High level conclusions

Fuzzer libpsl_idn2_load_fuzzer is blocked:

The runtime code coverage of libpsl_idn2_load_fuzzer covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer libpsl_idn_load_fuzzer is blocked:

The runtime code coverage of libpsl_idn_load_fuzzer covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 25.69% of cyclomatic complexity.

Fuzzers reach 25.73% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

585 / 2273

Cyclomatic complexity statically reachable by fuzzers

5030 / 19576

Runtime code coverage of functions

576 / 2273

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: libpsl_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	25	26.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	71	73.9%
All colors	96	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	58	is_public_suffix	call site: 00058	psl_idna_toASCII
3	78	LookupStringInFixedSet	call site: 00078	LookupStringInFixedSet
3	92	LLVMFuzzerTestOneInput	call site: 00092	psl_load_fp
2	9	psl_load_fp	call site: 00009	realloc
2	19	psl_load_fp	call site: 00019	strstr
2	23	psl_load_fp	call site: 00023	vector_find
2	53	psl_load_fp	call site: 00053	psl_free
2	82	is_public_suffix	call site: 00082	vector_find
2	86	is_public_suffix	call site: 00086	vector_find
1	6	psl_load_fp	call site: 00006	atoi
1	49	add_punycode_if_needed	call site: 00049	fgets
1	56	LLVMFuzzerTestOneInput	call site: 00056	is_public_suffix

Runtime coverage analysis

Covered functions

38

Functions that are reachable but not covered

15

Reachable functions

53

Percentage of reachable functions covered

71.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl_idn_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	79	43.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	103	56.5%
All colors	182	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	11	psl_load_fp	call site: 00011	add_punycode_if_needed
10	154	LookupStringInFixedSet	call site: 00154	LookupStringInFixedSet
8	120	idna_to_ascii_8z	call site: 00120	vector_add
4	100	idna_to_ascii_4i	call site: 00100	rpl_free
4	171	LLVMFuzzerTestOneInput	call site: 00171	insert_file
4	176	psl_latest	call site: 00176	psl_load_fp
3	87	stringprep_4i	call site: 00087	stringprep_find_character_in_table
3	134	is_public_suffix	call site: 00134	psl_idna_toASCII
2	41	idna_to_ascii_8z	call site: 00041	strcpy
2	51	rpl_free	call site: 00051	stringprep
2	129	psl_load_fp	call site: 00129	psl_free
1	8	psl_load_fp	call site: 00008	atoi

Runtime coverage analysis

Covered functions

53

Functions that are reachable but not covered

35

Reachable functions

88

Percentage of reachable functions covered

60.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl_idn_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	160	63.4%
gold	[1:9]	10	3.96%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	82	32.5%
All colors	252	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
89	5	is_public_suffix	call site: 00005	idna_to_ascii_8z
8	113	is_public_suffix	call site: 00113	LookupStringInFixedSet
8	173	libunistring_u8_casemap	call site: 00173	u8_mbtouc_unsafe
5	182	libunistring_u8_casemap	call site: 00182	__errno_location
5	207	u8_normalize	call site: 00207	__errno_location
5	229	libunistring_u8_casemap	call site: 00229	libunistring_rpl_free
4	137	psl_is_cookie_domain_acceptable	call site: 00137	is_ip6
4	215	u8_normalize	call site: 00215	__errno_location
4	224	u8_normalize	call site: 00224	libunistring_rpl_free
3	152	psl_strdup	call site: 00152	__ctype_b_loc
3	235	u8_tolower	call site: 00235	idn_u8_tolower
2	131	LLVMFuzzerTestOneInput	call site: 00131	is_public_suffix

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

57

Reachable functions

107

Percentage of reachable functions covered

46.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	31
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4
libpsllookup_string_in_fixed_set.c	9
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	1
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1

Fuzzer: libpsl_idn_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	170	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	170	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
169	0	EP	call site: 00000	idna_to_ascii_8z

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

80

Reachable functions

80

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	21
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl_idn2_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	240	72.0%
gold	[1:9]	10	3.00%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	83	24.9%
All colors	333	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
163	85	u8_tolower	call site: 00085	idn2_lookup_u8
8	21	libunistring_u8_casemap	call site: 00021	u8_mbtouc_unsafe
8	267	is_public_suffix	call site: 00267	LookupStringInFixedSet
5	5	is_public_suffix	call site: 00005	u8_tolower
5	30	libunistring_u8_casemap	call site: 00030	__errno_location
5	55	u8_normalize	call site: 00055	__errno_location
5	79	libunistring_u8_casemap	call site: 00079	libunistring_rpl_free
4	63	u8_normalize	call site: 00063	__errno_location
4	74	u8_normalize	call site: 00074	libunistring_rpl_free
4	291	psl_is_cookie_domain_acceptable	call site: 00291	is_ip6
4	315	psl_str_to_utf8lower	call site: 00315	idn_u8_tolower
3	306	psl_strdup	call site: 00306	__ctype_b_loc

Runtime coverage analysis

Covered functions

58

Functions that are reachable but not covered

77

Reachable functions

127

Percentage of reachable functions covered

39.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	30
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/gl/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl_idn2_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	324	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	324	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
323	0	EP	call site: 00000	idn2_lookup_u8

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

119

Reachable functions

119

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	20
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/gl/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl_idn2_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	202	60.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	134	39.8%
All colors	336	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	11	psl_load_fp	call site: 00011	add_punycode_if_needed
14	209	_idn2_label_test	call site: 00209	_idn2_contexto_rule
10	308	LookupStringInFixedSet	call site: 00308	LookupStringInFixedSet
9	47	libunistring_uc_is_case_ignorable	call site: 00047	u8_mbtouc_unsafe
8	274	idn2_lookup_u8	call site: 00274	vector_add
7	57	libunistring_u8_casemap	call site: 00057	__errno_location
7	82	u8_normalize	call site: 00082	__errno_location
7	200	_idn2_contextj_rule	call site: 00200	uc_joining_type
6	75	u8_normalize	call site: 00075	libunistring_gl_uninorm_decompose_merge_sort_inplace
6	118	u8_to_u32	call site: 00118	libunistring_rpl_free
6	139	_tr46	call site: 00139	rpl_free
6	150	_tr46	call site: 00150	get_map_data

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

52

Reachable functions

127

Percentage of reachable functions covered

59.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	26
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/gl/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl_icu_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	379	55.4%
gold	[1:9]	174	25.4%
yellow	[10:29]	2	0.29%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	129	18.8%
All colors	684	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
76	233	isTimeZoneFile(char const*, char const*)	call site: 00233	u_getTimeZoneFilesDirectory_59
28	394	uhash_get_59	call site: 00394	u_getDataDirectory_59
20	526	icu_59::IDNA::createUTS46Instance(unsigned int, UErrorCode&)	call site: 00526	add_punycode_if_needed
16	166	icu_59::CharString::append(char const*, int, UErrorCode&)	call site: 00166	uprv_pathIsAbsolute_59
16	445	doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)	call site: 00445	UDataMemory_init_59
13	380	uhash_hashChars_59	call site: 00380	ucln_common_registerCleanup_59
11	99	icu_59::Normalizer2::getInstance(char const*, char const*, UNormalization2Mode, UErrorCode&)	call site: 00099	strcmp
11	315	checkDataItem(DataHeader const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, char const*, char const*, UErrorCode*, UErrorCode*)	call site: 00315	udata_close_59
11	424	_uhash_put(UHashtable*, UElement, UElement, signed char, UErrorCode*)	call site: 00424	uprv_free_59
11	479	icu_59::Norm2AllModes::createInstance(char const*, char const*, UErrorCode&)	call site: 00479	ucln_common_registerCleanup_59
10	656	LookupStringInFixedSet	call site: 00656	LookupStringInFixedSet
9	89	icu_59::Mutex::~Mutex()	call site: 00089	__cxa_begin_catch

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

143

Reachable functions

416

Percentage of reachable functions covered

65.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	19
icu/source/common/ustring.cpp	5
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9

Fuzzer: libpsl_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	63	68.4%
gold	[1:9]	8	8.69%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	21	22.8%
All colors	92	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
28	19	psl_strdup	call site: 00019	LookupStringInFixedSet
14	3	LLVMFuzzerTestOneInput	call site: 00003	is_public_suffix
11	61	LLVMFuzzerTestOneInput	call site: 00061	psl_unregistrable_domain
3	57	LLVMFuzzerTestOneInput	call site: 00057	is_public_suffix
2	53	LLVMFuzzerTestOneInput	call site: 00053	is_public_suffix
2	76	psl_str_to_utf8lower	call site: 00076	__ctype_b_loc
1	48	LLVMFuzzerTestOneInput	call site: 00048	is_public_suffix
1	81	LLVMFuzzerTestOneInput	call site: 00081	vector_free
1	87	LLVMFuzzerTestOneInput	call site: 00087	stat

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

34

Reachable functions

52

Percentage of reachable functions covered

34.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	34
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl_icu_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1272	76.0%
gold	[1:9]	24	1.43%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	376	22.4%
All colors	1672	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
458	1095	_canonicalize(char const*, char*, int, unsigned int, UErrorCode*)	call site: 01095	uloc_getDefault_59
152	867	getShortestSubtagLength(char const*)	call site: 00867	uloc_forLanguageTag_59
118	465	udata_getMemory_59	call site: 00465	uidna_nameToASCII_59
76	225	isTimeZoneFile(char const*, char const*)	call site: 00225	u_getTimeZoneFilesDirectory_59
35	1057	_canonicalize(char const*, char*, int, unsigned int, UErrorCode*)	call site: 01057	uprv_sortArray_59
32	769	ucnv_loadSharedData_59	call site: 00769	ucnv_load_59
29	81	icu_59::Mutex::~Mutex()	call site: 00081	udata_openChoice_59
28	46	icu_59::UMemory::operator delete(void*)	call site: 00046	ucln_common_registerCleanup_59
28	386	uhash_get_59	call site: 00386	u_getDataDirectory_59
18	1616	_caseMap(int, unsigned int, int (*)(int, int (*)(void*, signed char), void*, char16_t const**, int), char16_t*, int, char16_t const*, UCaseContext*, int, int, icu_59::Edits*, UErrorCode&)	call site: 01616	uprv_malloc_59
16	158	icu_59::CharString::append(char const*, int, UErrorCode&)	call site: 00158	uprv_pathIsAbsolute_59
16	437	doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)	call site: 00437	UDataMemory_init_59

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

514

Reachable functions

798

Percentage of reachable functions covered

35.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	28
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	4
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	4
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	16
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	24
icu/source/common/ustring.cpp	7
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	11
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9
libpsllookup_string_in_fixed_set.c	9
icu/source/common/ucnv.cpp	10
icu/source/common/ucnv_bld.cpp	19
icu/source/common/umath.cpp	1
icu/source/common/ucnv_io.cpp	10
icu/source/common/ustr_cnv.cpp	1
icu/source/common/ustrcase_locale.cpp	2
icu/source/common/uloc.cpp	22
icu/source/common/locid.cpp	8
icu/source/common/uloc_tag.cpp	33
icu/source/common/cstring.cpp	8
icu/source/common/uloc_keytype.cpp	8
icu/source/common/uresbund.cpp	36
icu/source/common/uarrsort.cpp	6
icu/source/common/uresdata.cpp	15
icu/source/common/uinvchar.cpp	2
icu/source/common/./unicode/ures.h	3
icu/source/common/uvector.cpp	4
icu/source/common/./unicode/locid.h	1
icu/source/common/ucase.cpp	8
icu/source/common/ustrcase.cpp	6
icu/source/common/edits.cpp	5
icu/source/common/./unicode/edits.h	2
icu/source/common/utrace.cpp	1

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	64	37.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	106	62.3%
All colors	170	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	152	LookupStringInFixedSet	call site: 00152	psl_is_public_suffix
10	17	suffix_compare	call site: 00017	vector_add
4	9	psl_load_fp	call site: 00009	vector_alloc
4	98	idna_to_ascii_4i	call site: 00098	rpl_free
3	85	stringprep_4i	call site: 00085	stringprep_find_character_in_table
3	132	is_public_suffix	call site: 00132	psl_idna_toASCII
3	166	LLVMFuzzerTestOneInput	call site: 00166	psl_load_fp
2	28	vector_add	call site: 00028	add_punycode_if_needed
2	39	idna_to_ascii_8z	call site: 00039	strcpy
2	49	rpl_free	call site: 00049	stringprep
2	123	add_punycode_if_needed	call site: 00123	vector_sort
2	127	psl_load_fp	call site: 00127	psl_free

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

21

Reachable functions

80

Percentage of reachable functions covered

73.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	21
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl_load_dafsa_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	57	52.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	51	47.2%
All colors	108	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	11	psl_load_fp	call site: 00011	add_punycode_if_needed
10	80	LookupStringInFixedSet	call site: 00080	LookupStringInFixedSet
8	46	psl_strdup	call site: 00046	vector_add
4	97	LLVMFuzzerTestOneInput	call site: 00097	insert_file
4	102	psl_latest	call site: 00102	psl_load_fp
3	60	is_public_suffix	call site: 00060	psl_idna_toASCII
2	55	psl_load_fp	call site: 00055	psl_free
1	8	psl_load_fp	call site: 00008	atoi
1	58	LLVMFuzzerTestOneInput	call site: 00058	is_public_suffix
1	64	is_public_suffix	call site: 00064	LookupStringInFixedSet

Runtime coverage analysis

Covered functions

32

Functions that are reachable but not covered

29

Reachable functions

61

Percentage of reachable functions covered

52.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	33
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	115	45.6%
gold	[1:9]	1	0.39%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	136	53.9%
All colors	252	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	235	u8_tolower	call site: 00235	idn_u8_tolower
10	111	LookupStringInFixedSet	call site: 00111	LookupStringInFixedSet
8	154	psl_str_to_utf8lower	call site: 00154	idn_u8_tolower
8	173	libunistring_u8_casemap	call site: 00173	u8_mbtouc_unsafe
5	182	libunistring_u8_casemap	call site: 00182	__errno_location
5	207	u8_normalize	call site: 00207	__errno_location
5	229	libunistring_u8_casemap	call site: 00229	libunistring_rpl_free
4	73	idna_to_ascii_4i	call site: 00073	rpl_free
4	137	psl_is_cookie_domain_acceptable	call site: 00137	is_ip6
4	215	u8_normalize	call site: 00215	__errno_location
4	224	u8_normalize	call site: 00224	libunistring_rpl_free
3	60	stringprep_4i	call site: 00060	stringprep_find_character_in_table

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

23

Reachable functions

107

Percentage of reachable functions covered

78.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	31
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4
libpsllookup_string_in_fixed_set.c	9
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	1
libunistring/lib/uninorm/u-normalize-internal.h	1
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	67	36.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	115	63.1%
All colors	182	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	19	suffix_compare	call site: 00019	vector_add
10	154	LookupStringInFixedSet	call site: 00154	LookupStringInFixedSet
4	11	psl_load_fp	call site: 00011	vector_alloc
4	100	idna_to_ascii_4i	call site: 00100	rpl_free
4	171	LLVMFuzzerTestOneInput	call site: 00171	insert_file
4	176	psl_latest	call site: 00176	psl_load_fp
3	87	stringprep_4i	call site: 00087	stringprep_find_character_in_table
3	134	is_public_suffix	call site: 00134	psl_idna_toASCII
2	30	vector_add	call site: 00030	add_punycode_if_needed
2	41	idna_to_ascii_8z	call site: 00041	strcpy
2	51	rpl_free	call site: 00051	stringprep
2	125	add_punycode_if_needed	call site: 00125	vector_sort

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

23

Reachable functions

88

Percentage of reachable functions covered

73.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10
libidn/lib/idna.c	3
libidn/lib/nfkc.c	14
libidn/lib/gl/unistr/u8-check.c	1
libidn/lib/gl/free.c	1
libidn/lib/stringprep.c	6
libidn/lib/punycode.c	4

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	48	52.1%
gold	[1:9]	1	1.08%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	46.7%
All colors	92	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	78	psl_str_to_utf8lower	call site: 00078	psl_is_public_suffix
10	37	LookupStringInFixedSet	call site: 00037	LookupStringInFixedSet
4	13	domain_to_punycode	call site: 00013	psl_strdup
4	63	psl_is_cookie_domain_acceptable	call site: 00063	is_ip6
3	5	is_public_suffix	call site: 00005	psl_idna_toASCII
3	56	psl_unregistrable_domain	call site: 00056	psl_registrable_domain
3	71	psl_is_cookie_domain_acceptable	call site: 00071	psl_is_cookie_domain_acceptable
2	2	LLVMFuzzerTestOneInput	call site: 00002	psl_is_public_suffix
1	19	psl_strdup	call site: 00019	strlen
1	21	is_public_suffix	call site: 00021	LookupStringInFixedSet
1	48	LLVMFuzzerTestOneInput	call site: 00048	is_public_suffix
1	50	LLVMFuzzerTestOneInput	call site: 00050	psl_is_public_suffix2

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

8

Reachable functions

52

Percentage of reachable functions covered

84.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	34
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	47	48.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	49	51.0%
All colors	96	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	78	LookupStringInFixedSet	call site: 00078	psl_is_public_suffix
10	17	suffix_compare	call site: 00017	vector_add
4	9	psl_load_fp	call site: 00009	vector_alloc
4	38	domain_to_punycode	call site: 00038	psl_strdup
3	58	is_public_suffix	call site: 00058	psl_idna_toASCII
3	92	LLVMFuzzerTestOneInput	call site: 00092	psl_load_fp
2	28	vector_add	call site: 00028	add_punycode_if_needed
2	49	add_punycode_if_needed	call site: 00049	vector_sort
2	53	psl_load_fp	call site: 00053	psl_free
1	0	EP	call site: 00000	fmemopen
1	6	psl_load_fp	call site: 00006	atoi
1	14	vector_alloc	call site: 00014	suffix_compare_array

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

15

Reachable functions

53

Percentage of reachable functions covered

71.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	50	46.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	58	53.7%
All colors	108	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	19	suffix_compare	call site: 00019	vector_add
10	80	LookupStringInFixedSet	call site: 00080	LookupStringInFixedSet
4	11	psl_load_fp	call site: 00011	vector_alloc
4	40	domain_to_punycode	call site: 00040	psl_strdup
4	97	LLVMFuzzerTestOneInput	call site: 00097	insert_file
4	102	psl_latest	call site: 00102	psl_load_fp
3	60	is_public_suffix	call site: 00060	psl_idna_toASCII
2	30	vector_add	call site: 00030	add_punycode_if_needed
2	51	add_punycode_if_needed	call site: 00051	vector_sort
2	55	psl_load_fp	call site: 00055	psl_free
1	8	psl_load_fp	call site: 00008	atoi
1	16	vector_alloc	call site: 00016	suffix_compare_array

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

17

Reachable functions

61

Percentage of reachable functions covered

72.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	33
libpsllookup_string_in_fixed_set.c	10

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	188	56.4%
gold	[1:9]	1	0.30%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	144	43.2%
All colors	333	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
24	308	psl_str_to_utf8lower	call site: 00308	idn_u8_tolower
14	182	_idn2_label_test	call site: 00182	_idn2_contexto_rule
10	265	LookupStringInFixedSet	call site: 00265	LookupStringInFixedSet
8	21	libunistring_u8_casemap	call site: 00021	u8_mbtouc_unsafe
7	173	_idn2_contextj_rule	call site: 00173	uc_joining_type
6	91	u8_to_u32	call site: 00091	libunistring_rpl_free
6	112	_tr46	call site: 00112	rpl_free
6	123	_tr46	call site: 00123	get_map_data
6	225	_idn2_u8_to_u32_nfc	call site: 00225	u32_normalize
5	30	libunistring_u8_casemap	call site: 00030	__errno_location
5	55	u8_normalize	call site: 00055	__errno_location
5	79	libunistring_u8_casemap	call site: 00079	libunistring_rpl_free

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

34

Reachable functions

127

Percentage of reachable functions covered

73.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	30
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/gl/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1
libpsllookup_string_in_fixed_set.c	9

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	353	51.6%
gold	[1:9]	56	8.18%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	275	40.2%
All colors	684	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
76	233	isTimeZoneFile(char const*, char const*)	call site: 00233	u_getTimeZoneFilesDirectory_59
28	394	uhash_get_59	call site: 00394	u_getDataDirectory_59
16	166	icu_59::CharString::append(char const*, int, UErrorCode&)	call site: 00166	uprv_pathIsAbsolute_59
16	445	doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)	call site: 00445	UDataMemory_init_59
13	380	uhash_hashChars_59	call site: 00380	ucln_common_registerCleanup_59
11	99	icu_59::Normalizer2::getInstance(char const*, char const*, UNormalization2Mode, UErrorCode&)	call site: 00099	strcmp
11	424	_uhash_put(UHashtable*, UElement, UElement, signed char, UErrorCode*)	call site: 00424	uprv_free_59
11	479	icu_59::Norm2AllModes::createInstance(char const*, char const*, UErrorCode&)	call site: 00479	ucln_common_registerCleanup_59
10	531	suffix_compare	call site: 00531	vector_add
10	656	LookupStringInFixedSet	call site: 00656	LookupStringInFixedSet
9	89	icu_59::Mutex::~Mutex()	call site: 00089	__cxa_begin_catch
7	358	openCommonData(char const*, int, UErrorCode*)	call site: 00358	uhash_open_59

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

115

Reachable functions

416

Percentage of reachable functions covered

72.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	27
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	19
icu/source/common/ustring.cpp	5
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9

Fuzzer: libpsl_icu_load_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	342	50.8%
gold	[1:9]	174	25.8%
yellow	[10:29]	2	0.29%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	154	22.9%
All colors	672	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
76	231	isTimeZoneFile(char const*, char const*)	call site: 00231	u_getTimeZoneFilesDirectory_59
28	392	uhash_get_59	call site: 00392	u_getDataDirectory_59
16	164	icu_59::CharString::append(char const*, int, UErrorCode&)	call site: 00164	uprv_pathIsAbsolute_59
16	443	doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)	call site: 00443	UDataMemory_init_59
13	378	uhash_hashChars_59	call site: 00378	ucln_common_registerCleanup_59
11	97	icu_59::Normalizer2::getInstance(char const*, char const*, UNormalization2Mode, UErrorCode&)	call site: 00097	strcmp
11	313	checkDataItem(DataHeader const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, char const*, char const*, UErrorCode*, UErrorCode*)	call site: 00313	udata_close_59
11	422	_uhash_put(UHashtable*, UElement, UElement, signed char, UErrorCode*)	call site: 00422	uprv_free_59
11	477	icu_59::Norm2AllModes::createInstance(char const*, char const*, UErrorCode&)	call site: 00477	ucln_common_registerCleanup_59
9	87	icu_59::Mutex::~Mutex()	call site: 00087	__cxa_begin_catch
8	221	u_setDataDirectory_59	call site: 00221	uprv_free_59
7	347	setCommonICUData(UDataMemory*, signed char, UErrorCode*)	call site: 00347	uhash_close_59

Runtime coverage analysis

Covered functions

277

Functions that are reachable but not covered

125

Reachable functions

409

Percentage of reachable functions covered

69.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	21
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	19
icu/source/common/ustring.cpp	5
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	176	54.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	148	45.6%
All colors	324	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	207	_idn2_label_test	call site: 00207	_idn2_contexto_rule
11	306	LookupStringInFixedSet	call site: 00306	psl_is_public_suffix
10	17	suffix_compare	call site: 00017	vector_add
8	46	libunistring_u8_casemap	call site: 00046	u8_mbtouc_unsafe
7	198	_idn2_contextj_rule	call site: 00198	uc_joining_type
6	116	u8_to_u32	call site: 00116	libunistring_rpl_free
6	137	_tr46	call site: 00137	rpl_free
6	148	_tr46	call site: 00148	get_map_data
6	250	_idn2_u8_to_u32_nfc	call site: 00250	u32_normalize
5	55	libunistring_u8_casemap	call site: 00055	__errno_location
5	80	u8_normalize	call site: 00080	__errno_location
5	104	libunistring_u8_casemap	call site: 00104	libunistring_rpl_free

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

35

Reachable functions

119

Percentage of reachable functions covered

70.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	20
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/gl/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	179	53.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	157	46.7%
All colors	336	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	209	_idn2_label_test	call site: 00209	_idn2_contexto_rule
10	19	suffix_compare	call site: 00019	vector_add
10	308	LookupStringInFixedSet	call site: 00308	LookupStringInFixedSet
8	48	libunistring_u8_casemap	call site: 00048	u8_mbtouc_unsafe
7	200	_idn2_contextj_rule	call site: 00200	uc_joining_type
6	118	u8_to_u32	call site: 00118	libunistring_rpl_free
6	139	_tr46	call site: 00139	rpl_free
6	150	_tr46	call site: 00150	get_map_data
6	252	_idn2_u8_to_u32_nfc	call site: 00252	u32_normalize
5	57	libunistring_u8_casemap	call site: 00057	__errno_location
5	82	u8_normalize	call site: 00082	__errno_location
5	106	libunistring_u8_casemap	call site: 00106	libunistring_rpl_free

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

37

Reachable functions

127

Percentage of reachable functions covered

70.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_dafsa_fuzzer.c	1
libpslpsl.c	26
libpsllookup_string_in_fixed_set.c	10
libunistring/lib/unistr/u8-strlen.c	1
libunistring/lib/unicase/u8-tolower.c	1
libunistring/lib/unicase/u-casemap.h	1
libunistring/lib/unistr/u8-mbtouc-unsafe.c	1
libunistring/lib/./unicase/special-casing-table.h	2
libunistring/lib/unicase/cased.c	1
libunistring/lib/./unictype/bitmap.h	1
libunistring/lib/unicase/ignorable.c	1
libunistring/lib/unictype/pr_soft_dotted.c	1
libunistring/lib/unictype/bitmap.h	1
libunistring/lib/unictype/combiningclass.c	1
libunistring/lib/unistr/u8-uctomb.c	1
libunistring/lib/unistr/u-cpy.h	2
libunistring/lib/uninorm/u-normalize-internal.h	2
libunistring/lib/./array-mergesort.h	3
libunistring/lib/free.c	1
libunistring/lib/unicase/simple-mapping.h	1
libidn2/lib/lookup.c	6
libunistring/lib/unistr/u8-to-u32.c	1
libunistring/lib/unistr/u8-mbtoucr.c	1
libidn2/lib/tr46map.c	7
libidn2/gl/free.c	1
libunistring/lib/unistr/u32-mbtouc-unsafe.c	1
libunistring/lib/unistr/u32-uctomb.c	1
libunistring/lib/unistr/u32-to-u8.c	1
libidn2/lib/punycode.c	5
libidn2/lib/idna.c	4
libunistring/lib/unictype/categ_test.c	1
libidn2/lib/tables.c	6
libidn2/lib/context.c	4
libunistring/lib/unictype/joiningtype_of.c	1
libunistring/lib/unictype/categ_of.c	2
libunistring/lib/unictype/scripts.c	1
libidn2/lib/bidi.c	2
libunistring/lib/unictype/bidi_of.c	2
libunistring/lib/unistr/u32-cmp.c	1

Fuzzer: libpsl/fuzz/libpsl_load_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	350	52.0%
gold	[1:9]	56	8.33%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	266	39.5%
All colors	672	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
76	231	isTimeZoneFile(char const*, char const*)	call site: 00231	u_getTimeZoneFilesDirectory_59
28	392	uhash_get_59	call site: 00392	u_getDataDirectory_59
16	164	icu_59::CharString::append(char const*, int, UErrorCode&)	call site: 00164	uprv_pathIsAbsolute_59
16	443	doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)	call site: 00443	UDataMemory_init_59
13	378	uhash_hashChars_59	call site: 00378	ucln_common_registerCleanup_59
11	97	icu_59::Normalizer2::getInstance(char const*, char const*, UNormalization2Mode, UErrorCode&)	call site: 00097	strcmp
11	422	_uhash_put(UHashtable*, UElement, UElement, signed char, UErrorCode*)	call site: 00422	uprv_free_59
11	477	icu_59::Norm2AllModes::createInstance(char const*, char const*, UErrorCode&)	call site: 00477	ucln_common_registerCleanup_59
11	654	LookupStringInFixedSet	call site: 00654	psl_is_public_suffix
10	529	suffix_compare	call site: 00529	vector_add
9	87	icu_59::Mutex::~Mutex()	call site: 00087	__cxa_begin_catch
7	356	openCommonData(char const*, int, UErrorCode*)	call site: 00356	uhash_open_59

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

114

Reachable functions

409

Percentage of reachable functions covered

72.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_load_fuzzer.c	1
libpslpsl.c	21
libpsllookup_string_in_fixed_set.c	10
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	2
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	1
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	8
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	19
icu/source/common/ustring.cpp	5
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	6
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9

Fuzzer: libpsl/fuzz/libpsl_fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1167	69.7%
gold	[1:9]	71	4.24%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	434	25.9%
All colors	1672	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
458	1095	_canonicalize(char const*, char*, int, unsigned int, UErrorCode*)	call site: 01095	uloc_getDefault_59
152	867	getShortestSubtagLength(char const*)	call site: 00867	uloc_forLanguageTag_59
76	225	isTimeZoneFile(char const*, char const*)	call site: 00225	u_getTimeZoneFilesDirectory_59
35	1057	_canonicalize(char const*, char*, int, unsigned int, UErrorCode*)	call site: 01057	uprv_sortArray_59
32	769	ucnv_loadSharedData_59	call site: 00769	ucnv_load_59
28	386	uhash_get_59	call site: 00386	u_getDataDirectory_59
18	1616	_caseMap(int, unsigned int, int (*)(int, int (*)(void*, signed char), void*, char16_t const**, int), char16_t*, int, char16_t const*, UCaseContext*, int, int, icu_59::Edits*, UErrorCode&)	call site: 01616	uprv_malloc_59
16	158	icu_59::CharString::append(char const*, int, UErrorCode&)	call site: 00158	uprv_pathIsAbsolute_59
16	437	doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)	call site: 00437	UDataMemory_init_59
14	1651	psl_str_to_utf8lower	call site: 01651	psl_is_public_suffix
13	372	uhash_hashChars_59	call site: 00372	ucln_common_registerCleanup_59
13	1570	icu_59::Locale::init(char const*, signed char)	call site: 01570	uloc_canonicalize_59

Runtime coverage analysis

Covered functions

485

Functions that are reachable but not covered

382

Reachable functions

798

Percentage of reachable functions covered

52.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpsl/fuzz/libpsl_fuzzer.c	1
libpslpsl.c	28
icu/source/common/uts46.cpp	8
icu/source/common/./unicode/utypes.h	2
icu/source/common/uobject.cpp	3
icu/source/common/cmemory.cpp	4
icu/source/common/./unicode/idna.h	4
icu/source/common/./unicode/uobject.h	1
icu/source/common/loadednormalizer2impl.cpp	9
icu/source/common/normalizer2.cpp	11
icu/source/common/./umutex.h	7
icu/source/common/umutex.cpp	4
icu/source/common/./normalizer2impl.h	5
icu/source/common/normalizer2impl.cpp	2
icu/source/common/./norm2allmodes.h	5
icu/source/common/./unicode/normalizer2.h	1
icu/source/common/ucln_cmn.cpp	4
icu/source/common/./mutex.h	2
icu/source/common/udata.cpp	21
icu/source/common/./charstr.h	11
icu/source/common/./cmemory.h	8
icu/source/common/stringpiece.cpp	1
icu/source/common/./unicode/stringpiece.h	2
icu/source/common/charstr.cpp	4
icu/source/common/putil.cpp	16
icu/source/common/umapfile.cpp	2
icu/source/common/udatamem.cpp	8
icu/source/common/ucmndata.cpp	2
icu/source/common/uhash.cpp	24
icu/source/common/ustring.cpp	7
icu/source/common/utrie2.cpp	1
icu/source/common/./unicode/localpointer.h	11
icu/source/common/ustrtrns.cpp	7
icu/source/common/./unicode/char16ptr.h	8
icu/source/common/unistr.cpp	8
icu/source/common/./unicode/rep.h	1
icu/source/common/./unicode/unistr.h	9
libpsllookup_string_in_fixed_set.c	9
icu/source/common/ucnv.cpp	10
icu/source/common/ucnv_bld.cpp	19
icu/source/common/umath.cpp	1
icu/source/common/ucnv_io.cpp	10
icu/source/common/ustr_cnv.cpp	1
icu/source/common/ustrcase_locale.cpp	2
icu/source/common/uloc.cpp	22
icu/source/common/locid.cpp	8
icu/source/common/uloc_tag.cpp	33
icu/source/common/cstring.cpp	8
icu/source/common/uloc_keytype.cpp	8
icu/source/common/uresbund.cpp	36
icu/source/common/uarrsort.cpp	6
icu/source/common/uresdata.cpp	15
icu/source/common/uinvchar.cpp	2
icu/source/common/./unicode/ures.h	3
icu/source/common/uvector.cpp	4
icu/source/common/./unicode/locid.h	1
icu/source/common/ucase.cpp	8
icu/source/common/ustrcase.cpp	6
icu/source/common/edits.cpp	5
icu/source/common/./unicode/edits.h	2
icu/source/common/utrace.cpp	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
icu_59::UnicodeSet::containsNone(icu_59::UnicodeStringconst&)const	/src/icu/source/common/uniset.cpp	2	['N/A', 'N/A']	22	0	26	3	2	277	0	1056	854
icu_59::UTS46::labelToASCII_UTF8(icu_59::StringPiece,icu_59::ByteSink&,icu_59::IDNAInfo&,UErrorCode&)const	/src/icu/source/common/uts46.cpp	6	['N/A', 'N/A', 'int', 'N/A', 'N/A', 'N/A']	12	0	35	3	2	180	0	773	402
icu_59::ComposeNormalizer2::normalizeAndAppend(char16_tconst*,char16_tconst*,signedchar,icu_59::UnicodeString&,icu_59::ReorderingBuffer&,UErrorCode&)const	/src/icu/source/common/./norm2allmodes.h	7	['N/A', 'N/A', 'N/A', 'char', 'N/A', 'N/A', 'N/A']	13	0	37	3	2	202	0	528	370
uloc_toLanguageTag_59	/src/icu/source/common/uloc_tag.cpp	5	['N/A', 'N/A', 'int', 'char', 'N/A']	37	0	289	34	13	510	0	2767	359
idn2_to_ascii_lz	/src/libidn2/lib/lookup.c	3	['N/A', 'N/A', 'int']	10	0	21	3	2	93	0	1050	356
icu_59::Normalizer2Impl::addCanonIterPropertyStarts(USetAdderconst*,UErrorCode&)const	/src/icu/source/common/normalizer2impl.cpp	3	['N/A', 'N/A', 'N/A']	10	0	37	6	3	163	0	509	335
UConverter_toUnicode_ISO_2022_KR_OFFSETS_LOGIC(UConverterToUnicodeArgs*,UErrorCode*)	/src/icu/source/common/ucnv2022.cpp	2	['N/A', 'N/A']	6	0	531	66	24	39	0	328	324

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

917 / 2273

Cyclomatic complexity statically reachable by fuzzers

8030 / 19576

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

libpsl/fuzz/libpsl_load_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['is_public_suffix', 'LookupStringInFixedSet', 'LLVMFuzzerTestOneInput', 'psl_load_fp']

libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['psl_load_fp', 'LookupStringInFixedSet', 'idna_to_ascii_8z', 'idna_to_ascii_4i', 'LLVMFuzzerTestOneInput', 'psl_latest', 'stringprep_4i', 'is_public_suffix', 'rpl_free']

libpsl/fuzz/libpsl_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['is_public_suffix', 'libunistring_u8_casemap', 'u8_normalize', 'psl_is_cookie_domain_acceptable', 'psl_strdup']

libpsl/fuzz/libpsl_load_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

libpsl/fuzz/libpsl_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['u8_tolower', 'libunistring_u8_casemap', 'is_public_suffix', 'u8_normalize', 'psl_is_cookie_domain_acceptable']

libpsl/fuzz/libpsl_load_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['psl_load_fp', '_idn2_label_test', 'LookupStringInFixedSet', 'libunistring_uc_is_case_ignorable', 'idn2_lookup_u8', 'libunistring_u8_casemap', 'u8_normalize', '_idn2_contextj_rule', 'u8_to_u32']

libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['isTimeZoneFile(char const*, char const*)', 'uhash_get_59', 'icu_59::IDNA::createUTS46Instance(unsigned int, UErrorCode&)', 'icu_59::CharString::append(char const*, int, UErrorCode&)', 'doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)', 'uhash_hashChars_59', 'icu_59::Normalizer2::getInstance(char const*, char const*, UNormalization2Mode, UErrorCode&)', 'checkDataItem(DataHeader const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, char const*, char const*, UErrorCode*, UErrorCode*)', '_uhash_put(UHashtable*, UElement, UElement, signed char, UErrorCode*)', 'icu_59::Norm2AllModes::createInstance(char const*, char const*, UErrorCode&)']

libpsl/fuzz/libpsl_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['psl_strdup', 'LLVMFuzzerTestOneInput', 'psl_str_to_utf8lower']

libpsl/fuzz/libpsl_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_canonicalize(char const*, char*, int, unsigned int, UErrorCode*)', 'getShortestSubtagLength(char const*)', 'udata_getMemory_59', 'isTimeZoneFile(char const*, char const*)', '_canonicalize(char const*, char*, int, unsigned int, UErrorCode*)', 'ucnv_loadSharedData_59', 'icu_59::Mutex::~Mutex()', 'icu_59::UMemory::operator delete(void*)', 'uhash_get_59', '_caseMap(int, unsigned int, int (*)(int, int (*)(void*, signed char), void*, char16_t const**, int), char16_t*, int, char16_t const*, UCaseContext*, int, int, icu_59::Edits*, UErrorCode&)']

libpsl/fuzz/libpsl_load_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LookupStringInFixedSet', 'suffix_compare', 'psl_load_fp', 'idna_to_ascii_4i', 'stringprep_4i', 'is_public_suffix', 'LLVMFuzzerTestOneInput', 'vector_add', 'idna_to_ascii_8z', 'rpl_free']

libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['psl_load_fp', 'LookupStringInFixedSet', 'psl_strdup', 'LLVMFuzzerTestOneInput', 'psl_latest', 'is_public_suffix']

libpsl/fuzz/libpsl_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['u8_tolower', 'LookupStringInFixedSet', 'psl_str_to_utf8lower', 'libunistring_u8_casemap', 'u8_normalize', 'idna_to_ascii_4i', 'psl_is_cookie_domain_acceptable']

libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['suffix_compare', 'LookupStringInFixedSet', 'psl_load_fp', 'idna_to_ascii_4i', 'LLVMFuzzerTestOneInput', 'psl_latest', 'stringprep_4i', 'is_public_suffix', 'vector_add', 'idna_to_ascii_8z']

libpsl/fuzz/libpsl_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['psl_str_to_utf8lower', 'LookupStringInFixedSet', 'domain_to_punycode', 'psl_is_cookie_domain_acceptable', 'is_public_suffix', 'psl_unregistrable_domain', 'LLVMFuzzerTestOneInput', 'psl_strdup']

libpsl/fuzz/libpsl_load_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LookupStringInFixedSet', 'suffix_compare', 'psl_load_fp', 'domain_to_punycode', 'is_public_suffix', 'LLVMFuzzerTestOneInput', 'vector_add', 'add_punycode_if_needed']

libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['suffix_compare', 'LookupStringInFixedSet', 'psl_load_fp', 'domain_to_punycode', 'LLVMFuzzerTestOneInput', 'psl_latest', 'is_public_suffix', 'vector_add', 'add_punycode_if_needed']

libpsl/fuzz/libpsl_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['psl_str_to_utf8lower', '_idn2_label_test', 'LookupStringInFixedSet', 'libunistring_u8_casemap', '_idn2_contextj_rule', 'u8_to_u32', '_tr46', '_idn2_u8_to_u32_nfc']

libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['isTimeZoneFile(char const*, char const*)', 'uhash_get_59', 'icu_59::CharString::append(char const*, int, UErrorCode&)', 'doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)', 'uhash_hashChars_59', 'icu_59::Normalizer2::getInstance(char const*, char const*, UNormalization2Mode, UErrorCode&)', '_uhash_put(UHashtable*, UElement, UElement, signed char, UErrorCode*)', 'icu_59::Norm2AllModes::createInstance(char const*, char const*, UErrorCode&)', 'suffix_compare', 'LookupStringInFixedSet']

libpsl/fuzz/libpsl_load_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['isTimeZoneFile(char const*, char const*)', 'uhash_get_59', 'icu_59::CharString::append(char const*, int, UErrorCode&)', 'doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)', 'uhash_hashChars_59', 'icu_59::Normalizer2::getInstance(char const*, char const*, UNormalization2Mode, UErrorCode&)', 'checkDataItem(DataHeader const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, char const*, char const*, UErrorCode*, UErrorCode*)', '_uhash_put(UHashtable*, UElement, UElement, signed char, UErrorCode*)', 'icu_59::Norm2AllModes::createInstance(char const*, char const*, UErrorCode&)', 'icu_59::Mutex::~Mutex()']

libpsl/fuzz/libpsl_load_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_idn2_label_test', 'LookupStringInFixedSet', 'suffix_compare', 'libunistring_u8_casemap', '_idn2_contextj_rule', 'u8_to_u32', '_tr46', '_idn2_u8_to_u32_nfc']

libpsl/fuzz/libpsl_load_dafsa_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_idn2_label_test', 'suffix_compare', 'LookupStringInFixedSet', 'libunistring_u8_casemap', '_idn2_contextj_rule', 'u8_to_u32', '_tr46', '_idn2_u8_to_u32_nfc']

libpsl/fuzz/libpsl_load_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['isTimeZoneFile(char const*, char const*)', 'uhash_get_59', 'icu_59::CharString::append(char const*, int, UErrorCode&)', 'doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)', 'uhash_hashChars_59', 'icu_59::Normalizer2::getInstance(char const*, char const*, UNormalization2Mode, UErrorCode&)', '_uhash_put(UHashtable*, UElement, UElement, signed char, UErrorCode*)', 'icu_59::Norm2AllModes::createInstance(char const*, char const*, UErrorCode&)', 'LookupStringInFixedSet', 'suffix_compare']

libpsl/fuzz/libpsl_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_canonicalize(char const*, char*, int, unsigned int, UErrorCode*)', 'getShortestSubtagLength(char const*)', 'isTimeZoneFile(char const*, char const*)', '_canonicalize(char const*, char*, int, unsigned int, UErrorCode*)', 'ucnv_loadSharedData_59', 'uhash_get_59', '_caseMap(int, unsigned int, int (*)(int, int (*)(void*, signed char), void*, char16_t const**, int), char16_t*, int, char16_t const*, UCaseContext*, int, int, icu_59::Edits*, UErrorCode&)', 'icu_59::CharString::append(char const*, int, UErrorCode&)', 'doLoadFromCommonData(signed char, char const*, char const*, char const*, char const*, char const*, char const*, char const*, signed char (*)(void*, char const*, char const*, UDataInfo const*), void*, UErrorCode*, UErrorCode*)', 'psl_str_to_utf8lower']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
u8_check	49	25	51.02%	['libpsl_idn_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_idn_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_idn_load_fuzzer']
g_unichar_to_utf8	45	21	46.66%	['libpsl_idn_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_idn_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_idn_load_fuzzer']
combine	44	21	47.72%	['libpsl_idn_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_idn_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_idn_load_fuzzer']
libunistring_u8_casemap	299	158	52.84%	['libpsl_idn2_load_fuzzer', 'libpsl_idn2_fuzzer', 'libpsl_idn2_load_dafsa_fuzzer', 'libpsl_idn_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
_idn2_bidi	51	5	9.803%	['libpsl_idn2_load_fuzzer', 'libpsl_idn2_fuzzer', 'libpsl_idn2_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
_idn2_contextj_rule	59	6	10.16%	['libpsl_idn2_load_fuzzer', 'libpsl_idn2_fuzzer', 'libpsl_idn2_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
_tr46	190	71	37.36%	['libpsl_idn2_load_fuzzer', 'libpsl_idn2_fuzzer', 'libpsl_idn2_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
u8_mbtoucr	104	23	22.11%	['libpsl_idn2_load_fuzzer', 'libpsl_idn2_fuzzer', 'libpsl_idn2_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
udata_checkCommonData_59	38	19	50.0%	['libpsl_icu_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_load_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_icu_fuzzer']
doOpenChoice(charconst*,charconst*,charconst*,signedchar(*)(void*,charconst*,charconst*,UDataInfoconst*),void*,UErrorCode*)	127	51	40.15%	['libpsl_icu_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_load_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_icu_fuzzer']
openCommonData(charconst*,int,UErrorCode*)	60	24	40.0%	['libpsl_icu_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_load_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_icu_fuzzer']
_uhash_put(UHashtable*,UElement,UElement,signedchar,UErrorCode*)	33	17	51.51%	['libpsl_icu_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_load_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_icu_fuzzer']
u_strFromUTF8WithSub_59	251	66	26.29%	['libpsl_icu_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_load_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_icu_fuzzer']
u_strToUTF8WithSub_59	211	116	54.97%	['libpsl_icu_load_dafsa_fuzzer', '/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_load_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c', 'libpsl_icu_fuzzer']
uprv_getDefaultLocaleID_59	70	25	35.71%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
ucase_getCaseLocale_59	122	8	6.557%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
ucnv_close_59	54	16	29.62%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
ucnv_toUChars_59	44	21	47.72%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
_reset(UConverter*,UConverterResetChoice,signedchar)	55	17	30.90%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
_toUnicodeWithCallback(UConverterToUnicodeArgs*,UErrorCode*)	153	83	54.24%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
ucnv_flushCache_59	37	13	35.13%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
parseConverterOptions(charconst*,UConverterNamePieces*,UConverterLoadArgs*,UErrorCode*)	58	16	27.58%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
_getVariantEx(charconst*,char,char*,int,signedchar)	48	16	33.33%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
_canonicalize(charconst*,char*,int,unsignedint,UErrorCode*)	202	92	45.54%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
ustrcase_mapWithOverlap_59	46	23	50.0%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']
icu_59::UnicodeString::copyFrom(icu_59::UnicodeStringconst&,signedchar)	54	14	25.92%	['/src/libpsl/fuzz/libpsl_load_dafsa_fuzzer.c', 'libpsl_icu_load_fuzzer', '/src/libpsl/fuzz/libpsl_fuzzer.c', '/src/libpsl/fuzz/libpsl_load_fuzzer.c']