered

13

Reachable functions

105

Percentage of reachable functions covered

87.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/decompress_libjpeg.cc	2
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjdapimin.c	9
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdmarker.c	4
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjcomapi.c	3
libjpeg-turbo.mainjdatasrc.c	1
libjpeg-turbo.mainwrapper/../jdapistd.c	8
libjpeg-turbo.mainjdmaster.c	6
libjpeg-turbo.mainwrapper/../jutils.c	2
libjpeg-turbo.mainwrapper/../jquant1.c	8
libjpeg-turbo.mainwrapper/../jquant2.c	3
libjpeg-turbo.mainwrapper/../jdmerge.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	9
libjpeg-turbo.mainwrapper/../jdcolor.c	5
libjpeg-turbo.mainwrapper/../jdsample.c	3
libjpeg-turbo.mainwrapper/../jdpostct.c	3
libjpeg-turbo.mainwrapper/../jdlossls.c	3
libjpeg-turbo.mainjdlhuff.c	1
libjpeg-turbo.mainwrapper/../jddiffct.c	3
libjpeg-turbo.mainwrapper/../jddctmgr.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainwrapper/../jdmainct.c	4
libjpeg-turbo.mainwrapper/../jdmainct.h	1
libjpeg-turbo.mainwrapper/../jdcoefct.h	1

Fuzzer: transform_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	102	31.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.61%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	222	68.0%
All colors	326	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	79	tj3Set	call site: 00079	snprintf
15	271	tj3Transform	call site: 00271	do_crop_ext_reflect
14	230	jinit_c_master_control	call site: 00230	using_std_huff_tables
13	58	tj3Set	call site: 00058	snprintf
10	289	jtransform_execute_transform	call site: 00289	do_rot_180
7	143	tj3Transform	call site: 00143	jtransform_perfect_transform
5	198	jtransform_adjust_parameters	call site: 00198	adjust_quant
3	151	jtransform_request_workspace	call site: 00151	trim_right_edge
2	54	tj3Set	call site: 00054	snprintf
1	4	tj3Init	call site: 00004	_tjInitCompress
1	11	jinit_memory_mgr	call site: 00011	jpeg_mem_term
1	16	jinit_memory_mgr	call site: 00016	__isoc99_sscanf

Runtime coverage analysis

Covered functions

217

Functions that are reachable but not covered

30

Reachable functions

125

Percentage of reachable functions covered

76.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/transform.cc	1
libjpeg-turbo.devturbojpeg.c	17
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	8
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	7
libjpeg-turbo.devjdmarker.c	3
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjdicc.c	2
libjpeg-turbo.devtransupp.c	30
libjpeg-turbo.devwrapper/../jutils.c	4
libjpeg-turbo.devjdtrans.c	2
libjpeg-turbo.devjdarith.c	1
libjpeg-turbo.devjdphuff.c	1
libjpeg-turbo.devjdhuff.c	1
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jdcoefct.c	2
libjpeg-turbo.devjctrans.c	4
libjpeg-turbo.devjcparam.c	11
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1

Fuzzer: decompress_yuv_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	103	30.2%
gold	[1:9]	21	6.17%
yellow	[10:29]	1	0.29%
greenyellow	[30:49]	2	0.58%
lawngreen	50+	213	62.6%
All colors	340	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	77	tj3Set	call site: 00077	snprintf
16	164	jpeg_core_output_dimensions	call site: 00164	jdiv_round_up
12	56	tj3Set	call site: 00056	snprintf
12	195	master_selection	call site: 00195	jinit_1pass_quantizer
6	152	jpeg_core_output_dimensions	call site: 00152	jdiv_round_up
5	4	tj3Init	call site: 00004	_tjInitCompress
5	239	jsimd_can_ycc_rgb	call site: 00239	build_ycc_rgb_table
4	71	tj3Set	call site: 00071	snprintf
2	16	jinit_memory_mgr	call site: 00016	jpeg_mem_dest_tj
2	27	_tjInitDecompress	call site: 00027	_tjInitCompress
2	139	tj3DecompressToYUVPlanes8	call site: 00139	jpeg_read_header
2	148	jpeg_calc_output_dimensions	call site: 00148	jdiv_round_up

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

29

Reachable functions

122

Percentage of reachable functions covered

76.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.main/fuzz/decompress_yuv.cc	1
libjpeg-turbo.mainturbojpeg.c	21
libjpeg-turbo.mainjerror.c	1
libjpeg-turbo.mainjcapimin.c	2
libjpeg-turbo.mainjmemmgr.c	1
libjpeg-turbo.mainjmemnobs.c	3
libjpeg-turbo.mainjdatadst-tj.c	1
libjpeg-turbo.mainjdapimin.c	7
libjpeg-turbo.mainjdmarker.c	3
libjpeg-turbo.mainjdinput.c	1
libjpeg-turbo.mainjdatasrc-tj.c	1
libjpeg-turbo.mainjcomapi.c	4
libjpeg-turbo.mainjdicc.c	2
libjpeg-turbo.mainjdmaster.c	6
libjpeg-turbo.mainwrapper/../jutils.c	3
libjpeg-turbo.mainwrapper/../jdapistd.c	3
libjpeg-turbo.mainwrapper/../jquant1.c	8
libjpeg-turbo.mainwrapper/../jquant2.c	3
libjpeg-turbo.mainwrapper/../jdmerge.c	3
libjpeg-turbo.main/simd/x86_64/jsimd.c	9
libjpeg-turbo.mainwrapper/../jdcolor.c	5
libjpeg-turbo.mainwrapper/../jdsample.c	3
libjpeg-turbo.mainwrapper/../jdpostct.c	3
libjpeg-turbo.mainwrapper/../jdlossls.c	3
libjpeg-turbo.mainjdlhuff.c	1
libjpeg-turbo.mainwrapper/../jddiffct.c	3
libjpeg-turbo.mainwrapper/../jddctmgr.c	2
libjpeg-turbo.mainjdarith.c	1
libjpeg-turbo.mainjdphuff.c	1
libjpeg-turbo.mainjdhuff.c	1
libjpeg-turbo.mainjstdhuff.c	2
libjpeg-turbo.mainwrapper/../jdcoefct.c	2
libjpeg-turbo.mainwrapper/../jdmainct.c	4

Fuzzer: compress_fuzzer_dev

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	33.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	202	66.0%
All colors	306	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	230	jinit_compress_master	call site: 00230	j12init_color_converter
11	19	_tjInitCompress	call site: 00019	_tjInitCompress
9	194	initial_setup	call site: 00194	using_std_huff_tables
8	57	tj3Set	call site: 00057	snprintf
7	67	tj3Set	call site: 00067	snprintf
6	175	jpeg_simple_progression	call site: 00175	fill_dc_scans
5	39	tj3Set	call site: 00039	snprintf
5	261	jsimd_set_quantize	call site: 00261	jsimd_set_convsamp_float
3	75	tj3Set	call site: 00075	snprintf
3	94	_tj3LoadImageFromFileHandle8	call site: 00094	__errno_location
3	150	jpeg_default_colorspace	call site: 00150	jpeg_enable_lossless
3	159	setCompDefaults	call site: 00159	jpeg_set_colorspace

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

47

Reachable functions

119

Percentage of reachable functions covered

60.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libjpeg-turbo.dev/fuzz/compress.cc	1
libjpeg-turbo.devturbojpeg.c	11
libjpeg-turbo.devjerror.c	1
libjpeg-turbo.devjcapimin.c	7
libjpeg-turbo.devjmemmgr.c	1
libjpeg-turbo.devjmemnobs.c	3
libjpeg-turbo.devjdatadst-tj.c	1
libjpeg-turbo.devjdapimin.c	2
libjpeg-turbo.devjdmarker.c	2
libjpeg-turbo.devjdinput.c	1
libjpeg-turbo.devjdatasrc-tj.c	1
libjpeg-turbo.devturbojpeg-mp.c	2
libjpeg-turbo.devrdbmp.c	1
libjpeg-turbo.devwrapper/../rdppm.c	1
libjpeg-turbo.devjcomapi.c	4
libjpeg-turbo.devjcparam.c	12
libjpeg-turbo.devjstdhuff.c	2
libjpeg-turbo.devwrapper/../jcapistd.c	2
libjpeg-turbo.devjcinit.c	1
libjpeg-turbo.devjcmaster.c	4
libjpeg-turbo.devwrapper/../jutils.c	2
libjpeg-turbo.devwrapper/../jccolor.c	3
libjpeg-turbo.dev/simd/jsimd.c	12
libjpeg-turbo.devwrapper/../jcsample.c	3
libjpeg-turbo.devwrapper/../jcprepct.c	4
libjpeg-turbo.devwrapper/../jclossls.c	3
libjpeg-turbo.devjclhuff.c	1
libjpeg-turbo.devwrapper/../jcdiffct.c	3
libjpeg-turbo.devwrapper/../jcdctmgr.c	2
libjpeg-turbo.devjcarith.c	1
libjpeg-turbo.devjcphuff.c	1
libjpeg-turbo.devjchuff.c	1
libjpeg-turbo.devwrapper/../jccoefct.c	2
libjpeg-turbo.devwrapper/../jcmainct.c	3
libjpeg-turbo.devjcmarker.c	1
libjpeg-turbo.devjcicc.c	1