High level conclusions

Fuzzers reach 70.67% code coverage.

Fuzzers reach 88.07% of cyclomatic complexity.

Fuzzers reach 77.30% of all functions.

Fuzzer lint is blocked:

The runtime code coverage of lint covers 27.84% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

2156 / 2789

Cyclomatic complexity statically reachable by fuzzers

28333 / 32169

Runtime code coverage of functions

1971 / 2789

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	41	12.4%
gold	[1:9]	40	12.1%
yellow	[10:29]	12	3.63%
greenyellow	[30:49]	3	0.90%
lawngreen	50+	234	70.9%
All colors	330	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	9	xmlInitRandom	call site: 00009	xmlAbort
7	218	xmlURIEscape	call site: 00218	xmlURIEscapeStr
5	323	xmlFuzzDataCleanup	call site: 00323	xmlDictFree
4	134	LLVMFuzzerTestOneInput	call site: 00134	fprintf
4	197	xmlURIEscape	call site: 00197	xmlURIEscapeStr
2	150	xmlSaveUri	call site: 00150	xmlSaveUriRealloc
2	159	xmlSaveUri	call site: 00159	xmlSaveUriRealloc
1	27	xmlInitGlobalsInternal	call site: 00027	xmlResetError
1	45	xmlGetThreadLocalStorage	call site: 00045	pthread_getspecific
1	47	xmlGetThreadLocalStorage	call site: 00047	xmlAbort
1	60	xmlRandom	call site: 00060	xmlHashGrow
1	85	xmlParse3986Host	call site: 00085	xmlParse3986DecOctet

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

26

Reachable functions

117

Percentage of reachable functions covered

77.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/uri.c	1
fuzz/fuzz.c	7
hash.c	4
threads.c	7
dict.c	6
error.c	3
xmlmemory.c	1
globals.c	6
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
uri.c	43
xmlstring.c	12
./include/private/memory.h	1

Fuzzer: regexp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	23.0%
gold	[1:9]	51	11.8%
yellow	[10:29]	7	1.63%
greenyellow	[30:49]	3	0.69%
lawngreen	50+	269	62.7%
All colors	429	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	122	xmlVRaiseError	call site: 00122	xmlFormatError
10	401	xmlRegEpxFromParse	call site: 00401	xmlRegexpErrMemory
8	9	xmlInitRandom	call site: 00009	xmlAbort
7	100	xmlVRaiseError	call site: 00100	xmlGetLineNo
5	168	xmlFAGenerateTransitions	call site: 00168	xmlRegCopyAtom
5	421	xmlFuzzDataCleanup	call site: 00421	xmlDictFree
4	174	xmlRegNewRange	call site: 00174	xmlRegexpErrMemory
3	80	__xmlStructuredError	call site: 00080	__xmlStructuredError
3	118	xmlVSetError	call site: 00118	xmlCopyError
3	179	xmlRegFreeAtom	call site: 00179	xmlFAGenerateTransitions
3	233	xmlFAParseCharClassEsc	call site: 00233	xmlRegAtomAddRange
3	310	xmlFACompareAtoms	call site: 00310	xmlRegStrEqualWildcard

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

41

Reachable functions

182

Percentage of reachable functions covered

77.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/regexp.c	1
fuzz/fuzz.c	6
hash.c	4
threads.c	7
dict.c	6
error.c	13
xmlmemory.c	1
globals.c	12
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
xmlregexp.c	60
xmlstring.c	7
./include/private/memory.h	1
tree.c	2
parserInternals.c	1
chvalid.c	1
./codegen/unicode.inc	35

Fuzzer: html

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	560	45.3%
gold	[1:9]	39	3.15%
yellow	[10:29]	10	0.80%
greenyellow	[30:49]	8	0.64%
lawngreen	50+	618	50.0%
All colors	1235	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	905	xmlHashUpdateInternal	call site: 00905	xmlCopyNode
40	1025	xmlNewDocProp	call site: 01025	xmlNewDocProp
26	694	xmlAllocOutputBuffer	call site: 00694	xmlCharEncOutput
24	166	xmlUnlinkNode	call site: 00166	xmlFreeEntitiesTable
19	980	xmlNewDocProp	call site: 00980	xmlNodeParseAttValue
18	1004	xmlNewText	call site: 01004	xmlNodeParseAttValue
16	1120	xmlNodeGetContent	call site: 01120	xmlBufGetNodeContent
15	320	xmlVRaiseError	call site: 00320	xmlRaiseMemoryError
15	1066	xmlCopyPropInternal	call site: 01066	xmlCopyDtd
14	761	htmlNodeDumpInternal	call site: 00761	htmlParseMetaEncoding
12	779	htmlNodeDumpInternal	call site: 00779	xmlNsListDumpOutput
11	137	xmlFreeDtd	call site: 00137	xmlFreeElementTable

Runtime coverage analysis

Covered functions

302

Functions that are reachable but not covered

142

Reachable functions

388

Percentage of reachable functions covered

63.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/html.c	1
fuzz/fuzz.c	7
hash.c	16
threads.c	7
dict.c	18
error.c	14
xmlmemory.c	1
globals.c	15
encoding.c	19
xpath.c	2
xmlIO.c	17
catalog.c	5
xmlschemastypes.c	1
relaxng.c	1
HTMLparser.c	56
SAX2.c	1
parserInternals.c	30
parser.c	8
buf.c	19
tree.c	50
valid.c	33
list.c	3
xmlregexp.c	4
entities.c	8
xmlstring.c	12
./include/private/memory.h	1
./include/private/parser.h	1
HTMLtree.c	9
xmlsave.c	3

Fuzzer: xpath

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1146	34.3%
gold	[1:9]	169	5.06%
yellow	[10:29]	37	1.10%
greenyellow	[30:49]	27	0.80%
lawngreen	50+	1956	58.6%
All colors	3335	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
127	1791	xmlBuildURISafe	call site: 01791	xmlCatalogXMLResolve
53	1927	xmlInitializeCatalog	call site: 01927	xmlACatalogResolve
45	1557	xmlHashUpdateInternal	call site: 01557	xmlCopyEntity
39	689	xmlHashFindEntry	call site: 00689	xmlParseXMLCatalogFile
36	1513	xmlNewNs	call site: 01513	xmlStaticCopyNodeList
32	2165	xmlExpandPEsInEntityValue	call site: 02165	xmlLoadEntityContent
26	644	xmlURIUnescapeString	call site: 00644	xmlCatalogLocalResolve
25	1629	xmlNewDoc	call site: 01629	xmlCopyDtd
22	1400	nodePush	call site: 01400	xmlParseTextDecl
21	1986	xmlSkipBlankCharsPE	call site: 01986	xmlSkipBlankCharsPE
18	1127	xmlParseAttValue	call site: 01127	xmlSkipBlankChars
18	1732	xmlGetPropNodeValueInternal	call site: 01732	xmlParseXMLCatalogNodeList

Runtime coverage analysis

Covered functions

688

Functions that are reachable but not covered

185

Reachable functions

757

Percentage of reachable functions covered

75.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xpath.c	1
fuzz/fuzz.c	7
hash.c	27
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	140
xmlIO.c	17
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
parser.c	141
parserInternals.c	40
SAX2.c	6
buf.c	19
HTMLparser.c	2
xmlstring.c	16
tree.c	65
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
entities.c	10
valid.c	41
list.c	3
xmlregexp.c	4
xpointer.c	8
./timsort.h	12

Fuzzer: xinclude

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	783	21.1%
gold	[1:9]	234	6.32%
yellow	[10:29]	59	1.59%
greenyellow	[30:49]	46	1.24%
lawngreen	50+	2579	69.6%
All colors	3701	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
64	1877	xmlNodeGetBaseSafe	call site: 01877	xmlCatalogXMLResolve
50	1950	xmlInitializeCatalog	call site: 01950	xmlACatalogResolve
40	822	xmlRMutexUnlock	call site: 00822	xmlParseXMLCatalogFile
26	785	xmlURIUnescapeString	call site: 00785	xmlCatalogLocalResolve
18	1259	xmlParseAttValue	call site: 01259	xmlSkipBlankChars
17	1755	xmlGetPropNodeValueInternal	call site: 01755	xmlParseXMLCatalogNodeList
17	1791	xmlGetNsListSafe	call site: 01791	xmlParseXMLCatalogOneNode
14	1244	xmlParseStartTag2	call site: 01244	xmlParseStartTag
14	1360	xmlParseElementEnd	call site: 01360	xmlParseEndTag1
14	1554	xmlSearchNsByHrefSafe	call site: 01554	xmlSearchNsSafe
14	1736	xmlFinishDocument	call site: 01736	xmlFreeDoc
12	626	xmlParsePI	call site: 00626	xmlParseCatalogPI

Runtime coverage analysis

Covered functions

808

Functions that are reachable but not covered

128

Reachable functions

820

Percentage of reachable functions covered

84.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xinclude.c	1
fuzz/fuzz.c	12
hash.c	29
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	16
xpath.c	139
xmlIO.c	18
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	18
parserInternals.c	42
SAX2.c	6
parser.c	143
buf.c	19
tree.c	83
valid.c	41
list.c	3
xmlregexp.c	4
entities.c	11
HTMLparser.c	2
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	39
xinclude.c	27
xpointer.c	8
./timsort.h	12

Fuzzer: reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1882	33.3%
gold	[1:9]	283	5.00%
yellow	[10:29]	94	1.66%
greenyellow	[30:49]	50	0.88%
lawngreen	50+	3341	59.1%
All colors	5650	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
277	4502	xmlNodeListGetStringInternal	call site: 04502	xmlTextReaderExpand
150	502	xmlCtxtErrIO	call site: 00502	xmlFreeTextReader
86	4196	xmlFACompareAtoms	call site: 04196	xmlFARecurseDeterminism
64	2423	xmlCopyPropInternal	call site: 02423	xmlCopyDtd
64	2656	xmlNodeGetBaseSafe	call site: 02656	xmlCatalogXMLResolve
62	4963	htmlIsBooleanAttr	call site: 04963	xmlSaveSwitchEncoding
59	2826	xmlTextReaderValidatePop	call site: 02826	xmlRelaxNGValidatePopElement
50	2729	xmlInitializeCatalog	call site: 02729	xmlACatalogResolve
36	4313	xmlRegStateAddTransTo	call site: 04313	xmlFAGenerateTransitions
34	4906	xmlOutputBufferWriteQuotedString	call site: 04906	htmlNodeDumpInternal
33	1459	xmlCtxtResolveFromCatalog	call site: 01459	xmlResolveFromCatalog
33	1511	xmlNewParserCtxt	call site: 01511	xmlParserInputBufferCreateFilename

Runtime coverage analysis

Covered functions

1002

Functions that are reachable but not covered

340

Reachable functions

1195

Percentage of reachable functions covered

71.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/reader.c	2
fuzz/fuzz.c	11
hash.c	29
threads.c	9
dict.c	22
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	139
xmlIO.c	30
catalog.c	33
xmlschemastypes.c	2
relaxng.c	58
xmlstring.c	19
xmlreader.c	85
buf.c	20
SAX2.c	6
parser.c	151
parserInternals.c	43
./include/private/memory.h	1
tree.c	89
valid.c	51
list.c	3
xmlregexp.c	59
entities.c	11
uri.c	39
xinclude.c	29
pattern.c	8
HTMLparser.c	4
xmlschemas.c	43
./include/private/parser.h	2
chvalid.c	1
xpointer.c	8
./timsort.h	12
./codegen/unicode.inc	35
xmlsave.c	31
HTMLtree.c	8

Fuzzer: api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	879	17.0%
gold	[1:9]	182	3.52%
yellow	[10:29]	38	0.73%
greenyellow	[30:49]	10	0.19%
lawngreen	50+	4054	78.5%
All colors	5163	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	3799	xmlFACompareAtoms	call site: 03799	xmlFARecurseDeterminism
64	1888	xmlNodeGetBaseSafe	call site: 01888	xmlCatalogXMLResolve
51	1961	xmlInitializeCatalog	call site: 01961	xmlACatalogResolve
36	3916	xmlRegStateAddTransTo	call site: 03916	xmlFAGenerateTransitions
34	2197	xmlParseStringPEReference	call site: 02197	xmlLoadEntityContent
27	2014	xmlLoadResource	call site: 02014	xmlSkipBlankCharsPE
26	782	xmlURIUnescapeString	call site: 00782	xmlCatalogLocalResolve
20	1436	xmlCtxtParseContentInternal	call site: 01436	xmlParseTextDecl
17	4071	xmlRegExecSetErrString	call site: 04071	xmlFARegExecSaveInputString
15	1767	xmlGetPropNodeValueInternal	call site: 01767	xmlParseXMLCatalogNodeList
12	630	xmlParsePI	call site: 00630	xmlParseCatalogPI
10	819	xmlRMutexUnlock	call site: 00819	xmlParseXMLCatalogFile

Runtime coverage analysis

Covered functions

924

Functions that are reachable but not covered

149

Reachable functions

1001

Percentage of reachable functions covered

85.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/api.c	35
fuzz/fuzz.c	11
hash.c	30
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	29
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
tree.c	155
valid.c	101
list.c	12
xmlregexp.c	58
entities.c	20
parser.c	146
parserInternals.c	38
SAX2.c	6
buf.c	26
HTMLparser.c	7
xmlstring.c	18
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	36
HTMLtree.c	20
./codegen/unicode.inc	35
xmlsave.c	49

Fuzzer: xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	941	29.9%
gold	[1:9]	127	4.04%
yellow	[10:29]	55	1.75%
greenyellow	[30:49]	30	0.95%
lawngreen	50+	1986	63.2%
All colors	3139	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
69	1875	xmlBuildURISafe	call site: 01875	xmlCatalogXMLResolve
61	2616	htmlIsBooleanAttr	call site: 02616	htmlAttrDumpOutput
50	1953	xmlInitializeCatalog	call site: 01953	xmlACatalogResolve
49	1580	xmlNewDtd	call site: 01580	xmlCopyEntitiesTable
40	825	xmlRMutexUnlock	call site: 00825	xmlParseXMLCatalogFile
35	2558	xmlOutputBufferWriteQuotedString	call site: 02558	htmlNodeDumpInternal
27	1784	xmlStrncat	call site: 01784	xmlParseXMLCatalogOneNode
26	788	xmlURIUnescapeString	call site: 00788	xmlCatalogLocalResolve
21	1754	xmlSplitQName4	call site: 01754	xmlParseXMLCatalogNodeList
18	1262	xmlParseAttValue	call site: 01262	xmlSkipBlankChars
18	1553	xmlCopyPropInternal	call site: 01553	xmlNewReconciledNs
16	1690	xmlNodeGetContent	call site: 01690	xmlBufGetNodeContent

Runtime coverage analysis

Covered functions

604

Functions that are reachable but not covered

164

Reachable functions

691

Percentage of reachable functions covered

76.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xml.c	1
fuzz/fuzz.c	13
hash.c	28
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	31
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	17
parserInternals.c	43
SAX2.c	6
parser.c	152
buf.c	25
tree.c	67
valid.c	40
list.c	3
xmlregexp.c	4
entities.c	10
HTMLparser.c	4
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
xmlsave.c	35
HTMLtree.c	8

Fuzzer: valid

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	864	27.1%
gold	[1:9]	95	2.98%
yellow	[10:29]	83	2.60%
greenyellow	[30:49]	28	0.88%
lawngreen	50+	2111	66.3%
All colors	3181	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	2600	xmlFACompareAtoms	call site: 02600	xmlFARecurseDeterminism
69	1874	xmlBuildURISafe	call site: 01874	xmlCatalogXMLResolve
50	1952	xmlInitializeCatalog	call site: 01952	xmlACatalogResolve
49	1579	xmlNewDtd	call site: 01579	xmlCopyEntitiesTable
40	824	xmlRMutexUnlock	call site: 00824	xmlParseXMLCatalogFile
36	2717	xmlRegStateAddTransTo	call site: 02717	xmlFAGenerateTransitions
33	1783	xmlStrncat	call site: 01783	xmlParseXMLCatalogOneNode
27	1753	xmlSplitQName4	call site: 01753	xmlParseXMLCatalogNodeList
26	787	xmlURIUnescapeString	call site: 00787	xmlCatalogLocalResolve
18	1552	xmlCopyPropInternal	call site: 01552	xmlNewReconciledNs
17	2872	xmlRegExecSetErrString	call site: 02872	xmlFARegExecSaveInputString
16	1689	xmlNodeGetContent	call site: 01689	xmlBufGetNodeContent

Runtime coverage analysis

Covered functions

649

Functions that are reachable but not covered

195

Reachable functions

762

Percentage of reachable functions covered

74.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/valid.c	1
fuzz/fuzz.c	13
hash.c	28
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	20
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	16
parserInternals.c	43
SAX2.c	6
parser.c	157
buf.c	19
tree.c	70
valid.c	78
list.c	8
xmlregexp.c	58
entities.c	10
HTMLparser.c	3
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
./codegen/unicode.inc	35

Fuzzer: schema

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1604	26.1%
gold	[1:9]	430	7.01%
yellow	[10:29]	201	3.27%
greenyellow	[30:49]	93	1.51%
lawngreen	50+	3806	62.0%
All colors	6134	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
66	2351	xmlCopyPropInternal	call site: 02351	xmlCopyDtd
60	2588	xmlBuildURI	call site: 02588	xmlCatalogXMLResolve
51	2657	xmlInitializeCatalog	call site: 02657	xmlACatalogResolve
40	5493	xmlSchemaBuildContentModelForElement	call site: 05493	xmlSchemaBuildAContentModel
33	2187	xmlNewDocNode	call site: 02187	xmlNodeParseAttValue
32	2044	xmlParseStartTag2	call site: 02044	xmlParseStartTag
26	6012	xmlSchemaValidatorPopElem	call site: 06012	xmlAddChild
23	5855	xmlSchemaVAttributesComplex	call site: 05855	xmlNewProp
19	4749	xmlSchemaGetCanonValue	call site: 04749	xmlSchemaDateNormalize
18	2332	xmlCopyPropInternal	call site: 02332	xmlNewReconciledNs
18	2459	xmlNodeGetContent	call site: 02459	xmlAddIDSafe
18	5658	xmlSchemaVDocWalk	call site: 05658	xmlSchemaAssembleByXSI

Runtime coverage analysis

Covered functions

1066

Functions that are reachable but not covered

192

Reachable functions

1200

Percentage of reachable functions covered

84.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/schema.c	1
fuzz/fuzz.c	11
hash.c	29
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	19
catalog.c	33
xmlschemastypes.c	71
relaxng.c	1
xmlstring.c	20
xmlschemas.c	335
parserInternals.c	43
buf.c	19
xmlregexp.c	89
tree.c	85
SAX2.c	6
parser.c	144
valid.c	45
list.c	7
entities.c	10
HTMLparser.c	2
uri.c	36
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
pattern.c	29
xmlreader.c	3
./codegen/unicode.inc	35

Fuzzer: lint

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9840	84.6%
gold	[1:9]	119	1.02%
yellow	[10:29]	62	0.53%
greenyellow	[30:49]	39	0.33%
lawngreen	50+	1560	13.4%
All colors	11620	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1136	5832	xmlPatternCompileSafe	call site: 05832	xmlSchemaParseRedefine
781	3292	xmlTextReaderErrMemory	call site: 03292	xmlRelaxReadFile
660	5086	xmlFreePatternInternal	call site: 05086	xmlSchemaParseNewDocWithContext
622	4357	xmlNodeSetContentInternal	call site: 04357	xmlRelaxNGCleanupTree
524	1802	xmlFreeDoc	call site: 01802	xmlSkipBlankCharsPE
474	9157	xmllintMain	call site: 09157	xmlSchemaValidateStream
470	8538	xmlOpenCharEncodingHandler	call site: 08538	xmlXIncludeLoadFallback
322	9993	xmlValidateDocumentInternal	call site: 09993	xmllintShellRNGValidate
234	2818	xmlNodeGetAttrValue	call site: 02818	xmlRelaxNGParse
230	10900	xmlNodeDumpOutput	call site: 10900	xmllintShellSetContent
228	4127	xmlNewInputFromMemory	call site: 04127	xmlRelaxNGCleanupDoc
209	1430	xmlLoadResource	call site: 01430	xmlSkipBlankCharsPE

Runtime coverage analysis

Covered functions

630

Functions that are reachable but not covered

1441

Reachable functions

1997

Percentage of reachable functions covered

27.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/lint.c	2
xmlmemory.c	8
fuzz/fuzz.c	10
hash.c	30
threads.c	13
dict.c	24
error.c	18
globals.c	25
encoding.c	22
xpath.c	147
xmlIO.c	36
catalog.c	47
xmlschemastypes.c	72
relaxng.c	140
xmlstring.c	20
fuzz/../xmllint.c	27
parser.c	166
parserInternals.c	51
chvalid.c	1
./include/private/memory.h	1
uri.c	40
SAX2.c	7
buf.c	20
tree.c	110
./include/private/parser.h	2
valid.c	90
xmlregexp.c	92
entities.c	11
list.c	12
xmlschemas.c	343
xmlreader.c	51
./codegen/unicode.inc	35
pattern.c	32
HTMLparser.c	62
xinclude.c	29
xpointer.c	8
./timsort.h	12
HTMLtree.c	17
fuzz/../shell.c	21
xmlsave.c	44
c14n.c	39

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
xmlSAX2StartElement	/src/libxml2/SAX2.c	3	['N/A', 'N/A', 'N/A']	22	0	77	15	7	284	0	2942	244
xmlSAX2StartElementNs	/src/libxml2/SAX2.c	9	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A', 'int', 'int', 'N/A']	18	0	982	148	59	254	0	2316	157
xmlXPathSubstringFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	485	88	34	145	0	925	80
xmlCatalogDump	/src/libxml2/catalog.c	1	['N/A']	25	0	37	9	4	304	0	2838	71
xmlCatalogAdd	/src/libxml2/catalog.c	3	['N/A', 'N/A', 'N/A']	40	0	73	12	5	576	0	7114	59
xmlXPathTranslateFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	435	72	28	137	0	856	48
xmlParseEntity	/src/libxml2/parser.c	1	['N/A']	37	0	15	3	2	580	0	7109	40

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2201 / 2789

Cyclomatic complexity statically reachable by fuzzers

29032 / 32169

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzz/uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlInitRandom', 'xmlURIEscape', 'xmlFuzzDataCleanup', 'LLVMFuzzerTestOneInput', 'xmlSaveUri', 'xmlInitGlobalsInternal', 'xmlGetThreadLocalStorage']

fuzz/regexp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlVRaiseError', 'xmlRegEpxFromParse', 'xmlInitRandom', 'xmlFAGenerateTransitions', 'xmlFuzzDataCleanup', 'xmlRegNewRange', '__xmlStructuredError', 'xmlVSetError', 'xmlRegFreeAtom']

fuzz/html.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlHashUpdateInternal', 'xmlNewDocProp', 'xmlAllocOutputBuffer', 'xmlUnlinkNode', 'xmlNewText', 'xmlNodeGetContent', 'xmlVRaiseError', 'xmlCopyPropInternal', 'htmlNodeDumpInternal']

fuzz/xpath.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'xmlInitializeCatalog', 'xmlHashUpdateInternal', 'xmlHashFindEntry', 'xmlNewNs', 'xmlExpandPEsInEntityValue', 'xmlURIUnescapeString', 'xmlNewDoc', 'nodePush', 'xmlSkipBlankCharsPE']

fuzz/xinclude.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlRMutexUnlock', 'xmlURIUnescapeString', 'xmlParseAttValue', 'xmlGetPropNodeValueInternal', 'xmlGetNsListSafe', 'xmlParseStartTag2', 'xmlParseElementEnd', 'xmlSearchNsByHrefSafe']

fuzz/reader.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlNodeListGetStringInternal', 'xmlCtxtErrIO', 'xmlFACompareAtoms', 'xmlCopyPropInternal', 'xmlNodeGetBaseSafe', 'htmlIsBooleanAttr', 'xmlTextReaderValidatePop', 'xmlInitializeCatalog', 'xmlRegStateAddTransTo', 'xmlOutputBufferWriteQuotedString']

fuzz/api.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlRegStateAddTransTo', 'xmlParseStringPEReference', 'xmlLoadResource', 'xmlURIUnescapeString', 'xmlCtxtParseContentInternal', 'xmlRegExecSetErrString', 'xmlGetPropNodeValueInternal']

fuzz/xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'htmlIsBooleanAttr', 'xmlInitializeCatalog', 'xmlNewDtd', 'xmlRMutexUnlock', 'xmlOutputBufferWriteQuotedString', 'xmlStrncat', 'xmlURIUnescapeString', 'xmlSplitQName4', 'xmlParseAttValue']

fuzz/valid.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlBuildURISafe', 'xmlInitializeCatalog', 'xmlNewDtd', 'xmlRMutexUnlock', 'xmlRegStateAddTransTo', 'xmlStrncat', 'xmlSplitQName4', 'xmlURIUnescapeString', 'xmlCopyPropInternal']

fuzz/schema.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlCopyPropInternal', 'xmlBuildURI', 'xmlInitializeCatalog', 'xmlSchemaBuildContentModelForElement', 'xmlNewDocNode', 'xmlParseStartTag2', 'xmlSchemaValidatorPopElem', 'xmlSchemaVAttributesComplex', 'xmlSchemaGetCanonValue']

fuzz/lint.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlPatternCompileSafe', 'xmlTextReaderErrMemory', 'xmlFreePatternInternal', 'xmlNodeSetContentInternal', 'xmlFreeDoc', 'xmllintMain', 'xmlOpenCharEncodingHandler', 'xmlValidateDocumentInternal', 'xmlNodeGetAttrValue', 'xmlNodeDumpOutput']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
xmlErrString	321	169	52.64%	['xml', 'reader', 'xinclude', 'xpath', 'lint', 'valid', 'html', 'schema', 'api']
xmlXPathCacheObjectCopy	31	17	54.83%	['lint', 'reader', 'xinclude', 'xpath']
xmlXPathRunEval	31	14	45.16%	['lint', 'reader', 'xinclude', 'xpath']
xmlCtxtResolveFromCatalog	32	17	53.12%	['xml', 'reader', 'xinclude', 'xpath', 'lint', 'valid', 'schema', 'api']
xmlTextReaderSetStructuredErrorHandler	39	16	41.02%	['reader']
xmlTextReaderSetup	159	69	43.39%	['lint', 'reader']
xmlIOErr	154	8	5.194%	['xml', 'reader', 'xinclude', 'xpath', 'lint', 'valid', 'schema', 'api']
xmlSchemaItemTypeToStr	44	24	54.54%	['lint', 'schema']
xmlSchemaAddAnnotation	83	12	14.45%	['lint', 'schema']
xmlSchemaCheckSRCRedefineFirst	104	7	6.730%	['lint', 'schema']
xmlSchemaGetCircModelGrDefRef	37	20	54.05%	['lint', 'schema']
xmlSchemaCheckSTPropsCorrect	53	28	52.83%	['lint', 'schema']
xmlSchemaCheckCOSSTRestricts	300	138	46.0%	['lint', 'schema']
xmlSchemaCheckCOSSTDerivedOK	43	20	46.51%	['lint', 'schema']
xmlSchemaCheckCOSCTExtends	56	30	53.57%	['lint', 'schema']
xmlSchemaCheckDerivationOKRestriction	98	41	41.83%	['lint', 'schema']
xmlSchemaLookupNamespace	45	14	31.11%	['lint', 'schema']
xmlSchemaValidateElemDecl	87	40	45.97%	['lint', 'schema']
xmlSchemaGetBuiltInType	99	48	48.48%	['lint', 'schema']
xmlSchemaCopyValue	91	32	35.16%	['lint', 'schema']
xmlSchemaGetCanonValue	260	86	33.07%	['lint', 'schema']
xmlSchemaCompareValuesInternal	207	84	40.57%	['lint', 'schema']
xmlSchemaValidateFacetInternal	168	65	38.69%	['lint', 'schema']
xmlC14NProcessNode	122	24	19.67%	['lint']
xmlC14NCheckForRelativeNamespaces	31	7	22.58%	['lint']
xmlC14NProcessNamespacesAxis	47	22	46.80%	['lint']
xmlExcC14NProcessNamespacesAxis	108	32	29.62%	['lint']
xmlC14NProcessAttrsAxis	112	45	40.17%	['lint']
xmlC11NNormalizeString	85	27	31.76%	['lint']
xmlPatMatch	176	83	47.15%	['lint', 'reader']
xmlValidGetValidElements	64	26	40.62%	['lint']
xmlOutputDefaultOpen	41	20	48.78%	['lint']
xmllintResourceLoader	48	13	27.08%	['lint']
streamFile	156	26	16.66%	['lint']
testSAX	49	12	24.48%	['lint']
parseHtml	49	14	28.57%	['lint']
parseXml	50	15	30.0%	['lint']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libxml2/globals.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/parserInternals.c	['regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/list.c	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/pattern.c	['reader', 'schema', 'lint']	['schema', 'lint']
/src/libxml2/fuzz/reader.c	['reader']	['reader']
/src/libxml2/./timsort.h	['xpath', 'xinclude', 'reader', 'lint']	[]
/src/libxml2/relaxng.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/SAX2.c	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/fuzz/api.c	['api']	['api']
/src/libxml2/fuzz/schema.c	['schema']	['schema']
/src/libxml2/xpath.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/xpointer.c	['xpath', 'xinclude', 'reader', 'lint']	['xpath', 'xinclude', 'reader']
/src/libxml2/fuzz/regexp.c	['regexp']	['regexp']
/src/libxml2/fuzz/xml.c	['xml']	['xml']
/src/libxml2/HTMLtree.c	['html', 'reader', 'api', 'xml', 'lint']	['html', 'reader', 'api', 'xml']
/src/libxml2/xmlregexp.c	['regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['regexp', 'reader', 'api', 'valid', 'schema']
/src/libxml2/xmlschemas.c	['reader', 'schema', 'lint']	['schema']
/src/libxml2/fuzz/../shell.c	['lint']	[]
/src/libxml2/c14n.c	['lint']	['lint']
/src/libxml2/hash.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/HTMLparser.c	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['html', 'xinclude', 'api', 'xml', 'valid', 'lint']
/src/libxml2/fuzz/html.c	['html']	['html']
/src/libxml2/fuzz/uri.c	['uri']	['uri']
/src/libxml2/xinclude.c	['xinclude', 'reader', 'lint']	['xinclude', 'reader', 'lint']
/src/libxml2/xmlsave.c	['html', 'reader', 'api', 'xml', 'lint']	['reader', 'api', 'xml', 'lint']
/src/libxml2/dict.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/threads.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/fuzz/valid.c	['valid']	['valid']
/src/libxml2/uri.c	['uri', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/buf.c	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/fuzz/fuzz.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/xmlreader.c	['reader', 'schema', 'lint']	['reader', 'lint']
/src/libxml2/tree.c	['regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/fuzz/../xmllint.c	['lint']	[]
/src/libxml2/xmlmemory.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/xmlstring.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/fuzz/xinclude.c	['xinclude']	['xinclude']
/src/libxml2/encoding.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/./codegen/unicode.inc	['regexp', 'reader', 'api', 'valid', 'schema', 'lint']	[]
/src/libxml2/chvalid.c	['regexp', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['regexp', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema']
/src/libxml2/./include/private/parser.h	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	[]
/src/libxml2/parser.c	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/entities.c	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema']
/src/libxml2/error.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/./include/private/memory.h	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	[]
/src/libxml2/xmlIO.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/fuzz/xpath.c	['xpath']	['xpath']
/src/libxml2/valid.c	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/catalog.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/xmlschemastypes.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'api', 'xml', 'valid', 'schema', 'lint']
/src/libxml2/fuzz/lint.c	['lint']	['lint']

Directories in report

Directory
/src/libxml2/./codegen/
/src/libxml2/fuzz/../
/src/libxml2/./
/src/libxml2/fuzz/
/src/libxml2/./include/private/
/src/libxml2/