High level conclusions

Fuzzers reach 70.48% code coverage.

Fuzzers reach 88.08% of cyclomatic complexity.

Fuzzers reach 77.32% of all functions.

Fuzzer lint is blocked:

The runtime code coverage of lint covers 25.14% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

2159 / 2792

Cyclomatic complexity statically reachable by fuzzers

28365 / 32201

Runtime code coverage of functions

1968 / 2792

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	41	12.4%
gold	[1:9]	40	12.1%
yellow	[10:29]	12	3.63%
greenyellow	[30:49]	3	0.90%
lawngreen	50+	234	70.9%
All colors	330	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	9	xmlInitRandom	call site: 00009	xmlAbort
7	218	xmlURIEscape	call site: 00218	xmlURIEscapeStr
5	323	xmlFuzzDataCleanup	call site: 00323	xmlDictFree
4	134	LLVMFuzzerTestOneInput	call site: 00134	fprintf
4	197	xmlURIEscape	call site: 00197	xmlURIEscapeStr
2	150	xmlSaveUri	call site: 00150	xmlSaveUriRealloc
2	159	xmlSaveUri	call site: 00159	xmlSaveUriRealloc
1	27	xmlInitGlobalsInternal	call site: 00027	xmlResetError
1	45	xmlGetThreadLocalStorage	call site: 00045	pthread_getspecific
1	47	xmlGetThreadLocalStorage	call site: 00047	xmlAbort
1	60	xmlRandom	call site: 00060	xmlHashGrow
1	85	xmlParse3986Host	call site: 00085	xmlParse3986DecOctet

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

26

Reachable functions

117

Percentage of reachable functions covered

77.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/uri.c	1
fuzz/fuzz.c	7
hash.c	4
threads.c	7
dict.c	6
error.c	3
xmlmemory.c	1
globals.c	6
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
uri.c	43
xmlstring.c	12
./include/private/memory.h	1

Fuzzer: regexp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	23.0%
gold	[1:9]	50	11.6%
yellow	[10:29]	8	1.86%
greenyellow	[30:49]	2	0.46%
lawngreen	50+	270	62.9%
All colors	429	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	122	xmlVRaiseError	call site: 00122	xmlFormatError
10	401	xmlRegEpxFromParse	call site: 00401	xmlRegexpErrMemory
8	9	xmlInitRandom	call site: 00009	xmlAbort
7	100	xmlVRaiseError	call site: 00100	xmlGetLineNo
5	168	xmlFAGenerateTransitions	call site: 00168	xmlRegCopyAtom
5	421	xmlFuzzDataCleanup	call site: 00421	xmlDictFree
4	174	xmlRegNewRange	call site: 00174	xmlRegexpErrMemory
3	80	__xmlStructuredError	call site: 00080	__xmlStructuredError
3	118	xmlVSetError	call site: 00118	xmlCopyError
3	179	xmlRegFreeAtom	call site: 00179	xmlFAGenerateTransitions
3	233	xmlFAParseCharClassEsc	call site: 00233	xmlRegAtomAddRange
3	310	xmlFACompareAtoms	call site: 00310	xmlRegStrEqualWildcard

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

41

Reachable functions

182

Percentage of reachable functions covered

77.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/regexp.c	1
fuzz/fuzz.c	6
hash.c	4
threads.c	7
dict.c	6
error.c	13
xmlmemory.c	1
globals.c	12
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
xmlregexp.c	60
xmlstring.c	7
./include/private/memory.h	1
tree.c	2
parserInternals.c	1
chvalid.c	1
./codegen/unicode.inc	35

Fuzzer: html

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	562	45.4%
gold	[1:9]	39	3.15%
yellow	[10:29]	6	0.48%
greenyellow	[30:49]	8	0.64%
lawngreen	50+	622	50.2%
All colors	1237	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	906	xmlHashUpdateInternal	call site: 00906	xmlCopyNode
40	1026	xmlNewDocProp	call site: 01026	xmlNewDocProp
26	694	xmlAllocOutputBuffer	call site: 00694	xmlCharEncOutput
24	166	xmlUnlinkNode	call site: 00166	xmlFreeEntitiesTable
19	981	xmlNewDocProp	call site: 00981	xmlNodeParseAttValue
18	1005	xmlNewText	call site: 01005	xmlNodeParseAttValue
16	1121	xmlNodeGetContent	call site: 01121	xmlBufGetNodeContent
15	320	xmlVRaiseError	call site: 00320	xmlRaiseMemoryError
15	1067	xmlCopyPropInternal	call site: 01067	xmlCopyDtd
14	761	htmlNodeDumpInternal	call site: 00761	htmlParseMetaEncoding
12	779	htmlNodeDumpInternal	call site: 00779	xmlNsListDumpOutput
11	137	xmlFreeDtd	call site: 00137	xmlFreeElementTable

Runtime coverage analysis

Covered functions

302

Functions that are reachable but not covered

142

Reachable functions

388

Percentage of reachable functions covered

63.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/html.c	1
fuzz/fuzz.c	7
hash.c	16
threads.c	7
dict.c	18
error.c	14
xmlmemory.c	1
globals.c	15
encoding.c	19
xpath.c	2
xmlIO.c	17
catalog.c	5
xmlschemastypes.c	1
relaxng.c	1
HTMLparser.c	56
SAX2.c	1
parserInternals.c	30
parser.c	8
buf.c	19
tree.c	50
valid.c	33
list.c	3
xmlregexp.c	4
entities.c	8
xmlstring.c	12
./include/private/memory.h	1
./include/private/parser.h	1
HTMLtree.c	9
xmlsave.c	3

Fuzzer: xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	945	30.0%
gold	[1:9]	120	3.81%
yellow	[10:29]	58	1.84%
greenyellow	[30:49]	29	0.92%
lawngreen	50+	1992	63.3%
All colors	3144	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
73	1875	xmlBuildURISafe	call site: 01875	xmlCatalogXMLResolve
61	2621	htmlIsBooleanAttr	call site: 02621	htmlAttrDumpOutput
51	1957	xmlInitializeCatalog	call site: 01957	xmlACatalogResolve
49	1580	xmlNewDtd	call site: 01580	xmlCopyEntitiesTable
40	825	xmlRMutexUnlock	call site: 00825	xmlParseXMLCatalogFile
35	2563	xmlOutputBufferWriteQuotedString	call site: 02563	htmlNodeDumpInternal
27	1784	xmlStrncat	call site: 01784	xmlParseXMLCatalogOneNode
26	788	xmlURIUnescapeString	call site: 00788	xmlCatalogLocalResolve
21	1754	xmlSplitQName4	call site: 01754	xmlParseXMLCatalogNodeList
18	1262	xmlParseAttValue	call site: 01262	xmlSkipBlankChars
18	1553	xmlCopyPropInternal	call site: 01553	xmlNewReconciledNs
16	1690	xmlNodeGetContent	call site: 01690	xmlBufGetNodeContent

Runtime coverage analysis

Covered functions

604

Functions that are reachable but not covered

164

Reachable functions

691

Percentage of reachable functions covered

76.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xml.c	1
fuzz/fuzz.c	13
hash.c	28
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	31
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	17
parserInternals.c	43
SAX2.c	6
parser.c	152
buf.c	25
tree.c	67
valid.c	40
list.c	3
xmlregexp.c	4
entities.c	10
HTMLparser.c	4
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
xmlsave.c	35
HTMLtree.c	8

Fuzzer: valid

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	868	27.2%
gold	[1:9]	98	3.07%
yellow	[10:29]	78	2.44%
greenyellow	[30:49]	34	1.06%
lawngreen	50+	2108	66.1%
All colors	3186	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	2605	xmlFACompareAtoms	call site: 02605	xmlFARecurseDeterminism
73	1874	xmlBuildURISafe	call site: 01874	xmlCatalogXMLResolve
51	1956	xmlInitializeCatalog	call site: 01956	xmlACatalogResolve
49	1579	xmlNewDtd	call site: 01579	xmlCopyEntitiesTable
40	824	xmlRMutexUnlock	call site: 00824	xmlParseXMLCatalogFile
36	2722	xmlRegStateAddTransTo	call site: 02722	xmlFAGenerateTransitions
33	1783	xmlStrncat	call site: 01783	xmlParseXMLCatalogOneNode
27	1753	xmlSplitQName4	call site: 01753	xmlParseXMLCatalogNodeList
26	787	xmlURIUnescapeString	call site: 00787	xmlCatalogLocalResolve
18	1552	xmlCopyPropInternal	call site: 01552	xmlNewReconciledNs
17	2877	xmlRegExecSetErrString	call site: 02877	xmlFARegExecSaveInputString
16	1689	xmlNodeGetContent	call site: 01689	xmlBufGetNodeContent

Runtime coverage analysis

Covered functions

649

Functions that are reachable but not covered

195

Reachable functions

762

Percentage of reachable functions covered

74.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/valid.c	1
fuzz/fuzz.c	13
hash.c	28
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	20
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	16
parserInternals.c	43
SAX2.c	6
parser.c	157
buf.c	19
tree.c	70
valid.c	78
list.c	8
xmlregexp.c	58
entities.c	10
HTMLparser.c	3
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
./codegen/unicode.inc	35

Fuzzer: xinclude

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	786	21.2%
gold	[1:9]	235	6.34%
yellow	[10:29]	56	1.51%
greenyellow	[30:49]	27	0.72%
lawngreen	50+	2602	70.2%
All colors	3706	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
68	1877	xmlNodeGetBaseSafe	call site: 01877	xmlCatalogXMLResolve
51	1954	xmlInitializeCatalog	call site: 01954	xmlACatalogResolve
40	822	xmlRMutexUnlock	call site: 00822	xmlParseXMLCatalogFile
26	785	xmlURIUnescapeString	call site: 00785	xmlCatalogLocalResolve
18	1259	xmlParseAttValue	call site: 01259	xmlSkipBlankChars
17	1755	xmlGetPropNodeValueInternal	call site: 01755	xmlParseXMLCatalogNodeList
17	1791	xmlGetNsListSafe	call site: 01791	xmlParseXMLCatalogOneNode
14	1244	xmlParseStartTag2	call site: 01244	xmlParseStartTag
14	1360	xmlParseElementEnd	call site: 01360	xmlParseEndTag1
14	1554	xmlSearchNsByHrefSafe	call site: 01554	xmlSearchNsSafe
14	1736	xmlFinishDocument	call site: 01736	xmlFreeDoc
12	626	xmlParsePI	call site: 00626	xmlParseCatalogPI

Runtime coverage analysis

Covered functions

811

Functions that are reachable but not covered

128

Reachable functions

820

Percentage of reachable functions covered

84.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xinclude.c	1
fuzz/fuzz.c	12
hash.c	29
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	16
xpath.c	139
xmlIO.c	18
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	18
parserInternals.c	42
SAX2.c	6
parser.c	143
buf.c	19
tree.c	83
valid.c	41
list.c	3
xmlregexp.c	4
entities.c	11
HTMLparser.c	2
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	39
xinclude.c	27
xpointer.c	8
./timsort.h	12

Fuzzer: schema

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1581	25.7%
gold	[1:9]	431	7.01%
yellow	[10:29]	183	2.98%
greenyellow	[30:49]	103	1.67%
lawngreen	50+	3842	62.5%
All colors	6140	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
66	2351	xmlCopyPropInternal	call site: 02351	xmlCopyDtd
65	2588	xmlBuildURI	call site: 02588	xmlCatalogXMLResolve
52	2662	xmlInitializeCatalog	call site: 02662	xmlACatalogResolve
40	5499	xmlSchemaBuildContentModelForElement	call site: 05499	xmlSchemaBuildAContentModel
33	2187	xmlNewDocNode	call site: 02187	xmlNodeParseAttValue
32	2044	xmlParseStartTag2	call site: 02044	xmlParseStartTag
26	6018	xmlSchemaValidatorPopElem	call site: 06018	xmlAddChild
23	5861	xmlSchemaVAttributesComplex	call site: 05861	xmlNewProp
19	4755	xmlSchemaGetCanonValue	call site: 04755	xmlSchemaDateNormalize
18	2332	xmlCopyPropInternal	call site: 02332	xmlNewReconciledNs
18	5664	xmlSchemaVDocWalk	call site: 05664	xmlSchemaAssembleByXSI
17	2527	xmlGetPropNodeValueInternal	call site: 02527	xmlParseXMLCatalogNodeList

Runtime coverage analysis

Covered functions

1066

Functions that are reachable but not covered

192

Reachable functions

1200

Percentage of reachable functions covered

84.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/schema.c	1
fuzz/fuzz.c	11
hash.c	29
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	19
catalog.c	33
xmlschemastypes.c	71
relaxng.c	1
xmlstring.c	20
xmlschemas.c	335
parserInternals.c	43
buf.c	19
xmlregexp.c	89
tree.c	85
SAX2.c	6
parser.c	144
valid.c	45
list.c	7
entities.c	10
HTMLparser.c	2
uri.c	36
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
pattern.c	29
xmlreader.c	3
./codegen/unicode.inc	35

Fuzzer: api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	858	16.6%
gold	[1:9]	175	3.38%
yellow	[10:29]	46	0.89%
greenyellow	[30:49]	9	0.17%
lawngreen	50+	4079	78.9%
All colors	5167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	3803	xmlFACompareAtoms	call site: 03803	xmlFARecurseDeterminism
68	1888	xmlNodeGetBaseSafe	call site: 01888	xmlCatalogXMLResolve
52	1965	xmlInitializeCatalog	call site: 01965	xmlACatalogResolve
36	3920	xmlRegStateAddTransTo	call site: 03920	xmlFAGenerateTransitions
32	2204	xmlExpandPEsInEntityValue	call site: 02204	xmlLoadEntityContent
26	782	xmlURIUnescapeString	call site: 00782	xmlCatalogLocalResolve
23	2023	xmlParsePERefInternal	call site: 02023	xmlSkipBlankCharsPE
20	1436	xmlCtxtParseContentInternal	call site: 01436	xmlParseTextDecl
17	4075	xmlRegExecSetErrString	call site: 04075	xmlFARegExecSaveInputString
15	1767	xmlGetPropNodeValueInternal	call site: 01767	xmlParseXMLCatalogNodeList
12	630	xmlParsePI	call site: 00630	xmlParseCatalogPI
10	819	xmlRMutexUnlock	call site: 00819	xmlParseXMLCatalogFile

Runtime coverage analysis

Covered functions

926

Functions that are reachable but not covered

148

Reachable functions

1001

Percentage of reachable functions covered

85.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/api.c	35
fuzz/fuzz.c	11
hash.c	30
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	29
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
tree.c	155
valid.c	101
list.c	12
xmlregexp.c	58
entities.c	20
parser.c	146
parserInternals.c	38
SAX2.c	6
buf.c	26
HTMLparser.c	7
xmlstring.c	18
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	36
HTMLtree.c	20
./codegen/unicode.inc	35
xmlsave.c	49

Fuzzer: reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1850	32.7%
gold	[1:9]	282	4.98%
yellow	[10:29]	105	1.85%
greenyellow	[30:49]	48	0.84%
lawngreen	50+	3370	59.5%
All colors	5655	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
277	4507	xmlNodeListGetStringInternal	call site: 04507	xmlTextReaderExpand
150	502	xmlCtxtErrIO	call site: 00502	xmlFreeTextReader
86	4201	xmlFACompareAtoms	call site: 04201	xmlFARecurseDeterminism
68	2656	xmlNodeGetBaseSafe	call site: 02656	xmlCatalogXMLResolve
64	2423	xmlCopyPropInternal	call site: 02423	xmlCopyDtd
62	4968	htmlIsBooleanAttr	call site: 04968	xmlSaveSwitchEncoding
59	2831	xmlTextReaderValidatePop	call site: 02831	xmlRelaxNGValidatePopElement
51	2733	xmlInitializeCatalog	call site: 02733	xmlACatalogResolve
36	4318	xmlRegStateAddTransTo	call site: 04318	xmlFAGenerateTransitions
34	4911	xmlOutputBufferWriteQuotedString	call site: 04911	htmlNodeDumpInternal
33	1459	xmlCtxtResolveFromCatalog	call site: 01459	xmlResolveFromCatalog
33	1511	xmlNewParserCtxt	call site: 01511	xmlParserInputBufferCreateFilename

Runtime coverage analysis

Covered functions

1008

Functions that are reachable but not covered

338

Reachable functions

1195

Percentage of reachable functions covered

71.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/reader.c	2
fuzz/fuzz.c	11
hash.c	29
threads.c	9
dict.c	22
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	139
xmlIO.c	30
catalog.c	33
xmlschemastypes.c	2
relaxng.c	58
xmlstring.c	19
xmlreader.c	85
buf.c	20
SAX2.c	6
parser.c	151
parserInternals.c	43
./include/private/memory.h	1
tree.c	89
valid.c	51
list.c	3
xmlregexp.c	59
entities.c	11
uri.c	39
xinclude.c	29
pattern.c	8
HTMLparser.c	4
xmlschemas.c	43
./include/private/parser.h	2
chvalid.c	1
xpointer.c	8
./timsort.h	12
./codegen/unicode.inc	35
xmlsave.c	31
HTMLtree.c	8

Fuzzer: xpath

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1150	34.4%
gold	[1:9]	167	5.0%
yellow	[10:29]	41	1.22%
greenyellow	[30:49]	27	0.80%
lawngreen	50+	1955	58.5%
All colors	3340	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
131	1791	xmlBuildURISafe	call site: 01791	xmlCatalogXMLResolve
54	1931	xmlInitializeCatalog	call site: 01931	xmlACatalogResolve
45	1557	xmlHashUpdateInternal	call site: 01557	xmlCopyEntity
39	689	xmlHashFindEntry	call site: 00689	xmlParseXMLCatalogFile
36	1513	xmlNewNs	call site: 01513	xmlStaticCopyNodeList
32	2170	xmlExpandPEsInEntityValue	call site: 02170	xmlLoadEntityContent
26	644	xmlURIUnescapeString	call site: 00644	xmlCatalogLocalResolve
25	1629	xmlNewDoc	call site: 01629	xmlCopyDtd
22	1400	nodePush	call site: 01400	xmlParseTextDecl
21	1991	xmlSkipBlankCharsPE	call site: 01991	xmlSkipBlankCharsPE
18	1127	xmlParseAttValue	call site: 01127	xmlSkipBlankChars
18	1732	xmlGetPropNodeValueInternal	call site: 01732	xmlParseXMLCatalogNodeList

Runtime coverage analysis

Covered functions

688

Functions that are reachable but not covered

185

Reachable functions

757

Percentage of reachable functions covered

75.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xpath.c	1
fuzz/fuzz.c	7
hash.c	27
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	140
xmlIO.c	17
catalog.c	33
xmlschemastypes.c	1
relaxng.c	1
parser.c	141
parserInternals.c	40
SAX2.c	6
buf.c	19
HTMLparser.c	2
xmlstring.c	16
tree.c	65
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
entities.c	10
valid.c	41
list.c	3
xmlregexp.c	4
xpointer.c	8
./timsort.h	12

Fuzzer: lint

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9949	85.5%
gold	[1:9]	28	0.24%
yellow	[10:29]	71	0.61%
greenyellow	[30:49]	34	0.29%
lawngreen	50+	1551	13.3%
All colors	11633	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1136	5838	xmlPatternCompileSafe	call site: 05838	xmlSchemaParseRedefine
1021	3059	xmlSearchNs	call site: 03059	xmlRelaxReadFile
719	9153	xmllintMain	call site: 09153	xmlSchemaValidateStream
660	5092	xmlFreePatternInternal	call site: 05092	xmlSchemaParseNewDocWithContext
622	4363	xmlNodeSetContentInternal	call site: 04363	xmlRelaxNGCleanupTree
524	1806	xmlFreeDoc	call site: 01806	xmlSkipBlankCharsPE
470	8534	xmlOpenCharEncodingHandler	call site: 08534	xmlXIncludeLoadFallback
334	9998	xmlValidateDocumentInternal	call site: 09998	xmllintShellRNGValidate
238	2820	xmlNodeGetAttrValue	call site: 02820	xmlRelaxNGParse
229	10905	xmlNodeDumpOutput	call site: 10905	xmllintShellSetContent
228	4133	xmlNewInputFromMemory	call site: 04133	xmlRelaxNGCleanupDoc
209	1434	xmlLoadResource	call site: 01434	xmlSkipBlankCharsPE

Runtime coverage analysis

Covered functions

562

Functions that are reachable but not covered

1500

Reachable functions

2004

Percentage of reachable functions covered

25.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/lint.c	2
xmlmemory.c	8
fuzz/fuzz.c	10
hash.c	30
threads.c	13
dict.c	24
error.c	18
globals.c	25
encoding.c	22
xpath.c	147
xmlIO.c	38
catalog.c	47
xmlschemastypes.c	72
relaxng.c	140
xmlstring.c	20
fuzz/../xmllint.c	30
parser.c	166
parserInternals.c	53
chvalid.c	1
./include/private/memory.h	1
uri.c	40
SAX2.c	7
buf.c	20
tree.c	109
./include/private/parser.h	2
valid.c	90
xmlregexp.c	92
entities.c	11
list.c	12
xmlschemas.c	343
xmlreader.c	48
./codegen/unicode.inc	35
pattern.c	32
HTMLparser.c	62
xinclude.c	29
xpointer.c	8
./timsort.h	12
HTMLtree.c	17
fuzz/../shell.c	21
xmlsave.c	45
c14n.c	39

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
xmlSAX2StartElement	/src/libxml2/SAX2.c	3	['N/A', 'N/A', 'N/A']	22	0	77	15	7	284	0	2942	244
xmlSAX2StartElementNs	/src/libxml2/SAX2.c	9	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A', 'int', 'int', 'N/A']	18	0	982	148	59	254	0	2316	157
xmlXPathSubstringFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	485	88	34	145	0	925	80
xmlCatalogDump	/src/libxml2/catalog.c	1	['N/A']	25	0	37	9	4	304	0	2837	71
xmlCatalogAdd	/src/libxml2/catalog.c	3	['N/A', 'N/A', 'N/A']	40	0	73	12	5	576	0	7121	59
xmlXPathTranslateFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	435	72	28	137	0	856	48
xmlParseEntity	/src/libxml2/parser.c	1	['N/A']	37	0	15	3	2	580	0	7116	40

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2204 / 2792

Cyclomatic complexity statically reachable by fuzzers

29064 / 32201

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzz/uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlInitRandom', 'xmlURIEscape', 'xmlFuzzDataCleanup', 'LLVMFuzzerTestOneInput', 'xmlSaveUri', 'xmlInitGlobalsInternal', 'xmlGetThreadLocalStorage']

fuzz/regexp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlVRaiseError', 'xmlRegEpxFromParse', 'xmlInitRandom', 'xmlFAGenerateTransitions', 'xmlFuzzDataCleanup', 'xmlRegNewRange', '__xmlStructuredError', 'xmlVSetError', 'xmlRegFreeAtom']

fuzz/html.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlHashUpdateInternal', 'xmlNewDocProp', 'xmlAllocOutputBuffer', 'xmlUnlinkNode', 'xmlNewText', 'xmlNodeGetContent', 'xmlVRaiseError', 'xmlCopyPropInternal', 'htmlNodeDumpInternal']

fuzz/xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'htmlIsBooleanAttr', 'xmlInitializeCatalog', 'xmlNewDtd', 'xmlRMutexUnlock', 'xmlOutputBufferWriteQuotedString', 'xmlStrncat', 'xmlURIUnescapeString', 'xmlSplitQName4', 'xmlParseAttValue']

fuzz/valid.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlBuildURISafe', 'xmlInitializeCatalog', 'xmlNewDtd', 'xmlRMutexUnlock', 'xmlRegStateAddTransTo', 'xmlStrncat', 'xmlSplitQName4', 'xmlURIUnescapeString', 'xmlCopyPropInternal']

fuzz/xinclude.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlRMutexUnlock', 'xmlURIUnescapeString', 'xmlParseAttValue', 'xmlGetPropNodeValueInternal', 'xmlGetNsListSafe', 'xmlParseStartTag2', 'xmlParseElementEnd', 'xmlSearchNsByHrefSafe']

fuzz/schema.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlCopyPropInternal', 'xmlBuildURI', 'xmlInitializeCatalog', 'xmlSchemaBuildContentModelForElement', 'xmlNewDocNode', 'xmlParseStartTag2', 'xmlSchemaValidatorPopElem', 'xmlSchemaVAttributesComplex', 'xmlSchemaGetCanonValue']

fuzz/api.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlRegStateAddTransTo', 'xmlExpandPEsInEntityValue', 'xmlURIUnescapeString', 'xmlParsePERefInternal', 'xmlCtxtParseContentInternal', 'xmlRegExecSetErrString', 'xmlGetPropNodeValueInternal']

fuzz/reader.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlNodeListGetStringInternal', 'xmlCtxtErrIO', 'xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'xmlCopyPropInternal', 'htmlIsBooleanAttr', 'xmlTextReaderValidatePop', 'xmlInitializeCatalog', 'xmlRegStateAddTransTo', 'xmlOutputBufferWriteQuotedString']

fuzz/xpath.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'xmlInitializeCatalog', 'xmlHashUpdateInternal', 'xmlHashFindEntry', 'xmlNewNs', 'xmlExpandPEsInEntityValue', 'xmlURIUnescapeString', 'xmlNewDoc', 'nodePush', 'xmlSkipBlankCharsPE']

fuzz/lint.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlPatternCompileSafe', 'xmlSearchNs', 'xmllintMain', 'xmlFreePatternInternal', 'xmlNodeSetContentInternal', 'xmlFreeDoc', 'xmlOpenCharEncodingHandler', 'xmlValidateDocumentInternal', 'xmlNodeGetAttrValue', 'xmlNodeDumpOutput']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
xmlErrString	321	171	53.27%	['xinclude', 'html', 'api', 'xml', 'schema', 'lint', 'reader', 'xpath', 'valid']
xmlCtxtResolveFromCatalog	32	17	53.12%	['xinclude', 'api', 'xml', 'schema', 'lint', 'reader', 'xpath', 'valid']
xmlXPathCacheObjectCopy	31	17	54.83%	['reader', 'xinclude', 'lint', 'xpath']
xmlXPathRunEval	31	14	45.16%	['reader', 'xinclude', 'lint', 'xpath']
xmlIOErr	154	10	6.493%	['xinclude', 'api', 'xml', 'schema', 'lint', 'reader', 'xpath', 'valid']
xmlSchemaItemTypeToStr	44	24	54.54%	['schema', 'lint']
xmlSchemaAddAnnotation	83	12	14.45%	['schema', 'lint']
xmlSchemaCheckSRCRedefineFirst	104	7	6.730%	['schema', 'lint']
xmlSchemaCheckSTPropsCorrect	53	28	52.83%	['schema', 'lint']
xmlSchemaCheckCOSSTRestricts	300	138	46.0%	['schema', 'lint']
xmlSchemaCheckCOSSTDerivedOK	43	20	46.51%	['schema', 'lint']
xmlSchemaCheckCOSCTExtends	56	30	53.57%	['schema', 'lint']
xmlSchemaCheckDerivationOKRestriction	98	41	41.83%	['schema', 'lint']
xmlSchemaLookupNamespace	45	14	31.11%	['schema', 'lint']
xmlSchemaValidateElemDecl	87	40	45.97%	['schema', 'lint']
xmlSchemaGetBuiltInType	99	48	48.48%	['schema', 'lint']
xmlSchemaCopyValue	91	32	35.16%	['schema', 'lint']
xmlSchemaGetCanonValue	260	86	33.07%	['schema', 'lint']
xmlSchemaValidateFacetInternal	168	65	38.69%	['schema', 'lint']
xmlTextReaderSetStructuredErrorHandler	39	16	41.02%	['reader']
xmlTextReaderSetup	159	69	43.39%	['reader', 'lint']
xmlC14NProcessNode	122	24	19.67%	['lint']
xmlC14NCheckForRelativeNamespaces	31	7	22.58%	['lint']
xmlC14NProcessNamespacesAxis	47	22	46.80%	['lint']
xmlExcC14NProcessNamespacesAxis	108	32	29.62%	['lint']
xmlC14NProcessAttrsAxis	112	45	40.17%	['lint']
xmlC11NNormalizeString	85	27	31.76%	['lint']
xmlPatMatch	176	83	47.15%	['reader', 'lint']
xmlValidGetValidElements	64	26	40.62%	['lint']
xmllintResourceLoader	48	13	27.08%	['lint']
streamFile	163	34	20.85%	['lint']
testSAX	49	12	24.48%	['lint']
parseHtml	49	14	28.57%	['lint']
parseXml	59	25	42.37%	['lint']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libxml2/uri.c	['uri', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath']
/src/libxml2/valid.c	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/fuzz/uri.c	['uri']	['uri']
/src/libxml2/list.c	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/xinclude.c	['xinclude', 'reader', 'lint']	['xinclude', 'reader', 'lint']
/src/libxml2/parserInternals.c	['regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/HTMLtree.c	['html', 'xml', 'api', 'reader', 'lint']	['html', 'xml', 'api', 'reader']
/src/libxml2/parser.c	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/SAX2.c	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/chvalid.c	['regexp', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['regexp', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader']
/src/libxml2/fuzz/lint.c	['lint']	['lint']
/src/libxml2/dict.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/fuzz/api.c	['api']	['api']
/src/libxml2/tree.c	['regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/fuzz/schema.c	['schema']	['schema']
/src/libxml2/fuzz/../shell.c	['lint']	[]
/src/libxml2/./codegen/unicode.inc	['regexp', 'valid', 'schema', 'api', 'reader', 'lint']	[]
/src/libxml2/HTMLparser.c	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['html', 'xml', 'valid', 'xinclude', 'api', 'lint']
/src/libxml2/buf.c	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/fuzz/reader.c	['reader']	['reader']
/src/libxml2/c14n.c	['lint']	['lint']
/src/libxml2/fuzz/regexp.c	['regexp']	['regexp']
/src/libxml2/entities.c	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath']
/src/libxml2/globals.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/fuzz/xpath.c	['xpath']	['xpath']
/src/libxml2/threads.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/xmlschemastypes.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/./include/private/memory.h	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	[]
/src/libxml2/pattern.c	['schema', 'reader', 'lint']	['schema', 'lint']
/src/libxml2/xpointer.c	['xinclude', 'reader', 'xpath', 'lint']	['xinclude', 'reader', 'xpath']
/src/libxml2/fuzz/valid.c	['valid']	['valid']
/src/libxml2/hash.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/xmlreader.c	['schema', 'reader', 'lint']	['reader', 'lint']
/src/libxml2/xmlregexp.c	['regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['regexp', 'valid', 'schema', 'api', 'reader']
/src/libxml2/fuzz/html.c	['html']	['html']
/src/libxml2/fuzz/xml.c	['xml']	['xml']
/src/libxml2/xmlIO.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/relaxng.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/xmlstring.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/./include/private/parser.h	['html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	[]
/src/libxml2/xmlmemory.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/xpath.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/fuzz/../xmllint.c	['lint']	[]
/src/libxml2/error.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/catalog.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/./timsort.h	['xinclude', 'reader', 'xpath', 'lint']	[]
/src/libxml2/fuzz/xinclude.c	['xinclude']	['xinclude']
/src/libxml2/xmlsave.c	['html', 'xml', 'api', 'reader', 'lint']	['xml', 'api', 'reader', 'lint']
/src/libxml2/xmlschemas.c	['schema', 'reader', 'lint']	['schema']
/src/libxml2/fuzz/fuzz.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']
/src/libxml2/encoding.c	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']	['uri', 'regexp', 'html', 'xml', 'valid', 'xinclude', 'schema', 'api', 'reader', 'xpath', 'lint']

Directories in report

Directory
/src/libxml2/fuzz/
/src/libxml2/fuzz/../
/src/libxml2/./include/private/
/src/libxml2/
/src/libxml2/./
/src/libxml2/./codegen/