Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues
Project coverage
Per-fuzzer coverage

Table of contents

Project overview: libprotobuf-mutator
High level conclusions
Reachability and coverage overview
Fuzzers overview
Project functions overview
Fuzzer details
Fuzzer: expat_example
Call tree
Fuzz blockers
Runtime coverage analysis
Files reached
Fuzzer: libxml2_example
Call tree
Fuzz blockers
Runtime coverage analysis
Files reached
Analyses and suggestions
Optimal target analysis
Remaining optimal interesting functions
All functions overview
Runtime coverage analysis
Complex functions with low coverage
Files and Directories in report
Files in report
Directories in report
Metadata section
Function call coverage
Function in each files in report
Report generation date: 2023-03-26

Project overview: libprotobuf-mutator

High level conclusions

Reachability and coverage overview

Functions statically reachable by fuzzers
39.3%
3433/8722
Cyclomatic complexity statically reachable by fuzzers
37.7%
21059/55853
Runtime code coverage of functions
25.0%
2217 / 8722

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
expat_example /src/libprotobuf-mutator/examples/expat/expat_example.cc 5291 3418 41 105 12476 9151 expat_example.cc
libxml2_example /src/libprotobuf-mutator/examples/libxml2/libxml2_example.cc 6054 5102 41 126 39229 19353 libxml2_example.cc

Project functions overview

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzzer details

Fuzzer: expat_example

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 4196 70.9%
gold [1:9] 518 8.75%
yellow [10:29] 89 1.50%
greenyellow [30:49] 114 1.92%
lawngreen 50+ 997 16.8%
All colors 5914 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
14190 28147 8 :

['std::__1::basic_string , std::__1::allocator >::basic_string(std::__1::basic_string , std::__1::allocator >&&)', 'google::protobuf::TextFormat::Parser::ParserImpl::ConsumeAnyTypeUrl(std::__1::basic_string , std::__1::allocator >*, std::__1::basic_string , std::__1::allocator >*)', 'google::protobuf::Reflection::SetString(google::protobuf::Message*, google::protobuf::FieldDescriptor const*, std::__1::basic_string , std::__1::allocator >) const', 'std::__1::remove_reference , std::__1::allocator >&>::type&& std::__1::move , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)', 'google::protobuf::StrCat(google::protobuf::strings::AlphaNum const&, google::protobuf::strings::AlphaNum const&)', 'google::protobuf::TextFormat::Parser::ParserImpl::ConsumeAnyValue(google::protobuf::Descriptor const*, std::__1::basic_string , std::__1::allocator >*)', 'google::protobuf::strings::AlphaNum::AlphaNum(std::__1::basic_string , std::__1::allocator > const&)', 'google::protobuf::(anonymous namespace)::DefaultFinderFindAnyType(google::protobuf::Message const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)']

14190 43048 google::protobuf::TextFormat::Parser::ParserImpl::ConsumeField(google::protobuf::Message*) call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.cc:426
13948 13948 3 :

['google::protobuf::FileDescriptor::dependency(int) const', 'google::protobuf::FileDescriptor::dependency_count() const', 'google::protobuf::DescriptorBuilder::RecordPublicDependencies(google::protobuf::FileDescriptor const*)']

35894 44418 google::protobuf::DescriptorBuilder::BuildFileImpl(google::protobuf::FileDescriptorProtoconst&,google::protobuf::internal::FlatAllocator&) call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.cc:5265
13932 13948 6 :

['google::protobuf::FieldDescriptor::is_extension() const', 'google::protobuf::Message const* const& google::protobuf::Reflection::DefaultRaw (google::protobuf::FieldDescriptor const*) const', 'google::protobuf::Reflection::IsLazyField(google::protobuf::FieldDescriptor const*) const', 'google::protobuf::FieldOptions::weak() const', 'google::protobuf::FieldDescriptor::options() const', 'google::protobuf::internal::ReflectionSchema::InRealOneof(google::protobuf::FieldDescriptor const*) const']

13932 20916 google::protobuf::Reflection::GetDefaultMessageInstance(google::protobuf::FieldDescriptorconst*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:1956
7063 7063 2 :

['google::protobuf::internal::MapFieldBase::MutableRepeatedField()', 'google::protobuf::internal::MapFieldBase* google::protobuf::Reflection::MutableRaw (google::protobuf::Message*, google::protobuf::FieldDescriptor const*) const']

7063 14148 google::protobuf::Reflection::AddMessage(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,google::protobuf::MessageFactory*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2214
7063 7063 2 :

['google::protobuf::internal::MapFieldBase::MutableRepeatedField()', 'google::protobuf::internal::MapFieldBase* google::protobuf::Reflection::MutableRaw (google::protobuf::Message*, google::protobuf::FieldDescriptor const*) const']

7063 7067 google::protobuf::Reflection::MutableRepeatedMessage(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,int)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2187
7063 7063 3 :

['google::protobuf::internal::MapFieldBase::GetRepeatedField() const', 'google::protobuf::internal::MapFieldBase const& google::protobuf::Reflection::GetRaw (google::protobuf::Message const&, google::protobuf::FieldDescriptor const*) const', 'google::protobuf::internal::MapFieldBase::IsRepeatedFieldValid() const']

7063 7065 google::protobuf::Reflection::FieldSize(google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:1203
7059 7059 2 :

['google::protobuf::internal::MapFieldBase::GetRepeatedField() const', 'google::protobuf::internal::MapFieldBase const& google::protobuf::Reflection::GetRaw (google::protobuf::Message const&, google::protobuf::FieldDescriptor const*) const']

7059 7063 google::protobuf::Reflection::GetRepeatedMessage(google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*,int)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2165
7012 7012 4 :

['google::protobuf::Descriptor::FindFieldByNumber(int) const', 'google::protobuf::Descriptor::IsReservedNumber(int) const', 'google::protobuf::(anonymous namespace)::DefaultFinderFindExtensionByNumber(google::protobuf::Descriptor const*, int)', 'google::protobuf::Descriptor::IsExtensionNumber(int) const']

13994 87637 google::protobuf::TextFormat::Parser::ParserImpl::ConsumeField(google::protobuf::Message*) call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.cc:492
7010 7010 5 :

['google::protobuf::internal::InlinedStringField* google::protobuf::Reflection::MutableField (google::protobuf::Message*, google::protobuf::FieldDescriptor const*) const', 'google::protobuf::Reflection::IsInlinedStringDonated(google::protobuf::Message const&, google::protobuf::FieldDescriptor const*) const', 'google::protobuf::Reflection::MutableInlinedStringDonatedArray(google::protobuf::Message*) const', 'google::protobuf::internal::InlinedStringField::Set(std::__1::basic_string , std::__1::allocator > const&, google::protobuf::Arena*, bool, unsigned int*, unsigned int, google::protobuf::MessageLite*)', 'google::protobuf::internal::ReflectionSchema::InlinedStringIndex(google::protobuf::FieldDescriptor const*) const']

7010 7014 google::protobuf::Reflection::SetString(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,std::__1::basic_string ,std::__1::allocator >)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:1698
6975 6975 2 :

['google::protobuf::OneofDescriptor::field(int) const', 'google::protobuf::Reflection::ClearField(google::protobuf::Message*, google::protobuf::FieldDescriptor const*) const']

6975 6975 google::protobuf::Reflection::ClearOneof(google::protobuf::Message*,google::protobuf::OneofDescriptorconst*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2680
6974 6974 2 :

['google::protobuf::Reflection::MutableExtensionSet(google::protobuf::Message*) const', 'google::protobuf::internal::ExtensionSet::AddMessage(google::protobuf::FieldDescriptor const*, google::protobuf::MessageFactory*)']

6974 6974 google::protobuf::Reflection::AddMessage(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,google::protobuf::MessageFactory*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2205
6973 6973 2 :

['google::protobuf::Reflection::MutableExtensionSet(google::protobuf::Message*) const', 'google::protobuf::internal::ExtensionSet::MutableMessage(google::protobuf::FieldDescriptor const*, google::protobuf::MessageFactory*)']

6973 6973 google::protobuf::Reflection::MutableMessage(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,google::protobuf::MessageFactory*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2014

Runtime coverage analysis

Covered functions
1758
Functions that are reachable but not covered
3201
Reachable functions
5291
Percentage of reachable functions covered
39.5%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/libprotobuf-mutator/examples/expat/expat_example.cc 2
/src/libprotobuf-mutator/build/examples/xml/xml.pb.h 60
/src/libprotobuf-mutator/build/examples/xml/xml.pb.cc 12
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/message.h 5
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/message_lite.h 6
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/metadata_lite.h 11
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/generated_message_util.h 1
/src/libprotobuf-mutator/src/libfuzzer/libfuzzer_macro.cc 4
/src/libprotobuf-mutator/src/binary_format.cc 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message_lite.cc 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message_lite.h 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringpiece.h 15
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/coded_stream.h 33
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/parse_context.h 13
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/common.cc 5
/src/libprotobuf-mutator/src/text_format.cc 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.cc 73
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/text_format.h 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/strutil.h 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/strutil.cc 32
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream_impl_lite.cc 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream.h 4
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/tokenizer.h 11
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/tokenizer.cc 56
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringprintf.cc 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any.cc 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.h 84
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.cc 272
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/descriptor.h 26
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/mutex.h 8
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.pb.h 351
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.pb.cc 48
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_ptr_field.h 119
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/repeated_ptr_field.h 14
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_field.h 56
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arenastring.h 5
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/map_util.h 10
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenastring.cc 8
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenastring.h 13
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arena_impl.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena.cc 17
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena_impl.h 22
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenaz_sampler.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena.h 7
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/once.h 4
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/port.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_ptr_field.cc 4
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set.cc 45
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set.h 14
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format_lite.h 7
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arena.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/port.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/casts.h 5
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/stubs/once.h 1
/usr/local/bin/../include/c++/v1/math.h 4
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/unknown_field_set.h 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/unknown_field_set.cc 17
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/unknown_field_set.h 13
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stl_util.h 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream_impl_lite.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_util.h 5
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_util.cc 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/explicitly_constructed.h 6
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/explicitly_constructed.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringpiece.cc 7
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/substitute.h 6
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/substitute.cc 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/dynamic_message.cc 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message.h 34
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc 160
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.h 21
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/descriptor.pb.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map_field.cc 7
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map_field.h 34
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set_heavy.cc 6
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message.cc 7
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/coded_stream.cc 23
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format.cc 4
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/wire_format_lite.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor_database.cc 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor_database.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map.h 4
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.h 18
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any_lite.cc 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/inlined_string_field.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/parse_context.cc 1
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/io/coded_stream.h 4
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/stubs/port.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format.h 1
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/repeated_field.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/strtod.cc 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/reflection_ops.cc 3
/src/libprotobuf-mutator/src/libfuzzer/libfuzzer_mutator.h 1
/src/libprotobuf-mutator/src/mutator.h 2
/src/libprotobuf-mutator/src/mutator.cc 8
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/any.pb.h 5
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any.pb.cc 3
/src/libprotobuf-mutator/src/field_instance.h 2
/src/libprotobuf-mutator/examples/xml/xml_writer.cc 9
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/xmlparse.c 86
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/xmltok.c 6
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/./siphash.h 4
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/xmlrole.c 48
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/./xmltok_ns.c 5
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/./xmltok_impl.c 1

Fuzzer: libxml2_example

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 5995 61.6%
gold [1:9] 552 5.67%
yellow [10:29] 164 1.68%
greenyellow [30:49] 110 1.13%
lawngreen 50+ 2909 29.8%
All colors 9730 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
14190 28147 8 :

['std::__1::basic_string , std::__1::allocator >::basic_string(std::__1::basic_string , std::__1::allocator >&&)', 'google::protobuf::TextFormat::Parser::ParserImpl::ConsumeAnyTypeUrl(std::__1::basic_string , std::__1::allocator >*, std::__1::basic_string , std::__1::allocator >*)', 'google::protobuf::Reflection::SetString(google::protobuf::Message*, google::protobuf::FieldDescriptor const*, std::__1::basic_string , std::__1::allocator >) const', 'std::__1::remove_reference , std::__1::allocator >&>::type&& std::__1::move , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)', 'google::protobuf::StrCat(google::protobuf::strings::AlphaNum const&, google::protobuf::strings::AlphaNum const&)', 'google::protobuf::TextFormat::Parser::ParserImpl::ConsumeAnyValue(google::protobuf::Descriptor const*, std::__1::basic_string , std::__1::allocator >*)', 'google::protobuf::strings::AlphaNum::AlphaNum(std::__1::basic_string , std::__1::allocator > const&)', 'google::protobuf::(anonymous namespace)::DefaultFinderFindAnyType(google::protobuf::Message const&, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)']

14190 43048 google::protobuf::TextFormat::Parser::ParserImpl::ConsumeField(google::protobuf::Message*) call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.cc:426
13948 13948 3 :

['google::protobuf::FileDescriptor::dependency(int) const', 'google::protobuf::FileDescriptor::dependency_count() const', 'google::protobuf::DescriptorBuilder::RecordPublicDependencies(google::protobuf::FileDescriptor const*)']

35894 44418 google::protobuf::DescriptorBuilder::BuildFileImpl(google::protobuf::FileDescriptorProtoconst&,google::protobuf::internal::FlatAllocator&) call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.cc:5265
13932 13948 6 :

['google::protobuf::FieldDescriptor::is_extension() const', 'google::protobuf::Message const* const& google::protobuf::Reflection::DefaultRaw (google::protobuf::FieldDescriptor const*) const', 'google::protobuf::Reflection::IsLazyField(google::protobuf::FieldDescriptor const*) const', 'google::protobuf::FieldOptions::weak() const', 'google::protobuf::FieldDescriptor::options() const', 'google::protobuf::internal::ReflectionSchema::InRealOneof(google::protobuf::FieldDescriptor const*) const']

13932 20916 google::protobuf::Reflection::GetDefaultMessageInstance(google::protobuf::FieldDescriptorconst*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:1956
7063 7063 2 :

['google::protobuf::internal::MapFieldBase::MutableRepeatedField()', 'google::protobuf::internal::MapFieldBase* google::protobuf::Reflection::MutableRaw (google::protobuf::Message*, google::protobuf::FieldDescriptor const*) const']

7063 14148 google::protobuf::Reflection::AddMessage(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,google::protobuf::MessageFactory*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2214
7063 7063 2 :

['google::protobuf::internal::MapFieldBase::MutableRepeatedField()', 'google::protobuf::internal::MapFieldBase* google::protobuf::Reflection::MutableRaw (google::protobuf::Message*, google::protobuf::FieldDescriptor const*) const']

7063 7067 google::protobuf::Reflection::MutableRepeatedMessage(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,int)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2187
7063 7063 3 :

['google::protobuf::internal::MapFieldBase::GetRepeatedField() const', 'google::protobuf::internal::MapFieldBase const& google::protobuf::Reflection::GetRaw (google::protobuf::Message const&, google::protobuf::FieldDescriptor const*) const', 'google::protobuf::internal::MapFieldBase::IsRepeatedFieldValid() const']

7063 7065 google::protobuf::Reflection::FieldSize(google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:1203
7059 7059 2 :

['google::protobuf::internal::MapFieldBase::GetRepeatedField() const', 'google::protobuf::internal::MapFieldBase const& google::protobuf::Reflection::GetRaw (google::protobuf::Message const&, google::protobuf::FieldDescriptor const*) const']

7059 7063 google::protobuf::Reflection::GetRepeatedMessage(google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*,int)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2165
7012 7012 4 :

['google::protobuf::Descriptor::FindFieldByNumber(int) const', 'google::protobuf::Descriptor::IsReservedNumber(int) const', 'google::protobuf::(anonymous namespace)::DefaultFinderFindExtensionByNumber(google::protobuf::Descriptor const*, int)', 'google::protobuf::Descriptor::IsExtensionNumber(int) const']

13994 87637 google::protobuf::TextFormat::Parser::ParserImpl::ConsumeField(google::protobuf::Message*) call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.cc:492
7010 7010 5 :

['google::protobuf::internal::InlinedStringField* google::protobuf::Reflection::MutableField (google::protobuf::Message*, google::protobuf::FieldDescriptor const*) const', 'google::protobuf::Reflection::IsInlinedStringDonated(google::protobuf::Message const&, google::protobuf::FieldDescriptor const*) const', 'google::protobuf::Reflection::MutableInlinedStringDonatedArray(google::protobuf::Message*) const', 'google::protobuf::internal::InlinedStringField::Set(std::__1::basic_string , std::__1::allocator > const&, google::protobuf::Arena*, bool, unsigned int*, unsigned int, google::protobuf::MessageLite*)', 'google::protobuf::internal::ReflectionSchema::InlinedStringIndex(google::protobuf::FieldDescriptor const*) const']

7010 7014 google::protobuf::Reflection::SetString(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,std::__1::basic_string ,std::__1::allocator >)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:1698
6975 6975 2 :

['google::protobuf::OneofDescriptor::field(int) const', 'google::protobuf::Reflection::ClearField(google::protobuf::Message*, google::protobuf::FieldDescriptor const*) const']

6975 6975 google::protobuf::Reflection::ClearOneof(google::protobuf::Message*,google::protobuf::OneofDescriptorconst*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2680
6974 6974 2 :

['google::protobuf::Reflection::MutableExtensionSet(google::protobuf::Message*) const', 'google::protobuf::internal::ExtensionSet::AddMessage(google::protobuf::FieldDescriptor const*, google::protobuf::MessageFactory*)']

6974 6974 google::protobuf::Reflection::AddMessage(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,google::protobuf::MessageFactory*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2205
6973 6973 2 :

['google::protobuf::Reflection::MutableExtensionSet(google::protobuf::Message*) const', 'google::protobuf::internal::ExtensionSet::MutableMessage(google::protobuf::FieldDescriptor const*, google::protobuf::MessageFactory*)']

6973 6973 google::protobuf::Reflection::MutableMessage(google::protobuf::Message*,google::protobuf::FieldDescriptorconst*,google::protobuf::MessageFactory*)const call site: 00000 /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc:2014

Runtime coverage analysis

Covered functions
2088
Functions that are reachable but not covered
3573
Reachable functions
6054
Percentage of reachable functions covered
40.98%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/libprotobuf-mutator/examples/libxml2/libxml2_example.cc 6
/src/libprotobuf-mutator/build/examples/xml/xml.pb.h 60
/src/libprotobuf-mutator/build/examples/xml/xml.pb.cc 12
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/message.h 5
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/message_lite.h 6
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/metadata_lite.h 11
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/generated_message_util.h 1
/src/libprotobuf-mutator/src/libfuzzer/libfuzzer_macro.cc 4
/src/libprotobuf-mutator/src/binary_format.cc 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message_lite.cc 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message_lite.h 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringpiece.h 15
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/coded_stream.h 33
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/parse_context.h 13
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/common.cc 5
/src/libprotobuf-mutator/src/text_format.cc 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.cc 73
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/text_format.h 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/strutil.h 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/strutil.cc 32
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream_impl_lite.cc 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream.h 4
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/tokenizer.h 11
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/tokenizer.cc 56
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringprintf.cc 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any.cc 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.h 84
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.cc 272
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/descriptor.h 26
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/mutex.h 8
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.pb.h 351
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.pb.cc 48
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_ptr_field.h 119
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/repeated_ptr_field.h 14
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_field.h 56
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arenastring.h 5
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/map_util.h 10
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenastring.cc 8
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenastring.h 13
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arena_impl.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena.cc 17
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena_impl.h 22
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenaz_sampler.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena.h 7
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/once.h 4
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/port.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_ptr_field.cc 4
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set.cc 45
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set.h 14
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format_lite.h 7
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arena.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/port.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/casts.h 5
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/stubs/once.h 1
/usr/local/bin/../include/c++/v1/math.h 4
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/unknown_field_set.h 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/unknown_field_set.cc 17
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/unknown_field_set.h 13
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stl_util.h 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream_impl_lite.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_util.h 5
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_util.cc 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/explicitly_constructed.h 6
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/explicitly_constructed.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringpiece.cc 7
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/substitute.h 6
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/substitute.cc 3
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/dynamic_message.cc 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message.h 34
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc 160
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.h 21
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/descriptor.pb.h 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map_field.cc 7
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map_field.h 34
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set_heavy.cc 6
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message.cc 7
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/coded_stream.cc 23
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format.cc 4
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/wire_format_lite.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor_database.cc 21
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor_database.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map.h 4
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.h 18
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any_lite.cc 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/inlined_string_field.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/parse_context.cc 1
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/io/coded_stream.h 4
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/stubs/port.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format.h 1
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/repeated_field.h 1
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/strtod.cc 2
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/reflection_ops.cc 3
/src/libprotobuf-mutator/src/libfuzzer/libfuzzer_mutator.h 1
/src/libprotobuf-mutator/src/mutator.h 2
/src/libprotobuf-mutator/src/mutator.cc 8
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/any.pb.h 5
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any.pb.cc 3
/src/libprotobuf-mutator/src/field_instance.h 2
/src/libprotobuf-mutator/examples/xml/xml_writer.cc 9
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/error.c 14
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/globals.c 24
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/threads.c 13
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/parser.c 122
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlmemory.c 1
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/dict.c 12
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/encoding.c 14
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/SAX2.c 43
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlstring.c 18
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/tree.c 101
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/valid.c 96
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/hash.c 25
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/entities.c 21
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlIO.c 25
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xpath.c 1
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/parserInternals.c 26
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/buf.c 23
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/list.c 9
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlregexp.c 54
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/chvalid.c 1
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/uri.c 32
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xzlib.c 2
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlunicode.c 37
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/HTMLtree.c 8
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/catalog.c 11
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/HTMLparser.c 4
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlsave.c 31

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name Functions filename Arg count Args Function depth hitcount instr count bb count cyclomatic complexity Reachable functions Incoming references total cyclomatic complexity Unreached complexity
xmlShell /src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/debugXML.c 4 ['struct._xmlDoc *', 'char *', 'func_type *', 'struct._IO_FILE *'] 85 0 2165 300 86 1592 0 23010 10953
xmlTextReaderSchemaValidate /src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlreader.c 2 ['struct._xmlTextReader *', 'char *'] 104 0 20 3 2 1362 0 19762 4828
xmlTextReaderNextTree /src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlreader.c 1 ['struct._xmlTextReader *'] 107 0 192 24 11 1233 3 17381 1627
protobuf_mutator::libfuzzer::(anonymousnamespace)::CrossOverMessages(unsignedint,protobuf_mutator::libfuzzer::(anonymousnamespace)::InputReaderconst&,protobuf_mutator::libfuzzer::(anonymousnamespace)::InputReaderconst&,protobuf_mutator::libfuzzer::(anonymousnamespace)::OutputWriter*,google::protobuf::Message*,google::protobuf::Message*) /src/libprotobuf-mutator/src/libfuzzer/libfuzzer_macro.cc 6 ['int ', 'class.protobuf_mutator::libfuzzer::(anonymous namespace)::InputReader *', 'class.protobuf_mutator::libfuzzer::(anonymous namespace)::InputReader *', 'class.protobuf_mutator::libfuzzer::(anonymous namespace)::InputReader *', 'class.google::protobuf::Message *', 'class.google::protobuf::Message *'] 35 0 37 3 2 5540 2 8076 1020
google::protobuf::internal::WireFormat::_InternalParse(google::protobuf::Message*,charconst*,google::protobuf::internal::ParseContext*) /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format.cc 3 ['class.google::protobuf::Message *', 'char *', 'class.google::protobuf::internal::ParseContext.724 *'] 233 0 98 17 11 5203 1 7656 605
google::protobuf::util::MessageDifferencer::CompareRepeatedRep(google::protobuf::Messageconst&,google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*,std::__1::vector >*) /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/util/message_differencer.cc 5 ['class.google::protobuf::util::MessageDifferencer *', 'class.google::protobuf::Message *', 'class.google::protobuf::Message *', 'class.google::protobuf::FieldDescriptor *', 'class.std::__1::vector.168 *'] 234 0 398 74 51 5028 15 7467 499
google::protobuf::FileDescriptorSet::ByteSizeLong()const /src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.pb.cc 1 ['class.google::protobuf::SourceCodeInfo *'] 8 0 42 3 3 584 0 701 445

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers
59.4%
5187/8722
Cyclomatic complexity statically reachable by fuzzers
73.3%
40956 / 55853

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Runtime coverage analysis

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name Function total lines Lines covered at runtime percentage covered Reached by fuzzers
XML_Parse 58 18 31.03% ['expat_example']
XML_ParseBuffer 55 30 54.54% ['expat_example']
XML_GetBuffer 90 47 52.22% ['expat_example']
handleUnknownEncoding 32 4 12.5% ['expat_example']
doProlog 911 469 51.48% ['expat_example']
processXmlDecl 80 26 32.5% ['expat_example']
is_rfc3986_uri_char 92 6 6.521% ['expat_example']
storeRawNames 32 5 15.62% ['expat_example']
storeEntityValue 147 74 50.34% ['expat_example']
initScan 76 22 28.94% ['expat_example']
big2_prologTok 236 19 8.050% []
google::protobuf::DescriptorBuilder::AddSymbol(std::__1::basic_string ,std::__1::allocator >const&,voidconst*,std::__1::basic_string ,std::__1::allocator >const&,google::protobuf::Messageconst&,google::protobuf::Symbol) 40 8 20.0% []
google::protobuf::DescriptorBuilder::BuildFile(google::protobuf::FileDescriptorProtoconst&) 49 21 42.85% ['expat_example', 'libxml2_example']
google::protobuf::DescriptorBuilder::BuildFileImpl(google::protobuf::FileDescriptorProtoconst&,google::protobuf::internal::FlatAllocator&) 201 80 39.80% ['expat_example', 'libxml2_example']
google::protobuf::DescriptorBuilder::BuildMessage(google::protobuf::DescriptorProtoconst&,google::protobuf::Descriptorconst*,google::protobuf::Descriptor*,google::protobuf::internal::FlatAllocator&) 135 68 50.37% []
google::protobuf::DescriptorBuilder::BuildFieldOrExtension(google::protobuf::FieldDescriptorProtoconst&,google::protobuf::Descriptor*,google::protobuf::FieldDescriptor*,bool,google::protobuf::internal::FlatAllocator&) 232 105 45.25% []
google::protobuf::DescriptorBuilder::BuildEnum(google::protobuf::EnumDescriptorProtoconst&,google::protobuf::Descriptorconst*,google::protobuf::EnumDescriptor*,google::protobuf::internal::FlatAllocator&) 84 37 44.04% []
google::protobuf::DescriptorBuilder::BuildEnumValue(google::protobuf::EnumValueDescriptorProtoconst&,google::protobuf::EnumDescriptorconst*,google::protobuf::EnumValueDescriptor*,google::protobuf::internal::FlatAllocator&) 43 21 48.83% []
google::protobuf::DescriptorBuilder::CrossLinkField(google::protobuf::FieldDescriptor*,google::protobuf::FieldDescriptorProtoconst&) 193 53 27.46% ['expat_example', 'libxml2_example']
google::protobuf::(anonymousnamespace)::FlatAllocatorImpl ,std::__1::allocator >,google::protobuf::SourceCodeInfo,google::protobuf::FileDescriptorTables,google::protobuf::MessageOptions,google::protobuf::FieldOptions,google::protobuf::EnumOptions,google::protobuf::EnumValueOptions,google::protobuf::ExtensionRangeOptions,google::protobuf::OneofOptions,google::protobuf::ServiceOptions,google::protobuf::MethodOptions,google::protobuf::FileOptions>::AllocateFieldNames(std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >const&,std::__1::basic_string ,std::__1::allocator >const*) 40 15 37.5% []
google::protobuf::FileDescriptorProto::Clear() 33 15 45.45% []
google::protobuf::FileDescriptorProto::_InternalParse(charconst*,google::protobuf::internal::ParseContext*) 159 55 34.59% []
google::protobuf::DescriptorProto_ExtensionRange::_InternalParse(charconst*,google::protobuf::internal::ParseContext*) 53 28 52.83% []
google::protobuf::OneofDescriptorProto::_InternalParse(charconst*,google::protobuf::internal::ParseContext*) 45 21 46.66% []
google::protobuf::EnumDescriptorProto::_InternalParse(charconst*,google::protobuf::internal::ParseContext*) 82 32 39.02% []
google::protobuf::EnumValueDescriptorProto::_InternalParse(charconst*,google::protobuf::internal::ParseContext*) 53 28 52.83% []
google::protobuf::FileOptions::Clear() 55 13 23.63% ['expat_example', 'libxml2_example']
google::protobuf::FileOptions::_InternalParse(charconst*,google::protobuf::internal::ParseContext*) 211 73 34.59% []
google::protobuf::FileOptions::_InternalSerialize(unsignedchar*,google::protobuf::io::EpsCopyOutputStream*)const 139 76 54.67% []
google::protobuf::FieldOptions::_InternalParse(charconst*,google::protobuf::internal::ParseContext*) 111 28 25.22% []
google::protobuf::FieldOptions::_InternalSerialize(unsignedchar*,google::protobuf::io::EpsCopyOutputStream*)const 48 24 50.0% []
google::protobuf::Reflection::FieldSize(google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*)const 38 15 39.47% ['expat_example', 'libxml2_example']
google::protobuf::Reflection::ClearOneof(google::protobuf::Message*,google::protobuf::OneofDescriptorconst*)const 31 5 16.12% ['expat_example', 'libxml2_example']
google::protobuf::Reflection::HasBit(google::protobuf::Messageconst&,google::protobuf::FieldDescriptorconst*)const 50 5 10.0% ['expat_example', 'libxml2_example']
google::protobuf::io::Tokenizer::ConsumeNumber(bool,bool) 42 23 54.76% ['expat_example', 'libxml2_example']
google::protobuf::internal::EpsCopyInputStream::NextBuffer(int,int) 41 12 29.26% []
google::protobuf::FastUInt32ToBufferLeft(unsignedint,char*) 73 28 38.35% ['expat_example', 'libxml2_example']
google::protobuf::TextFormat::Parser::ParserImpl::ConsumeField(google::protobuf::Message*) 199 83 41.70% ['expat_example', 'libxml2_example']
google::protobuf::TextFormat::Parser::ParserImpl::ConsumeFieldValue(google::protobuf::Message*,google::protobuf::Reflectionconst*,google::protobuf::FieldDescriptorconst*) 118 41 34.74% ['expat_example', 'libxml2_example']
xmlSAX2ExternalSubset 90 7 7.777% ['libxml2_example']
xmlSAX2EntityDecl 44 23 52.27% ['libxml2_example']
xmlSAX2UnparsedEntityDecl 46 24 52.17% ['libxml2_example']
xmlSAX2AttributeNs 146 70 47.94% ['libxml2_example']
xmlGetCharEncodingName 53 12 22.64% ['libxml2_example']
xmlGetCharEncodingHandler 108 14 12.96% ['libxml2_example']
xmlReportError 172 85 49.41% ['libxml2_example']
xmlHashUpdateEntry3 116 54 46.55% ['libxml2_example']
xmlParseReference 254 134 52.75% ['libxml2_example']
xmlSwitchEncoding 57 21 36.84% ['libxml2_example']
xmlNewEntityInputStream 56 17 30.35% ['libxml2_example']
xmlInitSAXParserCtxt 169 92 54.43% ['libxml2_example']
xmlCreateIntSubset 82 45 54.87% ['libxml2_example']
xmlNodeListGetString 55 19 34.54% ['libxml2_example']
xmlAddNextSibling 43 19 44.18% ['libxml2_example']
xmlAddChild 80 36 45.0% ['libxml2_example']
xmlBufferResize 88 40 45.45% ['libxml2_example']
xmlGetLineNoInternal 34 15 44.11% ['libxml2_example']
xmlAddRef 68 28 41.17% ['libxml2_example']
__xmlIOErr 164 8 4.878% ['libxml2_example']
xmlAllocOutputBufferInternal 31 17 54.83% ['libxml2_example']

Files and Directories in report

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file Reached by Covered by
[] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/buf.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arena.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/SAX2.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/dynamic_message.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/src/utf8_fix.cc [] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/io/coded_stream.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_util.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any.pb.h [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlschemastypes.c [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena_impl.h ['expat_example', 'libxml2_example'] []
/usr/local/bin/../include/c++/v1/istream [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/port.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/substitute.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/debugXML.c [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/encoding.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/src/libfuzzer/libfuzzer_mutator.cc [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message_lite.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xpointer.c [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/hash.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map_field_inl.h [] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/has_bits.h [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/mathutil.h [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/inlined_string_field.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/common.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any_lite.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/./xmltok_impl.c ['expat_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.pb.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/nanohttp.c [] []
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/xmlrole.c ['expat_example'] ['expat_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/endian.h [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlunicode.c ['libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/coded_stream.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/globals.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/error.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/src/binary_format.cc ['expat_example', 'libxml2_example'] []
/usr/local/bin/../include/c++/v1/math.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlschemas.c [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xzlib.c ['libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format_lite.cc [] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/descriptor.pb.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/src/mutator.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/generated_message_util.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/parse_context.h [] []
/src/libprotobuf-mutator/build/examples/xml/xml.pb.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/unknown_field_set.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any.h [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arena_impl.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/substitute.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/printer.cc [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenastring.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/relaxng.c [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/tree.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/structurally_valid.cc [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/casts.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xinclude.c [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/parserInternals.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlmemory.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/strutil.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/src/libfuzzer/libfuzzer_mutator.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/examples/expat/expat_example.cc ['expat_example'] ['expat_example']
/src/libprotobuf-mutator/src/text_format.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream.cc [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/coded_stream.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/descriptor.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format_lite.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/pattern.c [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/util/message_differencer.cc [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_field.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_ptr_field.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/parse_context.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/examples/libxml2/libxml2_example.cc ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/dict.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/src/libfuzzer/libfuzzer_macro.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenaz_sampler.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor_database.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlregexp.c ['libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/metadata_lite.h [] []
/src/libprotobuf-mutator/build/examples/xml/xml.pb.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arenastring.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/util/field_comparator.h [] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/metadata_lite.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/map_util.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/tokenizer.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream_impl_lite.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/src/weighted_reservoir_sampler.h [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/list.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/parse_context.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/tokenizer.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringpiece.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/./xmltok_ns.c ['expat_example'] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/unknown_field_set.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/strtod.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlstring.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/examples/xml/xml_writer.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stl_util.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set_heavy.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map_field.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream_impl_lite.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/entities.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/text_format.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/xmltok.c ['expat_example'] ['expat_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/message_lite.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/./siphash.h ['expat_example'] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/threads.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/text_format.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/message.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/explicitly_constructed.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/util/field_comparator.cc [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any.pb.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlsave.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/src/field_instance.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/explicitly_constructed.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/any.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/port.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/repeated_ptr_field.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/repeated_field.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/map_field.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message_lite.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/valid.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/uri.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlIO.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/chvalid.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/HTMLtree.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/message.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor.pb.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringpiece.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/xmlparse.c ['expat_example'] ['expat_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/wire_format_lite.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/wire_format.h [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/repeated_ptr_field.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/util/message_differencer.h [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_util.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/timsort.h [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xpath.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/once.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/stringprintf.cc ['expat_example', 'libxml2_example'] ['expat_example']
/usr/local/bin/../include/c++/v1/iosfwd [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/strutil.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/dynamic_message.h [] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/xmlreader.c [] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/stubs/once.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/printer.h [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/HTMLparser.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/parser.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/reflection.h [] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/stubs/port.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/descriptor_database.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/common.h [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/wire_format.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/arenastring.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/zero_copy_stream.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/src/mutator.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/mutex.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/reflection_ops.cc ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/unknown_field_set.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/generated_message_reflection.cc ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/any.pb.h ['expat_example', 'libxml2_example'] ['expat_example', 'libxml2_example']
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/catalog.c ['libxml2_example'] ['libxml2_example']
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/reflection_internal.h [] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/arena.h ['expat_example', 'libxml2_example'] []
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/extension_set_inl.h [] []

Directories in report

Directory
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/
/src/libprotobuf-mutator/examples/libxml2/
/src/libprotobuf-mutator/src/
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/io/
/src/libprotobuf-mutator/examples/expat/
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/
/usr/local/bin/../include/c++/v1/
/src/libprotobuf-mutator/src/libfuzzer/
/src/libprotobuf-mutator/build/examples/expat/external.expat/src/external.expat/expat/lib/./
/src/libprotobuf-mutator/examples/xml/
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/stubs/
/src/libprotobuf-mutator/build/examples/xml/
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/util/
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/io/
/src/libprotobuf-mutator/build/examples/libxml2/external.libxml2/src/external.libxml2/
/src/libprotobuf-mutator/build/external.protobuf/include/google/protobuf/stubs/
/src/libprotobuf-mutator/build/external.protobuf/src/external.protobuf/src/google/protobuf/

Metadata section

This sections shows the raw data that is used to produce this report. This is mainly used for further processing and developer debugging.

Fuzzer Calltree file Program data file Coverage file
expat_example fuzzerLogFile-0-9ijRwPpNQK.data fuzzerLogFile-0-9ijRwPpNQK.data.yaml expat_example.covreport
libxml2_example fuzzerLogFile-0-7wEDLyqPj4.data fuzzerLogFile-0-7wEDLyqPj4.data.yaml libxml2_example.covreport

Function call coverage

This section shows a chosen list of functions / methods calls and their relative coverage information. By static analysis of the target project code, all of these function call and their caller information, including the source file or class and line number that initiate the call are captured. Column 1 is the function name of that selected functions or methods. Column 2 of each row indicate if the target function covered by any fuzzer calltree information. Column 3 lists all fuzzers (or no fuzzers at all) that have coered that particular function call dynamically. Column 4 shows list of parent function for the specific function call, while column 5 shows possible blocker functions that make the fuzzers fail to reach the specific functions. Both column 4 and 5 will only show information if none of the fuzzers cover the target function calls.

Function in each files in report

Target sink Callsite location Reached by fuzzer Function call path Covered by fuzzer Possible branch blockers