High level conclusions

Fuzzers reach 59.90% code coverage.

Fuzzers reach 61.42% of cyclomatic complexity.

Fuzzers reach 49.16% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

206 / 419

Cyclomatic complexity statically reachable by fuzzers

2048 / 3334

Runtime code coverage of functions

251 / 419

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: libpng_read_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	491	69.4%
gold	[1:9]	110	15.5%
yellow	[10:29]	35	4.95%
greenyellow	[30:49]	35	4.95%
lawngreen	50+	36	5.09%
All colors	707	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
198	501	png_image_read_header	call site: 00501	OSS_FUZZ_png_image_finish_read
40	308	OSS_FUZZ_png_calloc	call site: 00308	png_build_16bit_table
32	250	OSS_FUZZ_png_init_read_transformations	call site: 00250	OSS_FUZZ_png_set_rgb_coefficients
22	201	OSS_FUZZ_png_get_IHDR	call site: 00201	OSS_FUZZ_png_destroy_read_struct
14	283	OSS_FUZZ_png_init_read_transformations	call site: 00283	OSS_FUZZ_png_build_gamma_table
11	40	OSS_FUZZ_png_free_data	call site: 00040	OSS_FUZZ_png_free
11	175	OSS_FUZZ_png_chunk_report	call site: 00175	OSS_FUZZ_png_chunk_report
9	158	png_crc_finish_critical	call site: 00158	png_cache_unknown_chunk
8	54	OSS_FUZZ_png_free_data	call site: 00054	OSS_FUZZ_png_free
8	299	OSS_FUZZ_png_malloc	call site: 00299	png_build_16to8_table
8	436	OSS_FUZZ_png_do_read_transformations	call site: 00436	png_do_read_filler
7	428	OSS_FUZZ_png_do_read_transformations	call site: 00428	png_do_quantize

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

95

Reachable functions

207

Percentage of reachable functions covered

54.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc	3
/src/libpng/contrib/oss-fuzz/nalloc.h	4
/src/libpng/png.c	32
/src/libpng/pngread.c	33
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	20
/src/libpng/pngrio.c	2
/src/libpng/pngrtran.c	38
/src/libpng/pngrutil.c	23
/src/libpng/pngset.c	5
/src/libpng/pngget.c	3
/src/libpng/pngtrans.c	13

Fuzzer: libpng_readapi_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	242	54.5%
gold	[1:9]	16	3.60%
yellow	[10:29]	11	2.47%
greenyellow	[30:49]	2	0.45%
lawngreen	50+	173	38.9%
All colors	444	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
40	274	OSS_FUZZ_png_calloc	call site: 00274	png_build_16bit_table
31	216	OSS_FUZZ_png_init_read_transformations	call site: 00216	OSS_FUZZ_png_set_rgb_coefficients
14	249	OSS_FUZZ_png_init_read_transformations	call site: 00249	OSS_FUZZ_png_build_gamma_table
13	191	OSS_FUZZ_png_set_expand	call site: 00191	OSS_FUZZ_png_set_shift
10	391	OSS_FUZZ_png_do_read_transformations	call site: 00391	png_do_compose
9	140	png_crc_finish_critical	call site: 00140	png_cache_unknown_chunk
9	264	OSS_FUZZ_png_malloc	call site: 00264	png_build_16to8_table
8	157	OSS_FUZZ_png_chunk_report	call site: 00157	OSS_FUZZ_png_chunk_report
8	179	OSS_FUZZ_png_set_scale_16	call site: 00179	OSS_FUZZ_png_set_strip_16
8	410	OSS_FUZZ_png_do_read_transformations	call site: 00410	png_do_read_filler
7	402	OSS_FUZZ_png_do_read_transformations	call site: 00402	png_do_quantize
6	342	OSS_FUZZ_png_read_image	call site: 00342	OSS_FUZZ_png_read_start_row

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

61

Reachable functions

156

Percentage of reachable functions covered

60.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/libpng/contrib/oss-fuzz/libpng_readapi_fuzzer.cc	3
/src/libpng/pngread.c	12
/src/libpng/png.c	28
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	17
/src/libpng/pngrio.c	2
/src/libpng/pngrutil.c	23
/src/libpng/pngset.c	2
/src/libpng/pngrtran.c	32
/src/libpng/pngtrans.c	15

Fuzzer: libpng_colormap_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	249	40.7%
gold	[1:9]	7	1.14%
yellow	[10:29]	2	0.32%
greenyellow	[30:49]	36	5.89%
lawngreen	50+	317	51.8%
All colors	611	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	245	OSS_FUZZ_png_set_rgb_to_gray_fixed	call site: 00245	make_ga_colormap
15	264	png_image_read_colormap	call site: 00264	make_rgb_colormap
13	397	OSS_FUZZ_png_build_gamma_table	call site: 00397	OSS_FUZZ_png_warning
10	44	OSS_FUZZ_png_free_data	call site: 00044	OSS_FUZZ_png_free
9	153	png_crc_finish_critical	call site: 00153	png_cache_unknown_chunk
9	235	make_ga_colormap	call site: 00235	make_gray_colormap
8	170	OSS_FUZZ_png_chunk_report	call site: 00170	OSS_FUZZ_png_chunk_report
8	221	make_gray_colormap	call site: 00221	png_create_colormap_entry
6	10	OSS_FUZZ_png_create_png_struct	call site: 00010	OSS_FUZZ_png_safecat
6	280	png_image_read_colormap	call site: 00280	png_create_colormap_entry
6	421	OSS_FUZZ_png_init_read_transformations	call site: 00421	OSS_FUZZ_png_gamma_correct
6	451	png_image_read_and_map	call site: 00451	OSS_FUZZ_png_read_start_row

Runtime coverage analysis

Covered functions

218

Functions that are reachable but not covered

41

Reachable functions

185

Percentage of reachable functions covered

77.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/libpng/contrib/oss-fuzz/libpng_colormap_fuzzer.cc	2
/src/libpng/pngread.c	32
/src/libpng/png.c	30
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	18
/src/libpng/pngrio.c	2
/src/libpng/pngset.c	5
/src/libpng/pngrutil.c	23
/src/libpng/pngrtran.c	37
/src/libpng/pngtrans.c	13
/src/libpng/pngget.c	2

Fuzzer: libpng_transformations_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	285	39.4%
gold	[1:9]	5	0.69%
yellow	[10:29]	28	3.87%
greenyellow	[30:49]	8	1.10%
lawngreen	50+	397	54.9%
All colors	723	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	511	OSS_FUZZ_png_set_rgb_to_gray_fixed	call site: 00511	make_ga_colormap
15	530	png_image_read_colormap	call site: 00530	make_rgb_colormap
13	299	OSS_FUZZ_png_build_gamma_table	call site: 00299	OSS_FUZZ_png_warning
10	34	OSS_FUZZ_png_free_data	call site: 00034	OSS_FUZZ_png_free
9	139	png_crc_finish_critical	call site: 00139	png_cache_unknown_chunk
9	501	make_ga_colormap	call site: 00501	make_gray_colormap
9	682	OSS_FUZZ_png_read_png	call site: 00682	OSS_FUZZ_png_set_shift
8	156	OSS_FUZZ_png_chunk_report	call site: 00156	OSS_FUZZ_png_chunk_report
6	191	OSS_FUZZ_png_malloc	call site: 00191	OSS_FUZZ_png_calloc
6	323	OSS_FUZZ_png_init_read_transformations	call site: 00323	OSS_FUZZ_png_gamma_correct
6	348	test_png_transformations(unsigned char const*, unsigned long)	call site: 00348	OSS_FUZZ_png_read_start_row
6	546	png_image_read_colormap	call site: 00546	png_create_colormap_entry

Runtime coverage analysis

Covered functions

243

Functions that are reachable but not covered

40

Reachable functions

211

Percentage of reachable functions covered

81.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/libpng/contrib/oss-fuzz/libpng_transformations_fuzzer.cc	5
/src/libpng/pngread.c	36
/src/libpng/png.c	31
/src/libpng/pngmem.c	10
/src/libpng/pngerror.c	21
/src/libpng/pngrio.c	2
/src/libpng/pngrutil.c	23
/src/libpng/pngset.c	5
/src/libpng/pngget.c	6
/src/libpng/pngrtran.c	41
/src/libpng/pngtrans.c	17

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
png_handle_iCCP	/src/libpng/pngrutil.c	3	['N/A', 'N/A', 'int']	9	0	533	79	28	41	0	257	93
png_handle_iTXt	/src/libpng/pngrutil.c	3	['N/A', 'N/A', 'int']	8	0	468	80	28	36	0	233	86
OSS_FUZZ_png_set_sCAL	/src/libpng/pngset.c	5	['N/A', 'N/A', 'int', 'double', 'double']	5	0	60	9	4	17	0	118	79
png_handle_pCAL	/src/libpng/pngrutil.c	3	['N/A', 'N/A', 'int']	8	0	485	64	23	27	0	155	43
OSS_FUZZ_png_check_keyword	/src/libpng/pngset.c	3	['N/A', 'N/A', 'N/A']	3	0	237	46	17	7	0	61	39

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

234 / 419

Cyclomatic complexity statically reachable by fuzzers

2382 / 3334

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['png_image_read_header', 'OSS_FUZZ_png_calloc', 'OSS_FUZZ_png_init_read_transformations', 'OSS_FUZZ_png_get_IHDR', 'OSS_FUZZ_png_free_data', 'OSS_FUZZ_png_chunk_report', 'png_crc_finish_critical', 'OSS_FUZZ_png_malloc']

/src/libpng/contrib/oss-fuzz/libpng_readapi_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['OSS_FUZZ_png_calloc', 'OSS_FUZZ_png_init_read_transformations', 'OSS_FUZZ_png_set_expand', 'OSS_FUZZ_png_do_read_transformations', 'png_crc_finish_critical', 'OSS_FUZZ_png_malloc', 'OSS_FUZZ_png_chunk_report', 'OSS_FUZZ_png_set_scale_16']

/src/libpng/contrib/oss-fuzz/libpng_colormap_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['OSS_FUZZ_png_set_rgb_to_gray_fixed', 'png_image_read_colormap', 'OSS_FUZZ_png_build_gamma_table', 'OSS_FUZZ_png_free_data', 'png_crc_finish_critical', 'make_ga_colormap', 'OSS_FUZZ_png_chunk_report', 'make_gray_colormap', 'OSS_FUZZ_png_create_png_struct']

/src/libpng/contrib/oss-fuzz/libpng_transformations_fuzzer.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['OSS_FUZZ_png_set_rgb_to_gray_fixed', 'png_image_read_colormap', 'OSS_FUZZ_png_build_gamma_table', 'OSS_FUZZ_png_free_data', 'png_crc_finish_critical', 'make_ga_colormap', 'OSS_FUZZ_png_read_png', 'OSS_FUZZ_png_chunk_report', 'OSS_FUZZ_png_malloc', 'OSS_FUZZ_png_init_read_transformations']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
OSS_FUZZ_png_user_version_check	34	17	50.0%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
OSS_FUZZ_png_format_number	46	20	43.47%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
OSS_FUZZ_png_set_crc_action	50	20	40.0%	['libpng_read_fuzzer']
png_init_rgb_transformations	50	16	32.0%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
OSS_FUZZ_png_handle_unknown	86	26	30.23%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
OSS_FUZZ_png_combine_row	252	115	45.63%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
OSS_FUZZ_png_do_read_interlace	199	34	17.08%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
png_image_read_colormap	455	194	42.63%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer']
png_create_colormap_entry	149	73	48.99%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer']
png_image_read_background	192	83	43.22%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer']
OSS_FUZZ_png_set_rgb_to_gray_fixed	36	17	47.22%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer']
png_do_read_filler	162	54	33.33%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
OSS_FUZZ_png_do_check_palette_indexes	67	20	29.85%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
OSS_FUZZ_png_set_quantize	284	25	8.802%	['libpng_transformations_fuzzer']
png_do_quantize	70	13	18.57%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']
png_do_read_swap_alpha	78	40	51.28%	['libpng_transformations_fuzzer', 'libpng_colormap_fuzzer', 'libpng_read_fuzzer', 'libpng_readapi_fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libpng/contrib/oss-fuzz/nalloc.h	['libpng_read_fuzzer']	['libpng_read_fuzzer']
/src/libpng/pngerror.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/usr/local/bin/../include/c++/v1/stdexcept	[]	[]
/src/libpng/pngget.c	['libpng_read_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/pngrtran.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/pngtrans.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/pngrio.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/pngmem.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/pngread.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/contrib/oss-fuzz/libpng_readapi_fuzzer.cc	['libpng_readapi_fuzzer']	['libpng_readapi_fuzzer']
/src/libpng/contrib/oss-fuzz/libpng_colormap_fuzzer.cc	['libpng_colormap_fuzzer']	['libpng_colormap_fuzzer']
/src/libpng/pngrutil.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc	['libpng_read_fuzzer']	['libpng_read_fuzzer']
/src/libpng/png.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/pngset.c	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']	['libpng_read_fuzzer', 'libpng_readapi_fuzzer', 'libpng_colormap_fuzzer', 'libpng_transformations_fuzzer']
/src/libpng/contrib/oss-fuzz/libpng_transformations_fuzzer.cc	['libpng_transformations_fuzzer']	['libpng_transformations_fuzzer']

Directories in report

Directory
/usr/local/bin/../include/c++/v1/
/src/libpng/
/src/libpng/contrib/oss-fuzz/