High level conclusions

Fuzzers reach 61.34% code coverage.

Fuzzers reach 75.70% of cyclomatic complexity.

Fuzzers reach 62.15% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1682 / 2706

Cyclomatic complexity statically reachable by fuzzers

25175 / 33255

Runtime code coverage of functions

1660 / 2706

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	45	14.1%
gold	[1:9]	32	10.0%
yellow	[10:29]	13	4.10%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	227	71.6%
All colors	317	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
26	26	1 : View List ['xmlDictFree']	26	26	xmlHashFree	call site: 00311	/src/libxml2/hash.c:255
12	12	1 : View List ['xmlHashGrow']	12	12	xmlHashCreate	call site: 00042	/src/libxml2/hash.c:182
8	8	3 : View List ['__errno_location', 'abort', 'getentropy']	8	8	xmlInitRandom	call site: 00009	/src/libxml2/dict.c:942
2	2	1 : View List ['abort']	2	2	xmlFuzzCheckMallocFailure	call site: 00132	/src/libxml2/fuzz/fuzz.c:123
0	24	1 : View List ['xmlParse3986DecOctet']	0	95	xmlParse3986Host	call site: 00083	/src/libxml2/uri.c:488
0	5	1 : View List ['xmlStrndup']	0	5	xmlStrncat	call site: 00187	/src/libxml2/xmlstring.c:464
0	0	None	26	26	xmlHashFree	call site: 00311	/src/libxml2/hash.c:233
0	0	None	6	6	xmlInitMemoryInternal	call site: 00016	/src/libxml2/xmlmemory.c:851
0	0	None	4	304	xmlBuildURISafe	call site: 00265	/src/libxml2/uri.c:2213
0	0	None	0	918	xmlURIEscape	call site: 00190	/src/libxml2/uri.c:1787
0	0	None	0	272	xmlBuildURISafe	call site: 00264	/src/libxml2/uri.c:2100
0	0	None	0	272	xmlBuildURISafe	call site: 00264	/src/libxml2/uri.c:2126

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

27

Reachable functions

109

Percentage of reachable functions covered

75.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/uri.c	1
fuzz/fuzz.c	7
hash.c	3
threads.c	6
dict.c	6
xmlmemory.c	1
globals.c	7
error.c	1
encoding.c	1
xpath.c	1
xmlIO.c	2
uri.c	42
xmlstring.c	12

Fuzzer: regexp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	97	23.5%
gold	[1:9]	46	11.1%
yellow	[10:29]	10	2.42%
greenyellow	[30:49]	4	0.97%
lawngreen	50+	255	61.8%
All colors	412	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
113	226	2 : View List ['__xmlStructuredError', '__xmlStructuredErrorContext']	113	226	xmlRaiseMemoryError	call site: 00077	/src/libxml2/error.c:652
113	226	2 : View List ['__xmlStructuredError', '__xmlStructuredErrorContext']	113	226	xmlVRaiseError	call site: 00117	/src/libxml2/error.c:730
59	59	1 : View List ['xmlCopyError']	271	723	xmlVRaiseError	call site: 00095	/src/libxml2/error.c:723
26	26	1 : View List ['xmlDictFree']	26	26	xmlHashFree	call site: 00405	/src/libxml2/hash.c:255
12	12	1 : View List ['xmlHashGrow']	12	12	xmlHashCreate	call site: 00042	/src/libxml2/hash.c:182
8	8	3 : View List ['__errno_location', 'abort', 'getentropy']	8	8	xmlInitRandom	call site: 00009	/src/libxml2/dict.c:942
7	7	1 : View List ['xmlStrEqual']	7	7	xmlFACompareRanges	call site: 00375	/src/libxml2/xmlregexp.c:2055
2	2	1 : View List ['abort']	2	2	xmlVRaiseError	call site: 00090	/src/libxml2/error.c:701
0	355	1 : View List ['xmlRegexpErrCompile']	0	355	xmlFAParseAtom	call site: 00130	/src/libxml2/xmlregexp.c:5196
0	355	1 : View List ['xmlRegexpErrCompile']	0	355	xmlRegAtomAddRange	call site: 00220	/src/libxml2/xmlregexp.c:1177
0	355	1 : View List ['xmlRegexpErrCompile']	0	355	xmlRegAtomPush	call site: 00184	/src/libxml2/xmlregexp.c:1241
0	140	1 : View List ['xmlRegStatePush']	0	514	xmlFAGenerateCountedEpsilonTransition	call site: 00173	/src/libxml2/xmlregexp.c:1435

Runtime coverage analysis

Covered functions

269

Functions that are reachable but not covered

40

Reachable functions

175

Percentage of reachable functions covered

77.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/regexp.c	1
fuzz/fuzz.c	6
hash.c	3
threads.c	6
dict.c	6
xmlmemory.c	1
globals.c	11
error.c	11
encoding.c	1
xpath.c	1
xmlIO.c	2
xmlregexp.c	58
xmlstring.c	7
tree.c	2
chvalid.c	1
xmlunicode.c	37

Fuzzer: html

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1510	58.1%
gold	[1:9]	74	2.85%
yellow	[10:29]	23	0.88%
greenyellow	[30:49]	16	0.61%
lawngreen	50+	973	37.4%
All colors	2596	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3914	4393	3 : View List ['xmlExpandEntitiesInAttValue', 'xmlValidateOneAttribute', 'xmlValidCtxtNormalizeAttributeValue']	3914	4393	xmlSAX2AttributeInternal	call site: 00880	/src/libxml2/SAX2.c:1182
2064	2064	5 : View List ['xmlFreeURI', 'xmlNsWarnMsg', 'xmlNewNs', 'xmlParseURISafe', 'xmlValidateOneNamespace']	3354	3759	xmlSAX2AttributeInternal	call site: 00728	/src/libxml2/SAX2.c:1043
1604	1604	1 : View List ['xmlValidateOneElement']	1604	1608	xmlSAX2EndElement	call site: 00992	/src/libxml2/SAX2.c:1632
1390	2226	2 : View List ['xmlFreeNode', 'xmlStringGetNodeList']	1390	2226	xmlNewDocNodeEatName	call site: 00363	/src/libxml2/tree.c:2332
1390	1390	1 : View List ['xmlStringGetNodeList']	1616	1616	xmlNewDocProp	call site: 02415	/src/libxml2/tree.c:2021
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2ProcessingInstruction	call site: 01427	/src/libxml2/SAX2.c:2556
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2Comment	call site: 01445	/src/libxml2/SAX2.c:2604
1078	2750	2 : View List ['xmlFreeNode', 'xmlNodeAddContent']	1078	2750	xmlAddChild	call site: 00410	/src/libxml2/tree.c:3371
994	994	1 : View List ['xmlCopyEntitiesTable']	3145	3972	xmlCopyDtd	call site: 02391	/src/libxml2/tree.c:4533
988	988	2 : View List ['xmlValidateDtdFinal', 'xmlValidateRoot']	988	988	xmlSAX2StartElement	call site: 00957	/src/libxml2/SAX2.c:1596
803	803	1 : View List ['xmlFreeEntitiesTable']	803	803	xmlFreeDtd	call site: 00105	/src/libxml2/tree.c:1088
767	767	1 : View List ['xmlCopyElementTable']	4361	5188	xmlCopyDtd	call site: 02365	/src/libxml2/tree.c:4521

Runtime coverage analysis

Covered functions

332

Functions that are reachable but not covered

350

Reachable functions

667

Percentage of reachable functions covered

47.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/html.c	1
fuzz/fuzz.c	7
hash.c	19
threads.c	9
dict.c	17
xmlmemory.c	1
globals.c	21
error.c	16
encoding.c	16
xpath.c	1
xmlIO.c	19
HTMLparser.c	64
SAX2.c	22
tree.c	73
valid.c	77
parserInternals.c	28
xmlstring.c	17
xmlregexp.c	56
entities.c	11
list.c	9
uri.c	27
parser.c	30
chvalid.c	1
buf.c	22
HTMLtree.c	6
xmlunicode.c	37
catalog.c	9
xzlib.c	7
xmlsave.c	3

Fuzzer: schema

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2229	35.5%
gold	[1:9]	382	6.08%
yellow	[10:29]	185	2.94%
greenyellow	[30:49]	90	1.43%
lawngreen	50+	3388	54.0%
All colors	6274	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7153	29990	19 : View List ['xmlSchemaCleanupDoc', 'xmlSchemaBucketCreate', 'xmlCtxtSetErrorHandler', 'xmlStrdup', 'xmlSchemaGetProp', 'xmlSchemaPErrMemory', 'xmlSchemaPErr', 'xmlNewParserCtxt', 'xmlCtxtReadFile', 'xmlDictLookup', 'xmlDocGetRootElement', 'xmlGetLastError', 'xmlSchemaInternalErr', 'xmlFreeParserCtxt', 'xmlFreeDoc', 'xmlCtxtReadMemory', 'xmlDictFree', 'xmlSchemaCustomErr', 'xmlDictReference']	7153	30004	xmlSchemaAddSchemaDoc	call site: 00420	/src/libxml2/xmlschemas.c:10401
6580	6580	1 : View List ['xmlSchemaCheckSRCRedefineSecond']	6583	21537	xmlSchemaFixupComponents	call site: 06050	/src/libxml2/xmlschemas.c:21099
1866	1866	1 : View List ['xmlParseStartTag']	2602	4824	xmlParseElementStart	call site: 03196	/src/libxml2/parser.c:9891
1604	1604	1 : View List ['xmlValidateOneElement']	1604	1608	xmlSAX2EndElementNs	call site: 01123	/src/libxml2/SAX2.c:2306
1390	2226	2 : View List ['xmlFreeNode', 'xmlStringGetNodeList']	1390	2226	xmlNewDocNodeEatName	call site: 00466	/src/libxml2/tree.c:2332
1390	1390	1 : View List ['xmlStringGetNodeList']	1616	1616	xmlNewDocProp	call site: 03495	/src/libxml2/tree.c:2021
1390	1390	1 : View List ['xmlStringGetNodeList']	1390	1390	xmlNewDocNode	call site: 00724	/src/libxml2/tree.c:2299
1289	1289	1 : View List ['xmlSchemaValidateQName']	1289	11196	xmlSchemaVCheckCVCSimpleType	call site: 05363	/src/libxml2/xmlschemas.c:24491
1196	1196	1 : View List ['xmlParseEndTag1']	1211	1211	xmlParseElementEnd	call site: 03385	/src/libxml2/parser.c:9991
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2ProcessingInstruction	call site: 03005	/src/libxml2/SAX2.c:2556
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2Comment	call site: 03022	/src/libxml2/SAX2.c:2604
1078	2750	2 : View List ['xmlFreeNode', 'xmlNodeAddContent']	1078	2750	xmlAddChild	call site: 00632	/src/libxml2/tree.c:3371

Runtime coverage analysis

Covered functions

1051

Functions that are reachable but not covered

241

Reachable functions

1182

Percentage of reachable functions covered

79.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/schema.c	1
fuzz/fuzz.c	8
hash.c	29
threads.c	9
dict.c	22
xmlmemory.c	1
globals.c	24
error.c	17
encoding.c	14
xpath.c	2
xmlIO.c	12
xmlstring.c	19
xmlschemas.c	278
xmlschemastypes.c	62
xmlregexp.c	84
tree.c	92
parserInternals.c	36
SAX2.c	39
buf.c	20
entities.c	14
valid.c	88
list.c	9
parser.c	143
chvalid.c	1
xmlunicode.c	37
HTMLtree.c	1
uri.c	37
xzlib.c	7
catalog.c	11
HTMLparser.c	1
pattern.c	21
xmlreader.c	1

Fuzzer: xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3190	56.5%
gold	[1:9]	127	2.25%
yellow	[10:29]	87	1.54%
greenyellow	[30:49]	49	0.86%
lawngreen	50+	2188	38.7%
All colors	5641	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
9726	9732	3 : View List ['xmlTextReaderValidatePush', 'xmlTextReaderValidateCData', 'xmlStrlen']	9829	9835	xmlTextReaderRead	call site: 05436	/src/libxml2/xmlreader.c:1499
1866	1866	1 : View List ['xmlParseStartTag']	2602	4824	xmlParseElementStart	call site: 02923	/src/libxml2/parser.c:9891
1604	1604	1 : View List ['xmlValidateOneElement']	1604	1608	xmlSAX2EndElementNs	call site: 00851	/src/libxml2/SAX2.c:2306
1353	2227	4 : View List ['xmlFreeNode', 'xmlStrcat', 'xmlNodeSetContent', 'xmlStrdup']	1353	2227	xmlAddNextSibling	call site: 00402	/src/libxml2/tree.c:3051
1196	1196	1 : View List ['xmlParseEndTag1']	1211	1211	xmlParseElementEnd	call site: 03112	/src/libxml2/parser.c:9991
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2ProcessingInstruction	call site: 02738	/src/libxml2/SAX2.c:2556
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2Comment	call site: 02755	/src/libxml2/SAX2.c:2604
1078	2750	2 : View List ['xmlFreeNode', 'xmlNodeAddContent']	1078	2750	xmlAddChild	call site: 00354	/src/libxml2/tree.c:3371
1078	1078	1 : View List ['xmlNodeAddContent']	1078	1914	xmlAddNextSibling	call site: 00338	/src/libxml2/tree.c:3046
1060	1060	1 : View List ['xmlSchemaSAXUnplug']	3875	5381	xmlFreeTextReader	call site: 05496	/src/libxml2/xmlreader.c:2137
959	959	1 : View List ['xmlSchemaFree']	1867	3373	xmlFreeTextReader	call site: 05590	/src/libxml2/xmlreader.c:2146
948	948	1 : View List ['xmlSchemaFreeValidCtxt']	2815	4321	xmlFreeTextReader	call site: 05504	/src/libxml2/xmlreader.c:2141

Runtime coverage analysis

Covered functions

649

Functions that are reachable but not covered

665

Reachable functions

1292

Percentage of reachable functions covered

48.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xml.c	1
fuzz/fuzz.c	10
hash.c	30
threads.c	9
dict.c	22
xmlmemory.c	1
globals.c	27
error.c	16
encoding.c	16
xpath.c	158
xmlIO.c	23
xmlstring.c	18
parserInternals.c	37
SAX2.c	39
tree.c	91
buf.c	21
entities.c	15
valid.c	93
list.c	9
xmlregexp.c	57
parser.c	153
chvalid.c	1
xmlunicode.c	37
HTMLtree.c	1
uri.c	37
xzlib.c	7
catalog.c	11
HTMLparser.c	1
xmlsave.c	10
xmlreader.c	36
xinclude.c	28
pattern.c	8
relaxng.c	56
xpointer.c	9
./timsort.h	12
xmlschemas.c	41
xmlschemastypes.c	1

Fuzzer: xpath

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1874	42.9%
gold	[1:9]	168	3.85%
yellow	[10:29]	74	1.69%
greenyellow	[30:49]	36	0.82%
lawngreen	50+	2211	50.6%
All colors	4363	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1866	1866	1 : View List ['xmlParseStartTag']	2602	4824	xmlParseElementStart	call site: 02902	/src/libxml2/parser.c:9891
1604	1604	1 : View List ['xmlValidateOneElement']	1604	1608	xmlSAX2EndElementNs	call site: 00844	/src/libxml2/SAX2.c:2306
1353	2227	4 : View List ['xmlFreeNode', 'xmlStrcat', 'xmlNodeSetContent', 'xmlStrdup']	1353	2227	xmlAddNextSibling	call site: 00386	/src/libxml2/tree.c:3051
1196	1196	1 : View List ['xmlParseEndTag1']	1211	1211	xmlParseElementEnd	call site: 03091	/src/libxml2/parser.c:9991
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2ProcessingInstruction	call site: 02732	/src/libxml2/SAX2.c:2556
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2Comment	call site: 02749	/src/libxml2/SAX2.c:2604
1112	2567	4 : View List ['xmlStrEqual', 'xmlFatalErrMsg', 'xmlParseTextDecl', 'xmlDetectEncoding']	1112	10262	xmlCtxtParseContent	call site: 03143	/src/libxml2/parser.c:12010
1088	3307	4 : View List ['xmlNewDoc', 'xmlNewDtd', 'xmlSAX2EntityDecl', 'xmlErrMemory']	1088	7153	xmlParseEntityDecl	call site: 02085	/src/libxml2/parser.c:5785
1078	2750	2 : View List ['xmlFreeNode', 'xmlNodeAddContent']	1078	2750	xmlAddChild	call site: 00337	/src/libxml2/tree.c:3371
1078	1078	1 : View List ['xmlNodeAddContent']	1078	1914	xmlAddNextSibling	call site: 00321	/src/libxml2/tree.c:3046
1076	1588	4 : View List ['xmlBuildURISafe', 'xmlStrlen', 'xmlSAX2ErrMemory', 'xmlFatalErr']	1076	1588	xmlSAX2EntityDecl	call site: 02114	/src/libxml2/SAX2.c:561
836	836	1 : View List ['htmlNewDocNoDtD']	1175	1175	xmlSAX2StartDocument	call site: 02657	/src/libxml2/SAX2.c:788

Runtime coverage analysis

Covered functions

699

Functions that are reachable but not covered

303

Reachable functions

989

Percentage of reachable functions covered

69.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xpath.c	1
fuzz/fuzz.c	7
hash.c	30
threads.c	9
dict.c	22
xmlmemory.c	1
globals.c	24
error.c	16
encoding.c	14
xpath.c	159
xmlIO.c	12
parser.c	140
parserInternals.c	35
SAX2.c	39
tree.c	81
xmlstring.c	16
buf.c	20
entities.c	14
valid.c	87
list.c	9
xmlregexp.c	56
chvalid.c	1
xmlunicode.c	37
HTMLtree.c	1
uri.c	35
xzlib.c	7
catalog.c	11
HTMLparser.c	1
xpointer.c	8
./timsort.h	12

Fuzzer: xinclude

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1524	27.6%
gold	[1:9]	274	4.97%
yellow	[10:29]	174	3.15%
greenyellow	[30:49]	74	1.34%
lawngreen	50+	3465	62.8%
All colors	5511	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2927	10185	3 : View List ['xmlTextReaderExpand', 'xmlRelaxNGValidatePushElement', 'xmlRelaxNGValidateFullElement']	2927	10185	xmlTextReaderValidatePush	call site: 04985	/src/libxml2/xmlreader.c:871
1993	2495	5 : View List ['xmlFAGenerateCountedTransition', 'xmlRegGetCounter', 'xmlFAGenerateCountedEpsilonTransition', 'xmlFAGenerateTransitions', 'xmlRegCopyAtom']	1993	6494	xmlFAGenerateTransitions	call site: 01012	/src/libxml2/xmlregexp.c:1485
1353	2227	4 : View List ['xmlFreeNode', 'xmlStrcat', 'xmlNodeSetContent', 'xmlStrdup']	1353	2227	xmlAddNextSibling	call site: 00402	/src/libxml2/tree.c:3051
1353	1391	3 : View List ['xmlStrcat', 'xmlNodeSetContent', 'xmlStrdup']	1353	2227	xmlAddPrevSibling	call site: 03513	/src/libxml2/tree.c:3115
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2ProcessingInstruction	call site: 02738	/src/libxml2/SAX2.c:2556
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2Comment	call site: 02755	/src/libxml2/SAX2.c:2604
1060	1060	1 : View List ['xmlSchemaSAXUnplug']	3007	5381	xmlFreeTextReader	call site: 05366	/src/libxml2/xmlreader.c:2137
959	959	1 : View List ['xmlSchemaFree']	999	3373	xmlFreeTextReader	call site: 05460	/src/libxml2/xmlreader.c:2146
948	948	1 : View List ['xmlSchemaFreeValidCtxt']	1947	4321	xmlFreeTextReader	call site: 05374	/src/libxml2/xmlreader.c:2141
874	874	1 : View List ['xmlRelaxNGFree']	4071	6445	xmlFreeTextReader	call site: 05344	/src/libxml2/xmlreader.c:2128
836	836	1 : View List ['htmlNewDocNoDtD']	836	1175	xmlSAX2StartDocument	call site: 02663	/src/libxml2/SAX2.c:788
601	601	1 : View List ['xmlRelaxNGValidatePopElement']	601	601	xmlTextReaderValidatePop	call site: 04843	/src/libxml2/xmlreader.c:979

Runtime coverage analysis

Covered functions

919

Functions that are reachable but not covered

296

Reachable functions

1200

Percentage of reachable functions covered

75.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xinclude.c	1
fuzz/fuzz.c	10
hash.c	30
threads.c	9
dict.c	22
xmlmemory.c	1
globals.c	24
error.c	16
encoding.c	14
xpath.c	158
xmlIO.c	15
xmlstring.c	18
parserInternals.c	37
SAX2.c	39
tree.c	89
buf.c	21
entities.c	15
valid.c	93
list.c	9
xmlregexp.c	57
parser.c	153
chvalid.c	1
xmlunicode.c	37
HTMLtree.c	1
uri.c	37
xzlib.c	7
catalog.c	11
HTMLparser.c	1
xinclude.c	28
xpointer.c	9
./timsort.h	12
xmlreader.c	35
pattern.c	8
relaxng.c	56
xmlschemas.c	41
xmlschemastypes.c	1

Fuzzer: valid

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2536	45.7%
gold	[1:9]	103	1.85%
yellow	[10:29]	125	2.25%
greenyellow	[30:49]	52	0.93%
lawngreen	50+	2724	49.1%
All colors	5540	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2927	10185	3 : View List ['xmlTextReaderExpand', 'xmlRelaxNGValidatePushElement', 'xmlRelaxNGValidateFullElement']	2927	10185	xmlTextReaderValidatePush	call site: 05012	/src/libxml2/xmlreader.c:871
1993	2495	5 : View List ['xmlFAGenerateCountedTransition', 'xmlRegGetCounter', 'xmlFAGenerateCountedEpsilonTransition', 'xmlFAGenerateTransitions', 'xmlRegCopyAtom']	1993	6494	xmlFAGenerateTransitions	call site: 01012	/src/libxml2/xmlregexp.c:1485
1353	2227	4 : View List ['xmlFreeNode', 'xmlStrcat', 'xmlNodeSetContent', 'xmlStrdup']	1353	2227	xmlAddNextSibling	call site: 00402	/src/libxml2/tree.c:3051
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2ProcessingInstruction	call site: 02738	/src/libxml2/SAX2.c:2556
1120	1120	1 : View List ['xmlAddSibling']	1120	1120	xmlSAX2Comment	call site: 02755	/src/libxml2/SAX2.c:2604
1078	2750	2 : View List ['xmlFreeNode', 'xmlNodeAddContent']	1078	2750	xmlAddChild	call site: 00354	/src/libxml2/tree.c:3371
1078	1078	1 : View List ['xmlNodeAddContent']	1078	1914	xmlAddNextSibling	call site: 00338	/src/libxml2/tree.c:3046
1060	1060	1 : View List ['xmlSchemaSAXUnplug']	3875	5381	xmlFreeTextReader	call site: 05395	/src/libxml2/xmlreader.c:2137
959	959	1 : View List ['xmlSchemaFree']	1867	3373	xmlFreeTextReader	call site: 05489	/src/libxml2/xmlreader.c:2146
948	948	1 : View List ['xmlSchemaFreeValidCtxt']	2815	4321	xmlFreeTextReader	call site: 05403	/src/libxml2/xmlreader.c:2141
874	874	1 : View List ['xmlRelaxNGFree']	4939	6445	xmlFreeTextReader	call site: 05373	/src/libxml2/xmlreader.c:2128
868	868	1 : View List ['xmlXIncludeFreeContext']	908	2414	xmlFreeTextReader	call site: 05512	/src/libxml2/xmlreader.c:2152

Runtime coverage analysis

Covered functions

683

Functions that are reachable but not covered

540

Reachable functions

1208

Percentage of reachable functions covered

55.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/valid.c	1
fuzz/fuzz.c	9
hash.c	30
threads.c	9
dict.c	22
xmlmemory.c	1
globals.c	24
error.c	16
encoding.c	14
xpath.c	158
xmlIO.c	15
xmlstring.c	18
parserInternals.c	37
SAX2.c	39
tree.c	89
buf.c	21
entities.c	15
valid.c	97
list.c	9
xmlregexp.c	57
parser.c	154
chvalid.c	1
xmlunicode.c	37
HTMLtree.c	1
uri.c	38
xzlib.c	7
catalog.c	11
HTMLparser.c	1
xmlreader.c	36
xinclude.c	28
pattern.c	8
relaxng.c	56
xpointer.c	9
./timsort.h	12
xmlschemas.c	41
xmlschemastypes.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
xmlTextReaderRelaxNGValidate	/src/libxml2/xmlreader.c	2	['struct._xmlTextReader *', 'char *']	41	0	20	3	2	1042	0	14872	1423
xmlSchemaValidateStream	/src/libxml2/xmlschemas.c	5	['struct._xmlSchemaValidCtxt *', 'struct._xmlParserInputBuffer *', 'int', 'struct._xmlSAXHandler *', 'char *']	45	0	141	22	9	1281	0	18543	1241
xmlDefaultExternalEntityLoader	/src/libxml2/parserInternals.c	3	['char *', 'char *', 'struct._xmlParserCtxt *']	34	0	129	19	8	832	2	10606	568
xmlDOMWrapAdoptNode	/src/libxml2/tree.c	6	['struct._xmlDOMWrapCtxt *', 'struct._xmlDoc *', 'struct._xmlNode *', 'struct._xmlDoc *', 'struct._xmlNode *', 'int']	8	0	766	145	49	45	0	635	348
xmlParseSGMLCatalog	/src/libxml2/catalog.c	4	['struct._xmlCatalog *', 'char *', 'char *', 'int']	12	0	1110	234	79	118	6	1569	252
htmlParseContent	/src/libxml2/HTMLparser.c	1	['struct._xmlParserCtxt *']	24	0	979	161	61	202	2	2209	149
xmlRegexpPrint	/src/libxml2/xmlregexp.c	2	['struct._IO_FILE *', 'struct._xmlRegexp *']	4	0	156	20	7	7	0	112	110

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1945 / 2706

Cyclomatic complexity statically reachable by fuzzers

29092 / 33255

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzz/uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlIsMainThreadInternal', 'xmlURIEscape', 'xmlFuzzDataCleanup', 'xmlInitRandom', 'LLVMFuzzerTestOneInput', 'xmlSaveUri', 'xmlInitMemoryInternal']

fuzz/regexp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlIsMainThreadInternal', 'xmlRegEpxFromParse', 'xmlVRaiseError', 'xmlFAGenerateTransitions', 'xmlFuzzDataCleanup', 'xmlInitRandom', 'xmlRegNewRange', 'xmlVSetError', 'xmlRegFreeAtom']

fuzz/html.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlSAX2InitHtmlDefaultSAXHandler', 'xmlFatalErr', 'xmlStrcat', 'xmlNewDtd', 'xmlOutputBufferWrite', 'xmlParserInputBufferGrow', 'xmlSAX2StartElement', 'xmlAddID', 'xmlAllocOutputBuffer', 'xmlVErrMemory']

fuzz/schema.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlRegEpxFromParse', 'xmlCopyPropInternal', 'xmlSchemaBuildContentModelForElement', 'xmlSplitQName', 'xmlParserInputBufferGrow', 'xmlSAXVersion', 'xmlFreeNode', 'xmlNewReference', 'xmlAddIDSafe', 'xmlValidateNmtokenValueInternal']

fuzz/xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlTextReaderRead', '__xmlRaiseError', 'xmlSAXVersion', 'LLVMFuzzerTestOneInput', 'xmlTextReaderErrMemory', 'xmlCopyPropInternal', 'xmlIOErr', 'xmlParserInputBufferGrow', 'xmlTextReaderSetup', 'xmlAddNextSibling']

fuzz/xpath.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['__xmlRaiseError', 'xmlSAXVersion', 'xmlParseReference', 'xmlSAX2EntityDecl', 'xmlSplitQName', 'xmlParserInputBufferGrow', 'xmlHashAddEntry', 'xmlValidateNmtokenValueInternal', 'xmlParseURISafe', 'xmlAddElementDecl']

fuzz/xinclude.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlTextReaderValidatePush', 'LLVMFuzzerTestOneInput', 'xmlFACompareAtoms', 'xmlTextReaderValidatePop', 'xmlParserInputBufferGrow', 'xmlRegStateAddTransTo', 'xmlXIncludeLoadDoc', 'xmlTextReaderSetup', 'xmlTextReaderRead', 'xmlXPathEqualValuesCommon']

fuzz/valid.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlTextReaderRead', 'xmlTextReaderValidatePush', 'LLVMFuzzerTestOneInput', 'xmlFACompareAtoms', 'xmlTextReaderValidatePop', 'xmlCopyPropInternal', 'xmlParserInputBufferGrow', 'xmlTextReaderSetup', 'xmlAddNextSibling', 'xmlRegStateAddTransTo']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
xmlGetCharEncodingName	53	12	22.64%	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
xmlFindExtraHandler	32	14	43.75%	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
xmlErrString	319	159	49.84%	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
xmlSetTreeDoc	32	16	50.0%	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
xmlAddChild	89	44	49.43%	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
xmlSchemaFreeValidCtxt	70	18	25.71%	['schema', 'xml', 'xinclude', 'valid']
xmlSchemaErr4Line	56	11	19.64%	['schema']
xmlSchemaItemTypeToStr	44	20	45.45%	['schema']
xmlSchemaAddAnnotation	83	15	18.07%	['schema']
xmlSchemaCheckSRCRedefineFirst	104	7	6.730%	['schema']
xmlSchemaResolveIDCKeyReferences	44	22	50.0%	['schema']
xmlSchemaGetCircModelGrDefRef	37	20	54.05%	['schema']
xmlSchemaCheckSTPropsCorrect	53	15	28.30%	['schema']
xmlSchemaCheckCOSSTRestricts	300	124	41.33%	['schema']
xmlSchemaCheckCOSSTDerivedOK	43	21	48.83%	['schema']
xmlSchemaCheckSRCCT	93	24	25.80%	['schema']
xmlSchemaCheckCOSCTExtends	56	30	53.57%	['schema']
xmlSchemaCheckDerivationOKRestriction	98	43	43.87%	['schema']
xmlSchemaBuildContentModelForSubstGroup	71	37	52.11%	['schema']
xmlSchemaValidateNotation	57	28	49.12%	['schema']
xmlSchemaGetBuiltInType	101	42	41.58%	['schema']
xmlSchemaGetCanonValue	326	76	23.31%	['schema']
xmlSchemaCompareValuesInternal	207	91	43.96%	['schema']
xmlSchemaCompareDates	245	112	45.71%	['schema']
xmlSchemaValidateFacetInternal	169	61	36.09%	['schema']
xmlAddNextSibling	43	21	48.83%	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
xmlBufferResize	78	41	52.56%	['xml']
__xmlIOErr	187	24	12.83%	['html', 'xml']
xmlTextReaderSetup	157	75	47.77%	['xml', 'xinclude', 'valid']
xmlNewSaveCtxt	31	16	51.61%	['xml']
xmlXPathNodeSetAdd	34	18	52.94%	['xml', 'xpath', 'xinclude', 'valid']
xmlXPathObjectCopy	38	17	44.73%	['xml', 'xpath', 'xinclude', 'valid']
xmlXPathCacheObjectCopy	31	16	51.61%	['xml', 'xpath', 'xinclude', 'valid']
xmlAddPrevSibling	44	22	50.0%	['xml', 'xinclude', 'valid']
xmlNodeSetBase	54	17	31.48%	['xml', 'xinclude', 'valid']
xmlNodeAddContentLen	58	30	51.72%	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
xmlXIncludeMergeEntities	37	14	37.83%	['xml', 'xinclude', 'valid']
xmlRegExecPushStringInternal	232	107	46.12%	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libxml2/list.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/xinclude.c	['xml', 'xinclude', 'valid']	['xinclude']
/src/libxml2/relaxng.c	['xml', 'xinclude', 'valid']	[]
/src/libxml2/fuzz/uri.c	['uri']	['uri']
/src/libxml2/fuzz/regexp.c	['regexp']	['regexp']
/src/libxml2/buf.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/threads.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/xmlIO.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/xmlreader.c	['schema', 'xml', 'xinclude', 'valid']	['xml', 'xinclude', 'valid']
/src/libxml2/fuzz/valid.c	['valid']	['valid']
/src/libxml2/./timsort.h	['xml', 'xpath', 'xinclude', 'valid']	[]
/src/libxml2/parser.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/xpointer.c	['xml', 'xpath', 'xinclude', 'valid']	['xpath', 'xinclude']
/src/libxml2/entities.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/HTMLparser.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/fuzz/html.c	['html']	['html']
/src/libxml2/xmlregexp.c	['regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['regexp', 'schema', 'xinclude', 'valid']
/src/libxml2/xmlstring.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/HTMLtree.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'xml']
/src/libxml2/error.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/fuzz/xml.c	['xml']	['xml']
/src/libxml2/xzlib.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	[]
/src/libxml2/fuzz/xpath.c	['xpath']	['xpath']
/src/libxml2/globals.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/chvalid.c	['regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/xpath.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/fuzz/schema.c	['schema']	['schema']
/src/libxml2/SAX2.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/fuzz/fuzz.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/valid.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/xmlschemastypes.c	['schema', 'xml', 'xinclude', 'valid']	['schema']
/src/libxml2/xmlschemas.c	['schema', 'xml', 'xinclude', 'valid']	['schema']
/src/libxml2/hash.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/tree.c	['regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/xmlmemory.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/catalog.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/xmlsave.c	['html', 'xml']	['xml']
/src/libxml2/pattern.c	['schema', 'xml', 'xinclude', 'valid']	['schema']
/src/libxml2/xmlunicode.c	['regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['regexp', 'schema']
/src/libxml2/uri.c	['uri', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/parserInternals.c	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/encoding.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']
/src/libxml2/fuzz/xinclude.c	['xinclude']	['xinclude']
/src/libxml2/dict.c	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']	['uri', 'regexp', 'html', 'schema', 'xml', 'xpath', 'xinclude', 'valid']

Directories in report

Directory
/src/libxml2/fuzz/
/src/libxml2/./
/src/libxml2/