Project overview

High level conclusions

Fuzzers reach 75.47% of all functions. This is good

Fuzzers reach 67.30% of cyclomatic complexity. This is okay.

Reachability and coverage overview

Functions statically reachable by fuzzers

40/53

Cyclomatic complexity statically reachable by fuzzers

175/260

Functions covered at runtime

Fuzzers overview

Fuzzer	Fuzzer filename	Functions Reached	Functions unreached	Fuzzer depth	Files reached	Basic blocks reached	Cyclomatic complexity	Details
fuzz_regex	tests/./fuzzers/fuzz_regex.c	40	13	14	4	454	175	fuzz_regex.c

Project functions overview

The following table shows data about each function in the project. The functions included in this table corresponds to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer details

Fuzzer: fuzz_regex

Call tree overview

The following is the call tree with color coding for which functions are hit/not hit. This info is based on the coverage achieved of all fuzzers together and not just this specific fuzzer. This should change in the future to be per-fuzzer-basis.

For further technical details on what the call tree overview is, please see the Glossary .

Full calltree

The following link provides a visualisation of the full calltree overlayed with coverage information: full calltree

For futher technical details on how the call tree is made, please see the Glossary .

Fuzz blockers

The followings nodes represent call sites where fuzz blockers occur

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	155	re_regcomp	call site	die
1	201	compile	call site	toupperrune

Functions hit (dynamic analysis based)

Covered functions

Functions that are reachable but not covered

Reachable functions

Percentage of reachable functions covered

80.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation our of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files hit

filename	functions hit
tests/./fuzzers/fuzz_regex.c	1
src/regexp.c	31
/	6
src/./rd.h	3

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination reaches a high amount of code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
`match`	/src/librdkafka/src/regexp.c	5	['struct.Reinst ', 'char ', 'char ', 'int ', 'struct.Resub ']	4	0	542	105	36	11	2	109	100

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

48/53