High level conclusions

Fuzzers reach 66.16% code coverage.

Fuzzers reach 87.90% of cyclomatic complexity.

Fuzzers reach 77.24% of all functions.

Fuzzer lint is blocked:

The runtime code coverage of lint covers 26.79% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

2169 / 2808

Cyclomatic complexity statically reachable by fuzzers

28472 / 32389

Runtime code coverage of functions

1858 / 2808

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	41	12.4%
gold	[1:9]	40	12.1%
yellow	[10:29]	13	3.93%
greenyellow	[30:49]	2	0.60%
lawngreen	50+	234	70.9%
All colors	330	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
18	18	4 : View List ['getentropy', 'xmlAbort', 'time', '__errno_location']	18	18	xmlInitRandom	call site: 00009	/src/libxml2/dict.c:940
17	17	1 : View List ['xmlDictFree']	17	17	xmlHashFree	call site: 00323	/src/libxml2/hash.c:250
12	12	1 : View List ['xmlHashGrow']	12	12	xmlHashCreate	call site: 00042	/src/libxml2/hash.c:180
8	8	1 : View List ['xmlAbort']	8	26	xmlNewGlobalState	call site: 00047	/src/libxml2/globals.c:483
0	24	1 : View List ['xmlParse3986DecOctet']	0	95	xmlParse3986Host	call site: 00085	/src/libxml2/uri.c:482
0	5	1 : View List ['xmlStrndup']	0	5	xmlStrncat	call site: 00194	/src/libxml2/xmlstring.c:431
0	0	None	17	17	xmlHashFree	call site: 00323	/src/libxml2/hash.c:228
0	0	None	4	309	xmlBuildURISafe	call site: 00273	/src/libxml2/uri.c:2205
0	0	None	2	2	xmlFuzzCheckFailureReport	call site: 00136	/src/libxml2/fuzz/fuzz.c:173
0	0	None	0	953	xmlURIEscape	call site: 00197	/src/libxml2/uri.c:1751
0	0	None	0	317	xmlBuildRelativeURISafe	call site: 00307	/src/libxml2/uri.c:2656
0	0	None	0	277	xmlBuildURISafe	call site: 00272	/src/libxml2/uri.c:2092

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

26

Reachable functions

117

Percentage of reachable functions covered

77.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/uri.c	1
fuzz/fuzz.c	7
hash.c	4
threads.c	7
dict.c	6
error.c	3
xmlmemory.c	1
globals.c	6
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
uri.c	43
xmlstring.c	12
./include/private/memory.h	1

Fuzzer: regexp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	23.0%
gold	[1:9]	50	11.6%
yellow	[10:29]	7	1.63%
greenyellow	[30:49]	3	0.69%
lawngreen	50+	270	62.9%
All colors	429	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
104	208	2 : View List ['__xmlStructuredErrorContext', '__xmlStructuredError']	104	208	xmlRaiseMemoryError	call site: 00079	/src/libxml2/error.c:656
104	208	2 : View List ['__xmlStructuredErrorContext', '__xmlStructuredError']	104	208	xmlVRaiseError	call site: 00122	/src/libxml2/error.c:729
59	59	1 : View List ['xmlCopyError']	477	685	xmlVRaiseError	call site: 00100	/src/libxml2/error.c:722
18	18	4 : View List ['getentropy', 'xmlAbort', 'time', '__errno_location']	18	18	xmlInitRandom	call site: 00009	/src/libxml2/dict.c:940
17	17	1 : View List ['xmlDictFree']	17	17	xmlHashFree	call site: 00421	/src/libxml2/hash.c:250
12	12	1 : View List ['xmlHashGrow']	12	12	xmlHashCreate	call site: 00042	/src/libxml2/hash.c:180
8	8	1 : View List ['xmlAbort']	485	888	xmlVRaiseError	call site: 00096	/src/libxml2/error.c:703
8	8	1 : View List ['xmlAbort']	8	26	xmlNewGlobalState	call site: 00047	/src/libxml2/globals.c:483
7	7	1 : View List ['xmlStrEqual']	7	7	xmlFACompareRanges	call site: 00391	/src/libxml2/xmlregexp.c:2263
0	351	1 : View List ['xmlRegexpErrCompile']	0	351	xmlFAParseAtom	call site: 00140	/src/libxml2/xmlregexp.c:5233
0	351	1 : View List ['xmlRegexpErrCompile']	0	351	xmlRegAtomAddRange	call site: 00235	/src/libxml2/xmlregexp.c:1401
0	351	1 : View List ['xmlRegexpErrCompile']	0	351	xmlRegAtomPush	call site: 00197	/src/libxml2/xmlregexp.c:1459

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

41

Reachable functions

182

Percentage of reachable functions covered

77.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/regexp.c	1
fuzz/fuzz.c	6
hash.c	4
threads.c	7
dict.c	6
error.c	13
xmlmemory.c	1
globals.c	12
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
xmlregexp.c	60
xmlstring.c	7
./include/private/memory.h	1
tree.c	2
parserInternals.c	1
chvalid.c	1
./codegen/unicode.inc	35

Fuzzer: html

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	557	45.0%
gold	[1:9]	39	3.15%
yellow	[10:29]	14	1.13%
greenyellow	[30:49]	3	0.24%
lawngreen	50+	623	50.4%
All colors	1236	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1615	1615	1 : View List ['xmlValidateOneElement']	1615	1619	xmlSAX2EndElement	call site: 00000	/src/libxml2/SAX2.c:1744
745	745	1 : View List ['xmlSwitchEncodingName']	745	745	htmlCreatePushParserCtxt	call site: 01177	/src/libxml2/HTMLparser.c:5242
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromMemory	call site: 00264	/src/libxml2/parserInternals.c:1930
704	704	1 : View List ['xmlCopyEntitiesTable']	2285	2788	xmlCopyDtd	call site: 00953	/src/libxml2/tree.c:4240
678	1181	2 : View List ['xmlNodeParseAttValue', 'xmlFreeProp']	886	1389	xmlNewDocProp	call site: 00981	/src/libxml2/tree.c:1644
678	678	1 : View List ['xmlNodeParseAttValue']	886	886	xmlNewElem	call site: 00000	/src/libxml2/tree.c:1855
503	503	1 : View List ['xmlFreeEntitiesTable']	503	503	xmlFreeDtd	call site: 00135	/src/libxml2/tree.c:867
503	503	1 : View List ['xmlFreeEntity']	503	503	xmlFreeNode	call site: 00214	/src/libxml2/tree.c:3435
500	500	1 : View List ['xmlCopyElementTable']	3233	3736	xmlCopyDtd	call site: 00924	/src/libxml2/tree.c:4228
448	448	1 : View List ['xmlCopyAttributeTable']	2733	3236	xmlCopyDtd	call site: 00932	/src/libxml2/tree.c:4234
362	362	1 : View List ['xmlCopyNotationTable']	3595	4098	xmlCopyDtd	call site: 00899	/src/libxml2/tree.c:4222
321	345	2 : View List ['xmlDictOwns', 'xmlDictLookup']	321	345	xmlHashUpdateInternal	call site: 00906	/src/libxml2/hash.c:490

Runtime coverage analysis

Covered functions

302

Functions that are reachable but not covered

142

Reachable functions

388

Percentage of reachable functions covered

63.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/html.c	1
fuzz/fuzz.c	7
hash.c	16
threads.c	7
dict.c	18
error.c	14
xmlmemory.c	1
globals.c	15
encoding.c	19
xpath.c	2
xmlIO.c	17
catalog.c	5
xmlschemastypes.c	1
relaxng.c	1
HTMLparser.c	56
SAX2.c	1
parserInternals.c	30
parser.c	8
buf.c	19
tree.c	50
valid.c	33
list.c	3
xmlregexp.c	4
entities.c	8
xmlstring.c	12
./include/private/memory.h	1
./include/private/parser.h	1
HTMLtree.c	9
xmlsave.c	3

Fuzzer: xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1354	42.2%
gold	[1:9]	124	3.87%
yellow	[10:29]	67	2.09%
greenyellow	[30:49]	37	1.15%
lawngreen	50+	1619	50.5%
All colors	3201	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1615	1615	1 : View List ['xmlValidateOneElement']	1615	1619	xmlSAX2EndElementNs	call site: 00000	/src/libxml2/SAX2.c:2406
1565	1565	1 : View List ['xmlParseStartTag']	2303	4169	xmlParseElementStart	call site: 00970	/src/libxml2/parser.c:9734
1026	1026	1 : View List ['xmlParseEndTag1']	1041	1041	xmlParseElementEnd	call site: 01406	/src/libxml2/parser.c:9833
782	819	2 : View List ['xmlNsWarnMsg', 'xmlNewNs']	1742	8426	xmlSAX2StartElementNs	call site: 00000	/src/libxml2/SAX2.c:2289
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromMemory	call site: 00309	/src/libxml2/parserInternals.c:1930
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromString	call site: 00777	/src/libxml2/parserInternals.c:1991
546	546	1 : View List ['htmlNewDocNoDtD']	546	870	xmlSAX2StartDocument	call site: 00000	/src/libxml2/SAX2.c:800
521	521	1 : View List ['xmlValidateDocumentFinal']	521	1324	xmlSAX2EndDocument	call site: 00000	/src/libxml2/SAX2.c:849
485	745	4 : View List ['xmlFreeSaveCtxt', 'xmlStrdup', 'xmlSaveErr', 'xmlOpenCharEncodingHandler']	485	867	xmlNewSaveCtxt	call site: 02514	/src/libxml2/xmlsave.c:201
485	485	1 : View List ['xmlSaveErr']	485	485	xmlSaveSwitchEncoding	call site: 02586	/src/libxml2/xmlsave.c:656
440	440	1 : View List ['xmlValidateRoot']	738	2463	xmlParseElementStart	call site: 01345	/src/libxml2/parser.c:9754
401	401	1 : View List ['xmlErrValid']	3102	13993	xmlSAX2StartElementNs	call site: 00000	/src/libxml2/SAX2.c:2147

Runtime coverage analysis

Covered functions

573

Functions that are reachable but not covered

211

Reachable functions

715

Percentage of reachable functions covered

70.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xml.c	1
fuzz/fuzz.c	13
hash.c	28
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	32
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	17
parserInternals.c	43
SAX2.c	6
parser.c	152
buf.c	25
tree.c	67
valid.c	40
list.c	3
xmlregexp.c	4
entities.c	10
HTMLparser.c	4
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
xzlib.c	12
xmlsave.c	35
HTMLtree.c	8

Fuzzer: xinclude

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	826	21.9%
gold	[1:9]	234	6.22%
yellow	[10:29]	62	1.64%
greenyellow	[30:49]	47	1.24%
lawngreen	50+	2593	68.9%
All colors	3762	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1615	1615	1 : View List ['xmlValidateOneElement']	1615	1619	xmlSAX2EndElementNs	call site: 00000	/src/libxml2/SAX2.c:2406
1565	1565	1 : View List ['xmlParseStartTag']	2303	4169	xmlParseElementStart	call site: 00967	/src/libxml2/parser.c:9734
1026	1026	1 : View List ['xmlParseEndTag1']	1041	1041	xmlParseElementEnd	call site: 01403	/src/libxml2/parser.c:9833
792	792	1 : View List ['xmlInsertProp']	792	792	xmlInsertNode	call site: 02647	/src/libxml2/tree.c:2794
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromMemory	call site: 00306	/src/libxml2/parserInternals.c:1930
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromString	call site: 00774	/src/libxml2/parserInternals.c:1991
546	546	1 : View List ['htmlNewDocNoDtD']	546	870	xmlSAX2StartDocument	call site: 00000	/src/libxml2/SAX2.c:800
521	521	1 : View List ['xmlValidateDocumentFinal']	521	1324	xmlSAX2EndDocument	call site: 00000	/src/libxml2/SAX2.c:849
440	440	1 : View List ['xmlValidateRoot']	738	2463	xmlParseElementStart	call site: 01342	/src/libxml2/parser.c:9754
401	401	1 : View List ['xmlErrValid']	2320	13993	xmlSAX2StartElementNs	call site: 00000	/src/libxml2/SAX2.c:2147
391	391	1 : View List ['xmlValidityError']	391	3055	xmlParseElementChildrenContentDeclPriv	call site: 02153	/src/libxml2/parser.c:6469
391	391	1 : View List ['xmlValidityError']	391	2034	xmlParseElementMixedContentDecl	call site: 02119	/src/libxml2/parser.c:6156

Runtime coverage analysis

Covered functions

804

Functions that are reachable but not covered

153

Reachable functions

845

Percentage of reachable functions covered

81.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xinclude.c	1
fuzz/fuzz.c	12
hash.c	29
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	16
xpath.c	139
xmlIO.c	19
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	18
parserInternals.c	42
SAX2.c	6
parser.c	143
buf.c	19
tree.c	83
valid.c	41
list.c	3
xmlregexp.c	4
entities.c	11
HTMLparser.c	2
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	39
xzlib.c	12
xinclude.c	27
xpointer.c	8
./timsort.h	12

Fuzzer: xpath

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1195	35.1%
gold	[1:9]	167	4.91%
yellow	[10:29]	41	1.20%
greenyellow	[30:49]	23	0.67%
lawngreen	50+	1970	58.0%
All colors	3396	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1615	1615	1 : View List ['xmlValidateOneElement']	1615	1619	xmlSAX2EndElementNs	call site: 00000	/src/libxml2/SAX2.c:2406
1565	1565	1 : View List ['xmlParseStartTag']	2303	4169	xmlParseElementStart	call site: 00835	/src/libxml2/parser.c:9734
1110	2221	8 : View List ['xmlParseURISafe', 'xmlNormalizeURIPath', 'xmlCreateURI', 'xmlResolvePath', 'xmlFreeURI', 'xmlSaveUri', 'strlen', 'xmlStrstr']	1110	2230	xmlBuildURISafe	call site: 01852	/src/libxml2/uri.c:1984
1026	1026	1 : View List ['xmlParseEndTag1']	1041	1041	xmlParseElementEnd	call site: 01271	/src/libxml2/parser.c:9833
917	1784	4 : View List ['xmlStrEqual', 'xmlFatalErrMsg.6461', 'xmlParseTextDecl', 'xmlDetectEncoding']	917	10706	xmlCtxtParseContentInternal	call site: 01461	/src/libxml2/parser.c:11695
782	819	2 : View List ['xmlNsWarnMsg', 'xmlNewNs']	2117	8426	xmlSAX2StartElementNs	call site: 00000	/src/libxml2/SAX2.c:2289
778	2989	4 : View List ['xmlSAX2EntityDecl', 'xmlErrMemory', 'xmlNewDoc', 'xmlNewDtd']	1169	12119	xmlParseEntityDecl	call site: 02270	/src/libxml2/parser.c:5505
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromMemory	call site: 00151	/src/libxml2/parserInternals.c:1930
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromString	call site: 00633	/src/libxml2/parserInternals.c:1991
546	546	1 : View List ['htmlNewDocNoDtD']	870	870	xmlSAX2StartDocument	call site: 00000	/src/libxml2/SAX2.c:800
524	524	1 : View List ['xmlSBufReportError']	524	524	xmlSBufFinish	call site: 01021	/src/libxml2/parser.c:796
521	521	1 : View List ['xmlValidateDocumentFinal']	771	1324	xmlSAX2EndDocument	call site: 00000	/src/libxml2/SAX2.c:849

Runtime coverage analysis

Covered functions

688

Functions that are reachable but not covered

210

Reachable functions

782

Percentage of reachable functions covered

73.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xpath.c	1
fuzz/fuzz.c	7
hash.c	27
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	140
xmlIO.c	18
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
parser.c	141
parserInternals.c	40
SAX2.c	6
buf.c	19
HTMLparser.c	2
xmlstring.c	16
tree.c	65
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
xzlib.c	12
entities.c	10
valid.c	41
list.c	3
xmlregexp.c	4
xpointer.c	8
./timsort.h	12

Fuzzer: lint

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9917	84.8%
gold	[1:9]	72	0.61%
yellow	[10:29]	77	0.65%
greenyellow	[30:49]	39	0.33%
lawngreen	50+	1577	13.4%
All colors	11682	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
61258	71618	26 : View List ['xmlTextReaderEntPop', 'xmlTextReaderExpand', 'xmlXIncludeNewContext', 'xmlTextReaderValidateEntity', 'xmlXIncludeSetErrorHandler', 'xmlTextReaderValidateCData', 'xmlTextReaderValidatePop', 'xmlTextReaderValidatePush', 'xmlXIncludeProcessNode', 'xmlFatalErr', 'xmlStrlen', 'xmlTextReaderEntPush', 'xmlIsCatastrophicError', 'xmlUnlinkNode', 'xmlXIncludeSetResourceLoader', 'xmlXIncludeSetStreamingMode', 'xmlStrEqual', 'xmlSchemaIsValid', 'xmlTextReaderErrMemory', 'xmlTextReaderPreserve', 'xmlXIncludeSetFlags', 'xmlParseChunk', 'xmlXIncludeGetLastError', 'xmlTextReaderFreeNode', 'xmlPatternMatch', 'xmlTextReaderPushData']	61258	71618	xmlTextReaderRead	call site: 07350	/src/libxml2/xmlreader.c:1211
19602	26826	12 : View List ['xmlCtxtParseDtd', 'xmlFreeIDTable', 'xmlDocGetRootElement', 'xmlParseDTD', 'xmlValidateDtdFinal', 'xmlValidateRoot', 'xmlBuildURISafe', 'xmlVErrMemory', 'xmlFreeRefTable', 'xmlValidateElement', 'xmlLoadResource', 'xmlValidateDocumentFinal']	19602	26826	xmlValidateDocumentInternal	call site: 10052	/src/libxml2/valid.c:6263
18444	18460	8 : View List ['strcmp', 'xmlParserInputBufferCreateFd', 'xmlParserInputBufferCreateFilename', 'xmlSchemaValidateSetFilename', 'xmlFreeParserInputBuffer', 'xmlSchemaFreeValidCtxt', 'xmlSchemaNewValidCtxt', 'xmlSchemaValidateStream']	18444	18460	testSAX	call site: 09217	/src/libxml2/fuzz/../xmllint.c:1196
18118	18118	3 : View List ['xmlParseDTD', 'xmlValidateDtd', 'xmlFreeDtd']	37528	39125	parseAndPrintFile	call site: 11568	/src/libxml2/fuzz/../xmllint.c:2065
18018	18018	1 : View List ['xmllintShell']	18018	18547	parseAndPrintFile	call site: 10005	/src/libxml2/fuzz/../xmllint.c:1854
17479	17479	3 : View List ['xmlSchemaFreeValidCtxt', 'xmlSchemaNewValidCtxt', 'xmlSchemaValidateDoc']	17479	18517	parseAndPrintFile	call site: 11599	/src/libxml2/fuzz/../xmllint.c:2218
15860	15860	5 : View List ['fclose', 'xmlParseChunk', 'fopen64', 'xmlCtxtGetDocument', 'fread']	15860	15860	parseXml	call site: 09956	/src/libxml2/fuzz/../xmllint.c:338
15737	15737	4 : View List ['xmlSchemaParse', 'xmlSchemaSetResourceLoader', 'xmlSchemaNewParserCtxt', 'xmlSchemaFreeParserCtxt']	18261	113118	xmllintMain	call site: 05044	/src/libxml2/fuzz/../xmllint.c:3097
13332	13332	4 : View List ['xmlRelaxNGSetResourceLoader', 'xmlRelaxNGFreeParserCtxt', 'xmlRelaxNGParse', 'xmlRelaxNGNewParserCtxt']	31593	126466	xmllintMain	call site: 00729	/src/libxml2/fuzz/../xmllint.c:3064
7283	7283	1 : View List ['xmlCtxtReadFd']	7283	7283	parseXml	call site: 09966	/src/libxml2/fuzz/../xmllint.c:383
7235	7377	2 : View List ['xmlCtxtParseDocument', 'xmlNewInputFromMemory']	7235	7377	parseXml	call site: 09963	/src/libxml2/fuzz/../xmllint.c:368
7235	7235	1 : View List ['xmlCtxtParseDocument']	7235	7235	xmlCtxtReadFile	call site: 04156	/src/libxml2/parser.c:13619

Runtime coverage analysis

Covered functions

602

Functions that are reachable but not covered

1478

Reachable functions

2019

Percentage of reachable functions covered

26.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/lint.c	2
xmlmemory.c	8
fuzz/fuzz.c	10
hash.c	30
threads.c	13
dict.c	24
error.c	18
globals.c	25
encoding.c	22
xpath.c	147
xmlIO.c	37
catalog.c	47
xmlschemastypes.c	72
relaxng.c	140
xmlstring.c	20
fuzz/../xmllint.c	27
parser.c	166
parserInternals.c	51
chvalid.c	1
./include/private/memory.h	1
uri.c	40
SAX2.c	7
buf.c	20
xzlib.c	12
tree.c	110
./include/private/parser.h	2
valid.c	90
xmlregexp.c	92
entities.c	11
list.c	12
xmlschemas.c	343
xmlreader.c	51
./codegen/unicode.inc	35
pattern.c	32
HTMLparser.c	62
xinclude.c	29
xpointer.c	8
./timsort.h	12
HTMLtree.c	17
fuzz/../shell.c	21
xmlsave.c	44
c14n.c	39

Fuzzer: valid

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1565	48.2%
gold	[1:9]	210	6.47%
yellow	[10:29]	123	3.79%
greenyellow	[30:49]	67	2.06%
lawngreen	50+	1276	39.3%
All colors	3241	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
7309	7309	1 : View List ['xmlParseDTD']	7309	11248	xmlValidateDocumentInternal	call site: 02526	/src/libxml2/valid.c:6288
7220	24884	8 : View List ['xmlParseMarkupDecl', 'xmlParserGrow', 'xmlParsePERefInternal', 'xmlFatalErr', 'xmlParserShrink', 'xmlPopPE', 'xmlParseConditionalSections', 'xmlSkipBlankChars']	7220	25502	xmlParseExternalSubset	call site: 02553	/src/libxml2/parser.c:7061
1964	2432	5 : View List ['xmlFAGenerateCountedEpsilonTransition', 'xmlFAGenerateTransitions', 'xmlRegGetCounter', 'xmlFAGenerateCountedTransition', 'xmlRegCopyAtom']	1964	6417	xmlFAGenerateTransitions	call site: 02765	/src/libxml2/xmlregexp.c:1699
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromMemory	call site: 00308	/src/libxml2/parserInternals.c:1930
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromString	call site: 00776	/src/libxml2/parserInternals.c:1991
546	546	1 : View List ['htmlNewDocNoDtD']	546	870	xmlSAX2StartDocument	call site: 00000	/src/libxml2/SAX2.c:800
524	524	1 : View List ['xmlSBufReportError']	524	524	xmlSBufFinish	call site: 01155	/src/libxml2/parser.c:796
401	401	1 : View List ['xmlErrValidNodeNr']	401	581	xmlValidateRef	call site: 03115	/src/libxml2/valid.c:5882
392	392	1 : View List ['xmlErrAttributeDup']	392	392	xmlParserNsPush	call site: 01249	/src/libxml2/parser.c:1693
392	392	1 : View List ['xmlErrAttributeDup']	392	392	xmlParserNsPush	call site: 01253	/src/libxml2/parser.c:1718
391	391	1 : View List ['xmlNsErrMsg']	886	9941	xmlSAX1Attribute	call site: 00000	/src/libxml2/SAX2.c:1107
391	391	1 : View List ['xmlNsErrMsg']	391	2742	xmlSAX1Attribute	call site: 00000	/src/libxml2/SAX2.c:1056

Runtime coverage analysis

Covered functions

598

Functions that are reachable but not covered

250

Reachable functions

786

Percentage of reachable functions covered

68.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/valid.c	1
fuzz/fuzz.c	13
hash.c	28
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	21
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	16
parserInternals.c	43
SAX2.c	6
parser.c	157
buf.c	19
tree.c	70
valid.c	78
list.c	8
xmlregexp.c	58
entities.c	10
HTMLparser.c	3
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
xzlib.c	12
./codegen/unicode.inc	35

Fuzzer: reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1928	33.7%
gold	[1:9]	285	4.99%
yellow	[10:29]	115	2.01%
greenyellow	[30:49]	48	0.84%
lawngreen	50+	3333	58.3%
All colors	5709	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12759	12759	1 : View List ['xmlTextReaderNextTree']	12759	12759	xmlTextReaderNext	call site: 05675	/src/libxml2/xmlreader.c:1599
12759	12759	1 : View List ['xmlTextReaderNextTree']	12759	12759	xmlTextReaderNextSibling	call site: 05685	/src/libxml2/xmlreader.c:1954
2943	10453	3 : View List ['xmlTextReaderExpand', 'xmlRelaxNGValidateFullElement', 'xmlRelaxNGValidatePushElement']	2943	10453	xmlTextReaderValidatePush	call site: 04522	/src/libxml2/xmlreader.c:926
1964	2432	5 : View List ['xmlFAGenerateCountedEpsilonTransition', 'xmlFAGenerateTransitions', 'xmlRegGetCounter', 'xmlFAGenerateCountedTransition', 'xmlRegCopyAtom']	1964	6417	xmlFAGenerateTransitions	call site: 04360	/src/libxml2/xmlregexp.c:1699
792	792	1 : View List ['xmlInsertProp']	792	792	xmlInsertNode	call site: 03115	/src/libxml2/tree.c:2794
762	762	1 : View List ['xmlSchemaSAXUnplug']	2077	3887	xmlFreeTextReader	call site: 00528	/src/libxml2/xmlreader.c:2141
745	745	1 : View List ['xmlSwitchEncodingName']	745	754	xmlTextReaderSetup	call site: 00469	/src/libxml2/xmlreader.c:4875
742	742	1 : View List ['xmlSwitchInputEncodingName']	742	742	xmlCtxtNewInputFromString	call site: 01457	/src/libxml2/parserInternals.c:1991
697	3031	12 : View List ['xmlBufResetInput', 'xmlCtxtPushInput', 'xmlBufContent', 'xmlFreeInputStream', 'xmlCtxtReset', 'xmlNewInputStream', 'xmlCreatePushParserCtxt', 'xmlFreeParserInputBuffer', 'xmlAllocParserInputBuffer', 'xmlParserInputBufferRead', 'xmlCanonicPath', 'xmlBufUse']	1480	4535	xmlTextReaderSetup	call site: 00306	/src/libxml2/xmlreader.c:4776
648	648	1 : View List ['xmlSchemaFree']	686	2496	xmlFreeTextReader	call site: 00630	/src/libxml2/xmlreader.c:2150
629	629	1 : View List ['xmlSchemaFreeValidCtxt']	1315	3125	xmlFreeTextReader	call site: 00544	/src/libxml2/xmlreader.c:2145
602	602	1 : View List ['xmlRelaxNGValidatePopElement']	602	602	xmlTextReaderValidatePop	call site: 02888	/src/libxml2/xmlreader.c:1023

Runtime coverage analysis

Covered functions

995

Functions that are reachable but not covered

364

Reachable functions

1219

Percentage of reachable functions covered

70.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/reader.c	2
fuzz/fuzz.c	11
hash.c	29
threads.c	9
dict.c	22
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	139
xmlIO.c	31
catalog.c	33
xmlschemastypes.c	2
relaxng.c	58
xmlstring.c	19
xmlreader.c	85
buf.c	20
SAX2.c	6
parser.c	151
parserInternals.c	43
./include/private/memory.h	1
tree.c	89
valid.c	51
list.c	3
xmlregexp.c	59
entities.c	11
uri.c	39
xinclude.c	29
pattern.c	8
HTMLparser.c	4
xmlschemas.c	43
./include/private/parser.h	2
chvalid.c	1
xzlib.c	12
xpointer.c	8
./timsort.h	12
./codegen/unicode.inc	35
xmlsave.c	31
HTMLtree.c	8

Fuzzer: schema

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3609	58.2%
gold	[1:9]	410	6.61%
yellow	[10:29]	174	2.80%
greenyellow	[30:49]	106	1.71%
lawngreen	50+	1896	30.6%
All colors	6195	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
14888	14908	2 : View List ['xmlSchemaAssembleByXSI', 'xmlHashScan']	24594	43892	xmlSchemaValidateElem	call site: 05720	/src/libxml2/xmlschemas.c:26374
8311	8328	5 : View List ['xmlSchemaGetComponentNode', 'xmlSchemaCheckCVCWildcardNamespace', 'xmlSchemaCheckCOSSTDerivedOK', 'xmlSchemaGetEffectiveValueConstraint', 'xmlSchemaPAttrUseErr4']	9123	11364	xmlSchemaCheckDerivationOKRestriction2to4	call site: 05355	/src/libxml2/xmlschemas.c:13810
7701	21037	20 : View List ['xmlGetLastError', 'xmlSchemaGetProp', 'xmlSchemaPErr', 'xmlSchemaCustomErr', 'xmlSchemaPErrMemory', 'xmlCtxtReadFile', 'xmlNewParserCtxt', 'xmlCtxtReadMemory', 'xmlSchemaBucketCreate', 'xmlDocGetRootElement', 'xmlFreeDoc', 'xmlCtxtSetErrorHandler', 'xmlFreeParserCtxt', 'xmlSchemaInternalErr', 'xmlCtxtSetResourceLoader', 'xmlDictLookup', 'xmlDictReference', 'xmlStrdup', 'xmlSchemaCleanupDoc', 'xmlDictFree']	7701	21051	xmlSchemaAddSchemaDoc	call site: 00476	/src/libxml2/xmlschemas.c:10172
6618	6618	2 : View List ['xmlSchemaInternalErr', 'xmlSchemaProcessXSIType']	7070	7628	xmlSchemaValidateElemDecl	call site: 05848	/src/libxml2/xmlschemas.c:24673
6618	6618	2 : View List ['xmlSchemaProcessXSIType', 'xmlSchemaInternalErr']	6618	6618	xmlSchemaValidateChildElem	call site: 05742	/src/libxml2/xmlschemas.c:26073
6385	13708	5 : View List ['xmlSchemaPCustomErrExt', 'xmlSchemaCheckElementDeclComponent', 'xmlSchemaCheckSubstGroupCircular', 'xmlSchemaGetComponentQName', 'xmlSchemaCheckCOSDerivedOK']	6796	19689	xmlSchemaCheckElemPropsCorrect	call site: 05435	/src/libxml2/xmlschemas.c:19171
6232	6232	1 : View List ['xmlSchemaValidateElemWildcard']	8884	21090	xmlSchemaValidateElem	call site: 05827	/src/libxml2/xmlschemas.c:26441
6150	6150	1 : View List ['xmlSchemaCheckSRCRedefineSecond']	6153	20177	xmlSchemaFixupComponents	call site: 05423	/src/libxml2/xmlschemas.c:20733
6145	14400	5 : View List ['xmlSchemaFixupSimpleTypeStageTwo', 'xmlSchemaAddType', 'xmlSchemaTypeFixup', 'xmlSchemaFixupSimpleTypeStageOne', 'xmlSchemaPCustomErr']	6145	26690	xmlSchemaFixupComplexType	call site: 05279	/src/libxml2/xmlschemas.c:17792
2050	2050	2 : View List ['xmlSchemaInternalErr', 'xmlSchemaExpandAttributeGroupRefs']	2480	2998	xmlSchemaFixupTypeAttributeUses	call site: 05312	/src/libxml2/xmlschemas.c:14122
1615	1615	1 : View List ['xmlValidateOneElement']	1615	1619	xmlSAX2EndElementNs	call site: 00000	/src/libxml2/SAX2.c:2406
1565	1565	1 : View List ['xmlParseStartTag']	2303	4169	xmlParseElementStart	call site: 01979	/src/libxml2/parser.c:9734

Runtime coverage analysis

Covered functions

839

Functions that are reachable but not covered

431

Reachable functions

1225

Percentage of reachable functions covered

64.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/schema.c	1
fuzz/fuzz.c	11
hash.c	29
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	20
catalog.c	33
xmlschemastypes.c	71
relaxng.c	1
xmlstring.c	20
xmlschemas.c	335
parserInternals.c	43
buf.c	19
xmlregexp.c	89
tree.c	85
SAX2.c	6
parser.c	144
valid.c	45
list.c	7
entities.c	10
HTMLparser.c	2
uri.c	36
xzlib.c	12
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
pattern.c	29
xmlreader.c	3
./codegen/unicode.inc	35

Fuzzer: api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	870	16.6%
gold	[1:9]	186	3.56%
yellow	[10:29]	38	0.72%
greenyellow	[30:49]	10	0.19%
lawngreen	50+	4118	78.8%
All colors	5222	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
8612	26349	8 : View List ['xmlParseMarkupDecl', 'xmlParserGrow', 'xmlParsePERefInternal', 'xmlParserShrink', 'xmlPopPE', 'xmlParseConditionalSections', 'xmlNextChar', 'xmlSkipBlankChars']	8612	27912	xmlParseInternalSubset	call site: 00730	/src/libxml2/parser.c:8014
7220	23589	7 : View List ['xmlParseMarkupDecl', 'xmlParserGrow', 'xmlParserCheckEOF', 'xmlParsePERefInternal', 'xmlParserShrink', 'xmlParseConditionalSections', 'xmlSkipBlankChars']	8612	25502	xmlParseExternalSubset	call site: 03754	/src/libxml2/parser.c:7071
7220	18928	13 : View List ['xmlSBufAddChar', 'xmlFatalErrMsg.6461', 'xmlExpandPEsInEntityValue', 'xmlSBufAddString', 'xmlParserEntityCheck', 'xmlParseStringCharRef', 'xmlUTF8MultibyteLen', 'xmlFatalErr', 'xmlSBufAddReplChar', 'xmlParseStringPEReference', 'xmlParseStringName', 'xmlLoadEntityContent', 'xmlWarningMsg']	7220	18928	xmlExpandPEsInEntityValue	call site: 02255	/src/libxml2/parser.c:3537
7220	7220	1 : View List ['xmlResolveFromCatalog']	7220	7953	xmlNewInputFromUrl	call site: 00000	/src/libxml2/parserInternals.c:2461
1964	2432	5 : View List ['xmlFAGenerateCountedEpsilonTransition', 'xmlFAGenerateTransitions', 'xmlRegGetCounter', 'xmlFAGenerateCountedTransition', 'xmlRegCopyAtom']	1964	6417	xmlFAGenerateTransitions	call site: 03961	/src/libxml2/xmlregexp.c:1699
917	10987	8 : View List ['xmlParseTextDecl', 'xmlNewEntityInputStream', 'xmlCtxtPushInput', 'xmlFreeInputStream', 'xmlParserGrow', 'xmlDetectEncoding', 'xmlFatalErr', 'xmlWarningMsg']	917	10987	xmlParsePERefInternal	call site: 00761	/src/libxml2/parser.c:7631
351	351	1 : View List ['xmlRegexpErrCompile']	351	351	xmlFAGenerateTransitions	call site: 03960	/src/libxml2/xmlregexp.c:1695
351	351	1 : View List ['xmlRegexpErrCompile']	351	351	xmlRegStateAddTrans	call site: 03967	/src/libxml2/xmlregexp.c:1522
351	351	1 : View List ['xmlRegexpErrCompile']	351	351	xmlRegAtomPush	call site: 04010	/src/libxml2/xmlregexp.c:1459
208	217	2 : View List ['__xmlRegisterNodeDefaultValue', 'xmlStrdup']	208	10921	xmlSAX2StartElementNs	call site: 00000	/src/libxml2/SAX2.c:2185
143	143	1 : View List ['xmlOutputBufferWriteWSNonSig']	143	1206	xmlAttrDumpOutput	call site: 04680	/src/libxml2/xmlsave.c:887
136	198	6 : View List ['xmlFARegExecSaveInputString', 'xmlStrEqual', 'xmlRegExecSetErrString', 'xmlFARegExecRollBack', 'xmlRegStrEqualWildcard', 'xmlFARegExecSave']	136	198	xmlRegExecPushStringInternal	call site: 04126	/src/libxml2/xmlregexp.c:3893

Runtime coverage analysis

Covered functions

937

Functions that are reachable but not covered

160

Reachable functions

1025

Percentage of reachable functions covered

84.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/api.c	35
fuzz/fuzz.c	11
hash.c	30
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	30
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
tree.c	155
valid.c	101
list.c	12
xmlregexp.c	58
entities.c	20
parser.c	146
parserInternals.c	38
SAX2.c	6
buf.c	26
HTMLparser.c	7
xmlstring.c	18
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	36
xzlib.c	12
HTMLtree.c	20
./codegen/unicode.inc	35
xmlsave.c	49

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
xmlSAX2StartElement	/src/libxml2/SAX2.c	3	['N/A', 'N/A', 'N/A']	22	0	81	15	7	284	0	2940	243
xmlSAX2StartElementNs	/src/libxml2/SAX2.c	9	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A', 'int', 'int', 'N/A']	18	0	1007	148	59	254	0	2314	156
xmlXzfileRead	/src/libxml2/xmlIO.c	3	['N/A', 'N/A', 'int']	7	0	45	6	3	26	0	221	89
xmlXPathSubstringFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	498	88	34	145	0	925	80
xmlCatalogDump	/src/libxml2/catalog.c	1	['N/A']	25	0	38	9	4	304	0	2838	71
xmlCatalogAdd	/src/libxml2/catalog.c	3	['N/A', 'N/A', 'N/A']	40	0	77	12	5	601	0	7279	59
xmlXPathTranslateFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	451	72	28	137	0	856	48

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2216 / 2808

Cyclomatic complexity statically reachable by fuzzers

29214 / 32389

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzz/uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlInitRandom', 'xmlURIEscape', 'xmlFuzzDataCleanup', 'LLVMFuzzerTestOneInput', 'xmlSaveUri', 'xmlInitGlobalsInternal', 'xmlGetThreadLocalStorage']

fuzz/regexp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlVRaiseError', 'xmlRegEpxFromParse', 'xmlInitRandom', 'xmlFAGenerateTransitions', 'xmlFuzzDataCleanup', 'xmlRegNewRange', '__xmlStructuredError', 'xmlVSetError', 'xmlRegFreeAtom']

fuzz/html.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlHashUpdateInternal', 'xmlNewDocProp', 'xmlAllocOutputBuffer', 'xmlUnlinkNode', 'xmlNewText', 'xmlNodeGetContent', 'xmlVRaiseError', 'xmlCopyPropInternal', 'htmlNodeDumpInternal']

fuzz/xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlRMutexUnlock', 'xmlBuildURISafe', 'xmlSplitQName4', 'htmlIsBooleanAttr', 'xmlInitializeCatalog', 'xmlHashAdd3', 'xmlOutputBufferWriteQuotedString', 'xmlURIUnescapeString', 'xmlSkipBlankCharsPE', 'xmlParseAttributeType']

fuzz/xinclude.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlRMutexUnlock', 'xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlURIUnescapeString', 'xmlParseAttValue', 'xmlGetPropNodeValueInternal', 'xmlGetNsListSafe', 'xmlParseStartTag2', 'xmlParseElementEnd', 'xmlFinishDocument']

fuzz/xpath.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'xmlHashFindEntry', 'xmlInitializeCatalog', 'xmlHashUpdateInternal', 'xmlNewNs', 'xmlExpandPEsInEntityValue', 'xmlURIUnescapeString', 'xmlNewDoc', 'nodePush', 'xmlSkipBlankCharsPE']

fuzz/lint.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlPatternCompileSafe', 'xmlTextReaderErrMemory', 'xmllintMain', 'xmlFreePatternInternal', 'xmlNodeSetContentInternal', 'xmlFreeDoc', 'xmlOpenCharEncodingHandler', 'xmlValidateDocumentInternal', 'xmlNodeGetAttrValue', 'xmlNodeDumpOutput']

fuzz/valid.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlRMutexUnlock', 'xmlFACompareAtoms', 'xmlBuildURISafe', 'xmlSplitQName4', 'xmlInitializeCatalog', 'xmlHashAdd3', 'xmlRegStateAddTransTo', 'xmlURIUnescapeString', 'xmlRegExecPushStringInternal', 'xmlParsePERefInternal']

fuzz/reader.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlNodeListGetStringInternal', 'xmlCtxtErrIO', 'xmlNewParserCtxt', 'xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'htmlIsBooleanAttr', 'xmlTextReaderValidatePop', 'xmlHashAdd3', 'xmlInitializeCatalog', 'xmlRegStateAddTransTo']

fuzz/schema.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlSchemaVAttributesComplex', 'xmlRMutexUnlock', 'xmlCopyPropInternal', 'xmlParseElementMixedContentDecl', 'xmlSchemaCheckDerivationOKRestriction', 'xmlSchemaBuildContentModelForElement', 'xmlBuildURI', 'xmlSchemaValidatorPopElem', 'xmlInitializeCatalog', 'xmlSchemaFormatQName']

fuzz/api.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlRegStateAddTransTo', 'xmlParseStringPEReference', 'xmlLoadResource', 'xmlURIUnescapeString', 'is_format_lzma', 'xmlCtxtParseContentInternal', 'xmlRegExecSetErrString']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
xmlErrString	321	169	52.64%	['api', 'lint', 'xpath', 'xml', 'valid', 'html', 'schema', 'xinclude', 'reader']
xmlCtxtResolveFromCatalog	32	17	53.12%	['api', 'lint', 'xml', 'valid', 'xpath', 'schema', 'xinclude', 'reader']
xmlXPathCacheObjectCopy	31	17	54.83%	['reader', 'lint', 'xpath', 'xinclude']
xmlXPathRunEval	31	14	45.16%	['reader', 'lint', 'xpath', 'xinclude']
xmlC14NProcessNode	122	24	19.67%	['lint']
xmlC14NCheckForRelativeNamespaces	31	7	22.58%	['lint']
xmlC14NProcessNamespacesAxis	47	22	46.80%	['lint']
xmlExcC14NProcessNamespacesAxis	108	32	29.62%	['lint']
xmlC14NProcessAttrsAxis	112	45	40.17%	['lint']
xmlC11NNormalizeString	85	27	31.76%	['lint']
xmlPatMatch	176	86	48.86%	['reader', 'lint']
xmlValidGetValidElements	64	26	40.62%	['lint']
xmlIOErr	154	8	5.194%	['api', 'lint', 'xml', 'valid', 'xpath', 'schema', 'xinclude', 'reader']
xmlOutputDefaultOpen	41	20	48.78%	['lint']
xmllintResourceLoader	48	13	27.08%	['lint']
streamFile	157	26	16.56%	['lint']
testSAX	49	12	24.48%	['lint']
parseHtml	49	14	28.57%	['lint']
parseXml	50	15	30.0%	['lint']
xz_head	121	55	45.45%	['api', 'lint', 'xml', 'valid', 'xpath', 'schema', 'xinclude', 'reader']
xmlRegExecPushStringInternal	232	127	54.74%	['api', 'lint', 'valid', 'schema', 'reader']
xmlTextReaderSetStructuredErrorHandler	40	16	40.0%	['reader']
xmlTextReaderSetup	159	71	44.65%	['reader', 'lint']
xmlRegExecGetValues	131	54	41.22%	['schema', 'lint']
xmlSchemaFreeValidCtxt	70	37	52.85%	['reader', 'schema', 'lint']
xmlSchemaErr4Line	56	29	51.78%	['schema', 'lint']
xmlSchemaFormatItemForReport	188	30	15.95%	['schema', 'lint']
xmlSchemaAddSchemaDoc	245	131	53.46%	['schema', 'lint']
xmlSchemaBucketCreate	103	50	48.54%	['schema', 'lint']
xmlSchemaParseSchemaElement	83	37	44.57%	['schema', 'lint']
xmlSchemaPValAttrBlockFinal	72	37	51.38%	['schema', 'lint']
xmlSchemaParseAnnotation	74	34	45.94%	['schema', 'lint']
xmlSchemaParseImport	96	51	53.12%	['schema', 'lint']
xmlSchemaParseRestriction	197	89	45.17%	['schema', 'lint']
xmlSchemaParseExtension	86	40	46.51%	['schema', 'lint']
xmlSchemaParseComplexContent	66	26	39.39%	['schema', 'lint']
xmlSchemaParseAttributeGroupRef	79	36	45.56%	['schema', 'lint']
xmlSchemaParseList	66	29	43.93%	['schema', 'lint']
xmlSchemaParseGlobalAttribute	90	49	54.44%	['schema', 'lint']
xmlSchemaParseModelGroupDefinition	63	34	53.96%	['schema', 'lint']
xmlSchemaCheckSRCRedefineFirst	104	7	6.730%	['schema', 'lint']
xmlSchemaResolveElementReferences	47	18	38.29%	['schema', 'lint']
xmlSchemaResolveTypeReferences	74	26	35.13%	['schema', 'lint']
xmlSchemaResolveIDCKeyReferences	44	15	34.09%	['schema', 'lint']
xmlSchemaGetCircModelGrDefRef	37	14	37.83%	['schema', 'lint']
xmlSchemaFixupSimpleTypeStageOne	38	15	39.47%	['schema', 'lint']
xmlSchemaCheckSTPropsCorrect	53	15	28.30%	['schema', 'lint']
xmlSchemaCheckCOSSTRestricts	300	37	12.33%	['schema', 'lint']
xmlSchemaDeriveAndValidateFacets	394	98	24.87%	['schema', 'lint']
xmlSchemaCheckDerivationOKRestriction2to4	185	10	5.405%	['schema', 'lint']
xmlSchemaFixupComplexType	211	38	18.00%	['schema', 'lint']
xmlSchemaCheckSRCCT	93	9	9.677%	['schema', 'lint']
xmlSchemaFixupTypeAttributeUses	118	17	14.40%	['schema', 'lint']
xmlSchemaCheckCTPropsCorrect	70	8	11.42%	['schema', 'lint']
xmlSchemaCheckDerivationOKRestriction	98	15	15.30%	['schema', 'lint']
xmlSchemaCheckElemPropsCorrect	107	29	27.10%	['schema', 'lint']
xmlSchemaCheckElemSubstGroup	63	4	6.349%	['schema', 'lint']
xmlSchemaBuildAContentModel	46	5	10.86%	['schema', 'lint']
particle->maxOccurs==UNBOUNDED?UNBOUNDED	264	54	20.45%
xmlSchemaFacetTypeToString	31	12	38.70%	['schema', 'lint']
xmlSchemaVCheckCVCSimpleType	229	114	49.78%	['schema', 'lint']
xmlSchemaValidateNotation	57	28	49.12%	['schema', 'lint']
xmlSchemaFacetErr	94	49	52.12%	['schema', 'lint']
xmlSchemaGetCanonValueWhtspExt_1	59	24	40.67%	['schema', 'lint']
xmlSchemaValidatorPushAttribute	43	23	53.48%	['schema', 'lint']
xmlSchemaValidateElem	128	44	34.37%	['schema', 'lint']
xmlSchemaComplexTypeErr	69	13	18.84%	['schema', 'lint']
xmlSchemaValidateElemDecl	87	23	26.43%	['schema', 'lint']
xmlSchemaVAttributesComplex	333	62	18.61%	['schema', 'lint']
xmlSchemaValidatorPopElem	227	76	33.48%	['schema', 'lint']
xmlSchemaClearValidCtxt	79	30	37.97%	['reader', 'schema', 'lint']
xmlSchemaGetBuiltInType	100	23	23.0%	['schema', 'lint']
xmlSchemaGetCanonValue	260	17	6.538%	['schema', 'lint']
xmlSchemaValAtomicType	1023	310	30.30%	['schema', 'lint']
xmlSchemaCompareValuesInternal	207	39	18.84%	['schema', 'lint']
xmlSchemaCompareDates	245	68	27.75%	['schema', 'lint']
xmlSchemaValidateLengthFacetInternal	67	20	29.85%	['schema', 'lint']
xmlSchemaValidateFacetInternal	168	27	16.07%	['schema', 'lint']
xmlEscapeFormatString	35	15	42.85%	['reader', 'schema', 'lint']
is_format_lzma	37	11	29.72%	['api', 'lint', 'xml', 'valid', 'xpath', 'schema', 'xinclude', 'reader']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libxml2/fuzz/fuzz.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/xpath.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/fuzz/html.c	['html']	['html']
/src/libxml2/xmlschemastypes.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/entities.c	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['xml', 'xinclude', 'xpath', 'valid', 'reader', 'schema', 'api']
/src/libxml2/fuzz/../xmllint.c	['lint']	[]
/src/libxml2/dict.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/list.c	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'api']
/src/libxml2/buf.c	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/fuzz/xinclude.c	['xinclude']	['xinclude']
/src/libxml2/xmlmemory.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/xzlib.c	['xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['lint', 'api']
/src/libxml2/fuzz/xml.c	['xml']	['xml']
/src/libxml2/xmlIO.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/fuzz/uri.c	['uri']	['uri']
/src/libxml2/fuzz/api.c	['api']	['api']
/src/libxml2/xmlstring.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/./include/private/memory.h	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	[]
/src/libxml2/xmlschemas.c	['lint', 'reader', 'schema']	['schema']
/src/libxml2/HTMLtree.c	['html', 'xml', 'lint', 'reader', 'api']	['html', 'xml', 'reader', 'api']
/src/libxml2/c14n.c	['lint']	['lint']
/src/libxml2/uri.c	['uri', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/error.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/hash.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/relaxng.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/HTMLparser.c	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['html', 'xml', 'xinclude', 'lint', 'valid', 'api']
/src/libxml2/chvalid.c	['regexp', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['regexp', 'xml', 'xinclude', 'valid', 'reader', 'schema', 'api']
/src/libxml2/./timsort.h	['xinclude', 'xpath', 'lint', 'reader']	[]
/src/libxml2/fuzz/xpath.c	['xpath']	['xpath']
/src/libxml2/fuzz/reader.c	['reader']	['reader']
/src/libxml2/fuzz/lint.c	['lint']	['lint']
/src/libxml2/tree.c	['regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/threads.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/xinclude.c	['xinclude', 'lint', 'reader']	['xinclude', 'lint', 'reader']
/src/libxml2/xmlregexp.c	['regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['regexp', 'valid', 'reader', 'schema', 'api']
/src/libxml2/fuzz/schema.c	['schema']	['schema']
/src/libxml2/fuzz/regexp.c	['regexp']	['regexp']
/src/libxml2/pattern.c	['lint', 'reader', 'schema']	['lint', 'schema']
/src/libxml2/globals.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/parser.c	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/fuzz/../shell.c	['lint']	[]
/src/libxml2/valid.c	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/xpointer.c	['xinclude', 'xpath', 'lint', 'reader']	['xinclude', 'xpath', 'reader']
/src/libxml2/encoding.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/fuzz/valid.c	['valid']	['valid']
/src/libxml2/parserInternals.c	['regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/SAX2.c	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/./include/private/parser.h	['html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	[]
/src/libxml2/catalog.c	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']	['uri', 'regexp', 'html', 'xml', 'xinclude', 'xpath', 'lint', 'valid', 'reader', 'schema', 'api']
/src/libxml2/./codegen/unicode.inc	['regexp', 'lint', 'valid', 'reader', 'schema', 'api']	[]
/src/libxml2/xmlsave.c	['html', 'xml', 'lint', 'reader', 'api']	['xml', 'lint', 'reader', 'api']
/src/libxml2/xmlreader.c	['lint', 'reader', 'schema']	['lint', 'reader']

Directories in report

Directory
/src/libxml2/./codegen/
/src/libxml2/./
/src/libxml2/fuzz/
/src/libxml2/fuzz/../
/src/libxml2/./include/private/
/src/libxml2/