Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues
Project coverage
Per-fuzzer coverage

Table of contents

Project overview: libredwg
High level conclusions
Reachability and coverage overview
Fuzzers overview
Project functions overview
Fuzzer details
Fuzzer: llvmfuzz
Call tree
Fuzz blockers
Runtime coverage analysis
Files reached
Analyses and suggestions
Optimal target analysis
Remaining optimal interesting functions
All functions overview
Fuzz engine guidance
examples/llvmfuzz.c
Dictionary
Fuzzer function priority
Runtime coverage analysis
Complex functions with low coverage
Files and Directories in report
Files in report
Directories in report
Metadata section
Report generation date: 2025-12-31

Project overview: libredwg

High level conclusions

Reachability and coverage overview

Functions statically reachable by fuzzers
76.0%
4174 / 5461
Cyclomatic complexity statically reachable by fuzzers
98.0%
485787 / 495680
Runtime code coverage of functions
11.0%
587 / 5461

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
llvmfuzz examples/llvmfuzz.c 4225 1294 14 27 1469082 485898 llvmfuzz.c

Project functions overview

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name Functions filename Args Function call depth Reached by Fuzzers Runtime reached by Fuzzers Combined reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzzer details

Fuzzer: llvmfuzz

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 72868 89.4%
gold [1:9] 436 0.53%
yellow [10:29] 432 0.53%
greenyellow [30:49] 446 0.54%
lawngreen 50+ 7291 8.94%
All colors 81473 100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
42102 39368 dwg_encode call site: 39368 encode_objects_handles
14395 13178 dwg_decode_variable_type call site: 13178 dwg_decode_MULTILEADER
1388 29161 dwg_free_variable_type call site: 29161 dwg_free_variable_no_class
1068 8475 dwg_decode_handleref call site: 08475 bit_TV_to_utf8
743 33775 add_PERSUBENTMGR call site: 33775 add_ASSOCACTION
657 27792 bit_write_RC call site: 27792 read_2004_section_handles
474 36752 dwg_encode call site: 36752 encode_unknown_as_dummy
471 32939 new_object call site: 32939 dwg_encode_get_class
440 1272 bit_read_fixed call site: 01272 dwg_ref_tblname
378 32560 new_object call site: 32560 dwg_encode_get_class
310 31002 _set_struct_field call site: 31002 _set_struct_field
241 28492 bit_chain_init_dat call site: 28492 read_2007_section_handles

Runtime coverage analysis

Covered functions
588
Functions that are reachable but not covered
3637
Reachable functions
4225
Percentage of reachable functions covered
13.92%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
examples/llvmfuzz.c 2
src/decode.c 80
src/hash.c 7
src/common.c 12
src/decode_r11.c 6
src/bits.c 122
src/codepages.c 13
src/dwg_api.c 42
src/dwg.c 77
src/classes.c 12
src/encode.c 70
src/gen-dynapi.pl 33
src/src/dxfclasses.in 3
/usr/include/x86_64-linux-gnu/bits/byteswap.h 1
src/./dwg.spec 3359
src/decode_r2007.c 39
src/free.c 19
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h 2
src/in_json.c 53
src/./../jsmn/jsmn.h 6
src/src/objects.in 3
src/in_dxf.c 111
src/out_dxf.c 39
src/out_dxfb.c 25
src/out_json.c 39
src/out_geojson.c 7
src/geom.c 2

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name Functions filename Arg count Args Function depth hitcount instr count bb count cyclomatic complexity Reachable functions Incoming references total cyclomatic complexity Unreached complexity
dwg_add_Attribute /src/libredwg/src/dwg_api.c 7 ['N/A', 'double', 'int', 'N/A', 'N/A', 'N/A', 'N/A'] 12 0 361 72 27 72 0 832 154
dwg_add_POLYLINE_PFACE /src/libredwg/src/dwg_api.c 5 ['N/A', 'int', 'int', 'N/A', 'N/A'] 11 0 911 133 47 67 0 793 129
dwg_add_WEDGE /src/libredwg/src/dwg_api.c 6 ['N/A', 'N/A', 'N/A', 'double', 'double', 'double'] 11 0 330 26 10 78 0 698 85

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers
77.0%
4193 / 5461
Cyclomatic complexity statically reachable by fuzzers
98.0%
486155 / 495680

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name Functions filename Args Function call depth Reached by Fuzzers Runtime reached by Fuzzers Combined reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzz engine guidance

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

examples/llvmfuzz.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag


Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name 

-focus_function=['dwg_encode', 'dwg_decode_variable_type', 'dwg_free_variable_type', 'dwg_decode_handleref', 'add_PERSUBENTMGR', 'bit_write_RC', 'new_object', 'bit_read_fixed']

Runtime coverage analysis

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name Function total lines Lines covered at runtime percentage covered Reached by fuzzers
LLVMFuzzerTestOneInput 131 71 54.19%
bit_write_H 36 14 38.88% ['llvmfuzz']
bit_write_TV 38 17 44.73% ['llvmfuzz']
bit_utf8_to_TV 134 30 22.38% ['llvmfuzz']
bit_read_CMC 38 8 21.05% ['llvmfuzz']
dwg_decode_handleref 81 41 50.61% ['llvmfuzz']
dwg_fixup_BLOCKS_entities 170 34 20.0% ['llvmfuzz']
dwg_decode_xdata 207 62 29.95% ['llvmfuzz']
read_r2007_meta_data 76 9 11.84% ['llvmfuzz']
dwg_model_space_ref 35 13 37.14% ['llvmfuzz']
dwg_model_space_object 35 7 20.0% ['llvmfuzz']
dwg_find_dictionary 35 9 25.71% ['llvmfuzz']
dwg_ctrl_table 137 39 28.46% ['llvmfuzz']
dwg_decode_LAYER_private 134 67 50.0% ['llvmfuzz']
dwg_decode_LTYPE_private 117 64 54.70% ['llvmfuzz']
dwg_decode_VIEW_private 97 49 50.51% ['llvmfuzz']
dwg_decode_VPORT_private 172 63 36.62% ['llvmfuzz']
dwg_decode_DIMENSION_LINEAR_private 40 15 37.5% ['llvmfuzz']
dwg_decode_DIMENSION_ALIGNED_private 34 13 38.23% ['llvmfuzz']
dwg_decode_DIMENSION_ANG3PT_private 41 13 31.70% ['llvmfuzz']
dwg_decode_DIMENSION_ANG2LN_private 47 17 36.17% ['llvmfuzz']
dwg_decode_MTEXT_private 91 26 28.57% ['llvmfuzz']
dwg_decode_HATCH_private 191 87 45.54% ['llvmfuzz']
dwg_decode_LAYOUT_private 121 66 54.54% ['llvmfuzz']
dwg_free_HATCH_private 191 81 42.40% ['llvmfuzz']
dwg_free_INSERT_private 162 86 53.08% ['llvmfuzz']
dwg_free_JUMP_private 48 3 6.25% ['llvmfuzz']
dwg_free_MINSERT_private 117 45 38.46% ['llvmfuzz']
dwg_free_MTEXT_private 91 26 28.57% ['llvmfuzz']
dwg_free_VERTEX_2D_private 75 38 50.66% ['llvmfuzz']
dwg_free_LAYER_private 134 67 50.0% ['llvmfuzz']
dwg_free_LAYOUT_private 121 57 47.10% ['llvmfuzz']
dwg_free_LTYPE_private 125 61 48.8% ['llvmfuzz']
dwg_free_VIEW_private 97 44 45.36% ['llvmfuzz']
dwg_free_VPORT_private 172 83 48.25% ['llvmfuzz']
dwg_free_XRECORD_private 51 18 35.29% ['llvmfuzz']
dwg_encode_TEXT_private 146 27 18.49% ['llvmfuzz']
dwg_encode_ATTRIB_private 185 38 20.54% ['llvmfuzz']
dwg_encode_ATTDEF_private 194 40 20.61% ['llvmfuzz']
dwg_encode_INSERT_private 163 22 13.49% ['llvmfuzz']
dwg_encode_VERTEX_2D_private 76 19 25.0% ['llvmfuzz']
dwg_encode_POLYLINE_2D_private 84 24 28.57% ['llvmfuzz']
dwg_encode_POLYLINE_3D_private 55 23 41.81% ['llvmfuzz']
dwg_encode_LINE_private 66 15 22.72% ['llvmfuzz']
dwg_encode_DIMENSION_ORDINATE_private 43 15 34.88% ['llvmfuzz']
dwg_encode_DIMENSION_LINEAR_private 41 17 41.46% ['llvmfuzz']
dwg_encode_DIMENSION_ALIGNED_private 35 14 40.0% ['llvmfuzz']
dwg_encode_DIMENSION_ANG3PT_private 42 14 33.33% ['llvmfuzz']
dwg_encode_DIMENSION_ANG2LN_private 48 14 29.16% ['llvmfuzz']
dwg_encode__3DFACE_private 92 25 27.17% ['llvmfuzz']
dwg_encode_POLYLINE_PFACE_private 42 19 45.23% ['llvmfuzz']
dwg_encode_POLYLINE_MESH_private 66 25 37.87% ['llvmfuzz']
dwg_encode_SHAPE_private 46 11 23.91% ['llvmfuzz']
dwg_encode_VIEWPORT_private 125 21 16.8% ['llvmfuzz']
dwg_insert_entity 113 36 31.85% ['llvmfuzz']
dwg_add_DICTIONARY 31 11 35.48% ['llvmfuzz']
dwg_dynapi_common_value 45 21 46.66% ['llvmfuzz']
dwg_dynapi_common_set_value 82 31 37.80% ['llvmfuzz']
dwg_dynapi_subclass_name 46 13 28.26% ['llvmfuzz']
dynapi_set_helper 44 20 45.45% ['llvmfuzz']
dwg_encode 1137 136 11.96% ['llvmfuzz']
dwg_encode_get_class 59 5 8.474% ['llvmfuzz']
in_postprocess_handles 77 22 28.57% ['llvmfuzz']
remove_EXEMPT_FROM_CAD_STANDARDS_APPID 48 11 22.91% ['llvmfuzz']
encode_preR13_entities 237 100 42.19% ['llvmfuzz']
dwg_encode_entity 49 21 42.85% ['llvmfuzz']
dwg_free_variable_type 33 9 27.27% ['llvmfuzz']
dxf_tables_read 222 109 49.09% ['llvmfuzz']
new_table_control 227 81 35.68% ['llvmfuzz']
add_eed 309 93 30.09% ['llvmfuzz']
new_object 3193 639 20.01% ['llvmfuzz']
add_xdata 152 81 53.28% ['llvmfuzz']
add_SPLINE 199 69 34.67% ['llvmfuzz']
get_numfield_value 31 11 35.48% ['llvmfuzz']
add_TABLEGEOMETRY_Cell 170 45 26.47% ['llvmfuzz']
resolve_postponed_eed_refs 35 4 11.42% ['llvmfuzz']
dxf_blocks_read 188 78 41.48% ['llvmfuzz']
resolve_postponed_object_refs 99 32 32.32% ['llvmfuzz']
dxf_entities_read 91 38 41.75% ['llvmfuzz']
json_string 53 19 35.84% ['llvmfuzz']
json_OBJECTS 578 183 31.66% ['llvmfuzz']
_set_struct_field 769 59 7.672% ['llvmfuzz']
json_SummaryInfo 115 13 11.30% ['llvmfuzz']

Files and Directories in report

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file Reached by Covered by
[] []
/src/libredwg/src/out_json.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/out_dxf.c ['llvmfuzz'] []
/src/libredwg/src/decode.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/out_geojson.c ['llvmfuzz'] []
/src/libredwg/examples/llvmfuzz.c ['llvmfuzz'] ['llvmfuzz']
/usr/include/x86_64-linux-gnu/bits/byteswap.h ['llvmfuzz'] []
/src/libredwg/src/encode.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/geom.c ['llvmfuzz'] []
/src/libredwg/src/free.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/decode_r2007.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/./../jsmn/jsmn.h ['llvmfuzz'] []
/src/libredwg/src/bits.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/codepages.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/in_dxf.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/src/dxfclasses.in ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/./dwg.spec ['llvmfuzz'] []
/src/libredwg/src/in_json.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/classes.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/common.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/hash.c ['llvmfuzz'] ['llvmfuzz']
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h ['llvmfuzz'] []
/src/libredwg/src/gen-dynapi.pl ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/src/objects.in ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/decode_r11.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/dwg.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/dwg_api.c ['llvmfuzz'] ['llvmfuzz']
/src/libredwg/src/out_dxfb.c ['llvmfuzz'] []

Directories in report

Directory
/usr/include/x86_64-linux-gnu/bits/
/src/libredwg/src/src/
/src/libredwg/src/./
/src/libredwg/examples/
/src/libredwg/src/
/src/libredwg/src/./../jsmn/

Metadata section

This sections shows the raw data that is used to produce this report. This is mainly used for further processing and developer debugging.

Fuzzer Calltree file Program data file Coverage file
llvmfuzz fuzzerLogFile-0-5IoUuVvnSe.data fuzzerLogFile-0-5IoUuVvnSe.data.yaml llvmfuzz.covreport