High level conclusions

Fuzzers reach 70.39% code coverage.

Fuzzers reach 88.06% of cyclomatic complexity.

Fuzzers reach 77.29% of all functions.

Fuzzer lint is blocked:

The runtime code coverage of lint covers 26.50% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

2162 / 2797

Cyclomatic complexity statically reachable by fuzzers

28388 / 32235

Runtime code coverage of functions

1969 / 2797

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: regexp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	23.0%
gold	[1:9]	49	11.4%
yellow	[10:29]	9	2.09%
greenyellow	[30:49]	2	0.46%
lawngreen	50+	270	62.9%
All colors	429	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	122	xmlVRaiseError	call site: 00122	xmlFormatError
10	401	xmlRegEpxFromParse	call site: 00401	xmlRegexpErrMemory
8	9	xmlInitRandom	call site: 00009	xmlAbort
7	100	xmlVRaiseError	call site: 00100	xmlGetLineNo
5	168	xmlFAGenerateTransitions	call site: 00168	xmlRegCopyAtom
5	421	xmlFuzzDataCleanup	call site: 00421	xmlDictFree
4	174	xmlRegNewRange	call site: 00174	xmlRegexpErrMemory
3	80	__xmlStructuredError	call site: 00080	__xmlStructuredError
3	118	xmlVSetError	call site: 00118	xmlCopyError
3	179	xmlRegFreeAtom	call site: 00179	xmlFAGenerateTransitions
3	233	xmlFAParseCharClassEsc	call site: 00233	xmlRegAtomAddRange
3	310	xmlFACompareAtoms	call site: 00310	xmlRegStrEqualWildcard

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

41

Reachable functions

182

Percentage of reachable functions covered

77.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/regexp.c	1
fuzz/fuzz.c	6
hash.c	4
threads.c	7
dict.c	6
error.c	13
xmlmemory.c	1
globals.c	12
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
xmlregexp.c	60
xmlstring.c	7
./include/private/memory.h	1
tree.c	2
parserInternals.c	1
chvalid.c	1
./codegen/unicode.inc	35

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	41	12.4%
gold	[1:9]	41	12.4%
yellow	[10:29]	11	3.33%
greenyellow	[30:49]	3	0.90%
lawngreen	50+	234	70.9%
All colors	330	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	9	xmlInitRandom	call site: 00009	xmlAbort
7	218	xmlURIEscape	call site: 00218	xmlURIEscapeStr
5	323	xmlFuzzDataCleanup	call site: 00323	xmlDictFree
4	134	LLVMFuzzerTestOneInput	call site: 00134	fprintf
4	197	xmlURIEscape	call site: 00197	xmlURIEscapeStr
2	150	xmlSaveUri	call site: 00150	xmlSaveUriRealloc
2	159	xmlSaveUri	call site: 00159	xmlSaveUriRealloc
1	27	xmlInitGlobalsInternal	call site: 00027	xmlResetError
1	45	xmlGetThreadLocalStorage	call site: 00045	pthread_getspecific
1	47	xmlGetThreadLocalStorage	call site: 00047	xmlAbort
1	60	xmlRandom	call site: 00060	xmlHashGrow
1	85	xmlParse3986Host	call site: 00085	xmlParse3986DecOctet

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

26

Reachable functions

117

Percentage of reachable functions covered

77.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/uri.c	1
fuzz/fuzz.c	7
hash.c	4
threads.c	7
dict.c	6
error.c	3
xmlmemory.c	1
globals.c	6
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
uri.c	43
xmlstring.c	12
./include/private/memory.h	1

Fuzzer: html

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	562	45.4%
gold	[1:9]	39	3.15%
yellow	[10:29]	8	0.64%
greenyellow	[30:49]	6	0.48%
lawngreen	50+	622	50.2%
All colors	1237	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	906	xmlHashUpdateInternal	call site: 00906	xmlCopyNode
40	1026	xmlNewDocProp	call site: 01026	xmlNewDocProp
26	694	xmlAllocOutputBuffer	call site: 00694	xmlCharEncOutput
24	166	xmlUnlinkNode	call site: 00166	xmlFreeEntitiesTable
19	981	xmlNewDocProp	call site: 00981	xmlNodeParseAttValue
18	1005	xmlNewText	call site: 01005	xmlNodeParseAttValue
16	1121	xmlNodeGetContent	call site: 01121	xmlBufGetNodeContent
15	320	xmlVRaiseError	call site: 00320	xmlRaiseMemoryError
15	1067	xmlCopyPropInternal	call site: 01067	xmlCopyDtd
14	761	htmlNodeDumpInternal	call site: 00761	htmlParseMetaEncoding
12	779	htmlNodeDumpInternal	call site: 00779	xmlNsListDumpOutput
11	137	xmlFreeDtd	call site: 00137	xmlFreeElementTable

Runtime coverage analysis

Covered functions

302

Functions that are reachable but not covered

142

Reachable functions

388

Percentage of reachable functions covered

63.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/html.c	1
fuzz/fuzz.c	7
hash.c	16
threads.c	7
dict.c	18
error.c	14
xmlmemory.c	1
globals.c	15
encoding.c	19
xpath.c	2
xmlIO.c	17
catalog.c	5
xmlschemastypes.c	1
relaxng.c	1
HTMLparser.c	56
SAX2.c	1
parserInternals.c	30
parser.c	8
buf.c	19
tree.c	50
valid.c	33
list.c	3
xmlregexp.c	4
entities.c	8
xmlstring.c	12
./include/private/memory.h	1
./include/private/parser.h	1
HTMLtree.c	9
xmlsave.c	3

Fuzzer: xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	964	30.4%
gold	[1:9]	124	3.92%
yellow	[10:29]	53	1.67%
greenyellow	[30:49]	35	1.10%
lawngreen	50+	1986	62.8%
All colors	3162	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
73	1890	xmlBuildURISafe	call site: 01890	xmlCatalogXMLResolve
70	810	xmlRMutexUnlock	call site: 00810	xmlCatalogListXMLResolve
61	2640	htmlIsBooleanAttr	call site: 02640	htmlAttrDumpOutput
55	1972	xmlInitializeCatalog	call site: 01972	xmlACatalogResolve
49	1595	xmlNewDtd	call site: 01595	xmlCopyEntitiesTable
35	2582	xmlOutputBufferWriteQuotedString	call site: 02582	htmlNodeDumpInternal
27	1799	xmlStrncat	call site: 01799	xmlParseXMLCatalogOneNode
21	1769	xmlSplitQName4	call site: 01769	xmlParseXMLCatalogNodeList
18	1277	xmlParseAttValue	call site: 01277	xmlSkipBlankChars
18	1568	xmlCopyPropInternal	call site: 01568	xmlNewReconciledNs
16	1705	xmlNodeGetContent	call site: 01705	xmlBufGetNodeContent
15	1645	xmlCreateEnumeration	call site: 01645	xmlCopyEntitiesTable

Runtime coverage analysis

Covered functions

604

Functions that are reachable but not covered

167

Reachable functions

694

Percentage of reachable functions covered

75.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xml.c	1
fuzz/fuzz.c	13
hash.c	29
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	31
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	17
parserInternals.c	43
SAX2.c	6
parser.c	152
buf.c	25
tree.c	67
valid.c	40
list.c	3
xmlregexp.c	4
entities.c	10
HTMLparser.c	4
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
xmlsave.c	35
HTMLtree.c	8

Fuzzer: xinclude

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	806	21.6%
gold	[1:9]	233	6.25%
yellow	[10:29]	55	1.47%
greenyellow	[30:49]	34	0.91%
lawngreen	50+	2597	69.7%
All colors	3725	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
70	807	xmlRMutexUnlock	call site: 00807	xmlCatalogListXMLResolve
68	1892	xmlNodeGetBaseSafe	call site: 01892	xmlCatalogXMLResolve
55	1969	xmlInitializeCatalog	call site: 01969	xmlACatalogResolve
18	1274	xmlParseAttValue	call site: 01274	xmlSkipBlankChars
17	1770	xmlGetPropNodeValueInternal	call site: 01770	xmlParseXMLCatalogNodeList
17	1806	xmlGetNsListSafe	call site: 01806	xmlParseXMLCatalogOneNode
14	1259	xmlParseStartTag2	call site: 01259	xmlParseStartTag
14	1375	xmlParseElementEnd	call site: 01375	xmlParseEndTag1
14	1569	xmlSearchNsByHrefSafe	call site: 01569	xmlSearchNsSafe
14	1751	xmlFinishDocument	call site: 01751	xmlFreeDoc
13	626	xmlParsePI	call site: 00626	xmlParseCatalogPI
11	3663	xmlXIncludeLoadTxt	call site: 03663	xmlAddChild

Runtime coverage analysis

Covered functions

812

Functions that are reachable but not covered

131

Reachable functions

823

Percentage of reachable functions covered

84.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xinclude.c	1
fuzz/fuzz.c	12
hash.c	30
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	16
xpath.c	139
xmlIO.c	18
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	18
parserInternals.c	42
SAX2.c	6
parser.c	143
buf.c	19
tree.c	83
valid.c	41
list.c	3
xmlregexp.c	4
entities.c	11
HTMLparser.c	2
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	39
xinclude.c	27
xpointer.c	8
./timsort.h	12

Fuzzer: xpath

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1169	34.8%
gold	[1:9]	168	5.00%
yellow	[10:29]	43	1.28%
greenyellow	[30:49]	24	0.71%
lawngreen	50+	1955	58.2%
All colors	3359	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
131	1806	xmlBuildURISafe	call site: 01806	xmlCatalogXMLResolve
80	1537	xmlNewNs	call site: 01537	xmlStaticCopyNodeList
58	1946	xmlInitializeCatalog	call site: 01946	xmlACatalogResolve
39	714	xmlHashLookup	call site: 00714	xmlParseXMLCatalogFile
32	2189	xmlExpandPEsInEntityValue	call site: 02189	xmlLoadEntityContent
25	1644	xmlNewDoc	call site: 01644	xmlCopyDtd
22	666	xmlRMutexUnlock	call site: 00666	xmlCatalogListXMLResolve
22	1424	nodePush	call site: 01424	xmlParseTextDecl
21	2010	xmlSkipBlankCharsPE	call site: 02010	xmlSkipBlankCharsPE
18	1152	xmlParseAttValue	call site: 01152	xmlSkipBlankChars
18	1747	xmlGetPropNodeValueInternal	call site: 01747	xmlParseXMLCatalogNodeList
17	1507	xmlParseReference	call site: 01507	xmlDocCopyNode

Runtime coverage analysis

Covered functions

688

Functions that are reachable but not covered

188

Reachable functions

760

Percentage of reachable functions covered

75.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xpath.c	1
fuzz/fuzz.c	7
hash.c	28
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	140
xmlIO.c	17
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
parser.c	141
parserInternals.c	40
SAX2.c	6
buf.c	19
HTMLparser.c	2
xmlstring.c	16
tree.c	65
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
entities.c	10
valid.c	41
list.c	3
xmlregexp.c	4
xpointer.c	8
./timsort.h	12

Fuzzer: valid

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	887	27.6%
gold	[1:9]	99	3.08%
yellow	[10:29]	84	2.62%
greenyellow	[30:49]	27	0.84%
lawngreen	50+	2108	65.7%
All colors	3205	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	2624	xmlFACompareAtoms	call site: 02624	xmlFARecurseDeterminism
73	1889	xmlBuildURISafe	call site: 01889	xmlCatalogXMLResolve
70	809	xmlRMutexUnlock	call site: 00809	xmlCatalogListXMLResolve
55	1971	xmlInitializeCatalog	call site: 01971	xmlACatalogResolve
49	1594	xmlNewDtd	call site: 01594	xmlCopyEntitiesTable
36	2741	xmlRegStateAddTransTo	call site: 02741	xmlFAGenerateTransitions
33	1798	xmlStrncat	call site: 01798	xmlParseXMLCatalogOneNode
27	1768	xmlSplitQName4	call site: 01768	xmlParseXMLCatalogNodeList
18	1567	xmlCopyPropInternal	call site: 01567	xmlNewReconciledNs
17	2896	xmlRegExecSetErrString	call site: 02896	xmlFARegExecSaveInputString
16	1704	xmlNodeGetContent	call site: 01704	xmlBufGetNodeContent
14	1515	xmlCtxtParseEntity	call site: 01515	xmlSetTreeDoc

Runtime coverage analysis

Covered functions

649

Functions that are reachable but not covered

198

Reachable functions

765

Percentage of reachable functions covered

74.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/valid.c	1
fuzz/fuzz.c	13
hash.c	29
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	20
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	16
parserInternals.c	43
SAX2.c	6
parser.c	157
buf.c	19
tree.c	70
valid.c	78
list.c	8
xmlregexp.c	58
entities.c	10
HTMLparser.c	3
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
./codegen/unicode.inc	35

Fuzzer: api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	872	16.8%
gold	[1:9]	179	3.45%
yellow	[10:29]	42	0.80%
greenyellow	[30:49]	7	0.13%
lawngreen	50+	4086	78.7%
All colors	5186	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	3823	xmlFACompareAtoms	call site: 03823	xmlFARecurseDeterminism
68	1903	xmlNodeGetBaseSafe	call site: 01903	xmlCatalogXMLResolve
56	1980	xmlInitializeCatalog	call site: 01980	xmlACatalogResolve
36	3940	xmlRegStateAddTransTo	call site: 03940	xmlFAGenerateTransitions
32	2223	xmlExpandPEsInEntityValue	call site: 02223	xmlLoadEntityContent
23	2042	xmlParsePERefInternal	call site: 02042	xmlSkipBlankCharsPE
22	804	xmlRMutexUnlock	call site: 00804	xmlCatalogListXMLResolve
20	1460	xmlCtxtParseContentInternal	call site: 01460	xmlParseTextDecl
19	834	xmlHashUpdateInternal	call site: 00834	xmlFetchXMLCatalogFile
17	4095	xmlRegExecSetErrString	call site: 04095	xmlFARegExecSaveInputString
15	1782	xmlGetPropNodeValueInternal	call site: 01782	xmlParseXMLCatalogNodeList
13	630	xmlParsePI	call site: 00630	xmlParseCatalogPI

Runtime coverage analysis

Covered functions

926

Functions that are reachable but not covered

151

Reachable functions

1004

Percentage of reachable functions covered

84.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/api.c	35
fuzz/fuzz.c	11
hash.c	31
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	29
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
tree.c	155
valid.c	101
list.c	12
xmlregexp.c	58
entities.c	20
parser.c	146
parserInternals.c	38
SAX2.c	6
buf.c	26
HTMLparser.c	7
xmlstring.c	18
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	36
HTMLtree.c	20
./codegen/unicode.inc	35
xmlsave.c	49

Fuzzer: lint

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9914	84.9%
gold	[1:9]	100	0.85%
yellow	[10:29]	70	0.59%
greenyellow	[30:49]	37	0.31%
lawngreen	50+	1546	13.2%
All colors	11667	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1139	5867	xmlPatternCompileSafe	call site: 05867	xmlSchemaParseRedefine
1031	3081	xmlSearchNs	call site: 03081	xmlRelaxReadFile
660	5121	xmlFreePatternInternal	call site: 05121	xmlSchemaParseNewDocWithContext
622	4392	xmlNodeSetContentInternal	call site: 04392	xmlRelaxNGCleanupTree
524	1825	xmlFreeDoc	call site: 01825	xmlSkipBlankCharsPE
474	9186	xmllintMain	call site: 09186	xmlSchemaValidateStream
471	8566	xmlOpenCharEncodingHandler	call site: 08566	xmlXIncludeLoadFallback
335	10033	xmlValidateDocumentInternal	call site: 10033	xmllintShellRNGValidate
229	4161	xmlNewInputFromMemory	call site: 04161	xmlRelaxNGCleanupDoc
229	10939	xmlNodeDumpOutput	call site: 10939	xmllintShellSetContent
209	1453	xmlLoadResource	call site: 01453	xmlSkipBlankCharsPE
196	2884	xmllintResourceLoader	call site: 02884	xmlRelaxNGParse

Runtime coverage analysis

Covered functions

603

Functions that are reachable but not covered

1475

Reachable functions

2007

Percentage of reachable functions covered

26.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/lint.c	2
xmlmemory.c	8
fuzz/fuzz.c	10
hash.c	31
threads.c	13
dict.c	24
error.c	18
globals.c	25
encoding.c	22
xpath.c	147
xmlIO.c	38
catalog.c	49
xmlschemastypes.c	72
relaxng.c	140
xmlstring.c	20
fuzz/../xmllint.c	30
parser.c	166
parserInternals.c	53
chvalid.c	1
./include/private/memory.h	1
uri.c	40
SAX2.c	7
buf.c	20
tree.c	109
./include/private/parser.h	2
valid.c	90
xmlregexp.c	92
entities.c	11
list.c	12
xmlschemas.c	343
xmlreader.c	48
./codegen/unicode.inc	35
pattern.c	32
HTMLparser.c	62
xinclude.c	29
xpointer.c	8
./timsort.h	12
HTMLtree.c	17
fuzz/../shell.c	21
xmlsave.c	45
c14n.c	39

Fuzzer: schema

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1591	25.8%
gold	[1:9]	419	6.80%
yellow	[10:29]	197	3.19%
greenyellow	[30:49]	91	1.47%
lawngreen	50+	3861	62.6%
All colors	6159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
66	2366	xmlCopyPropInternal	call site: 02366	xmlCopyDtd
65	2603	xmlBuildURI	call site: 02603	xmlCatalogXMLResolve
56	2677	xmlInitializeCatalog	call site: 02677	xmlACatalogResolve
40	5518	xmlSchemaBuildContentModelForElement	call site: 05518	xmlSchemaBuildAContentModel
38	686	xmlStrncmp	call site: 00686	xmlCatalogListXMLResolve
33	2202	xmlNewDocNode	call site: 02202	xmlNodeParseAttValue
32	2059	xmlParseStartTag2	call site: 02059	xmlParseStartTag
26	6037	xmlSchemaValidatorPopElem	call site: 06037	xmlAddChild
23	5880	xmlSchemaVAttributesComplex	call site: 05880	xmlNewProp
19	4774	xmlSchemaGetCanonValue	call site: 04774	xmlSchemaDateNormalize
18	2347	xmlCopyPropInternal	call site: 02347	xmlNewReconciledNs
18	5683	xmlSchemaVDocWalk	call site: 05683	xmlSchemaAssembleByXSI

Runtime coverage analysis

Covered functions

1069

Functions that are reachable but not covered

192

Reachable functions

1203

Percentage of reachable functions covered

84.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/schema.c	1
fuzz/fuzz.c	11
hash.c	30
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	19
catalog.c	35
xmlschemastypes.c	71
relaxng.c	1
xmlstring.c	20
xmlschemas.c	335
parserInternals.c	43
buf.c	19
xmlregexp.c	89
tree.c	85
SAX2.c	6
parser.c	144
valid.c	45
list.c	7
entities.c	10
HTMLparser.c	2
uri.c	36
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
pattern.c	29
xmlreader.c	3
./codegen/unicode.inc	35

Fuzzer: reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1871	32.9%
gold	[1:9]	288	5.07%
yellow	[10:29]	109	1.92%
greenyellow	[30:49]	61	1.07%
lawngreen	50+	3343	58.9%
All colors	5672	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
277	4526	xmlNodeListGetStringInternal	call site: 04526	xmlTextReaderExpand
150	502	xmlCtxtErrIO	call site: 00502	xmlFreeTextReader
86	4220	xmlFACompareAtoms	call site: 04220	xmlFARecurseDeterminism
68	2671	xmlNodeGetBaseSafe	call site: 02671	xmlCatalogXMLResolve
64	2438	xmlCopyPropInternal	call site: 02438	xmlCopyDtd
62	4987	htmlIsBooleanAttr	call site: 04987	xmlSaveSwitchEncoding
59	2850	xmlTextReaderValidatePop	call site: 02850	xmlRelaxNGValidatePopElement
55	2748	xmlInitializeCatalog	call site: 02748	xmlACatalogResolve
37	1488	xmlRMutexUnlock	call site: 01488	xmlCatalogListXMLResolve
36	4337	xmlRegStateAddTransTo	call site: 04337	xmlFAGenerateTransitions
34	4930	xmlOutputBufferWriteQuotedString	call site: 04930	htmlNodeDumpInternal
33	1526	xmlNewParserCtxt	call site: 01526	xmlParserInputBufferCreateFilename

Runtime coverage analysis

Covered functions

1012

Functions that are reachable but not covered

340

Reachable functions

1198

Percentage of reachable functions covered

71.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/reader.c	2
fuzz/fuzz.c	11
hash.c	30
threads.c	9
dict.c	22
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	139
xmlIO.c	30
catalog.c	35
xmlschemastypes.c	2
relaxng.c	58
xmlstring.c	19
xmlreader.c	85
buf.c	20
SAX2.c	6
parser.c	151
parserInternals.c	43
./include/private/memory.h	1
tree.c	89
valid.c	51
list.c	3
xmlregexp.c	59
entities.c	11
uri.c	39
xinclude.c	29
pattern.c	8
HTMLparser.c	4
xmlschemas.c	43
./include/private/parser.h	2
chvalid.c	1
xpointer.c	8
./timsort.h	12
./codegen/unicode.inc	35
xmlsave.c	31
HTMLtree.c	8

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
xmlSAX2StartElement	/src/libxml2/SAX2.c	3	['N/A', 'N/A', 'N/A']	22	0	77	15	7	284	0	2942	244
xmlSAX2StartElementNs	/src/libxml2/SAX2.c	9	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A', 'int', 'int', 'N/A']	18	0	982	148	59	254	0	2316	157
xmlXPathSubstringFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	485	88	34	145	0	925	80
xmlCatalogDump	/src/libxml2/catalog.c	1	['N/A']	26	0	37	9	4	305	0	2840	74
xmlCatalogAdd	/src/libxml2/catalog.c	3	['N/A', 'N/A', 'N/A']	40	0	73	12	5	579	0	7135	59
xmlXPathTranslateFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	435	72	28	137	0	856	48
xmlParseEntity	/src/libxml2/parser.c	1	['N/A']	37	0	15	3	2	583	0	7130	40

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2208 / 2797

Cyclomatic complexity statically reachable by fuzzers

29090 / 32235

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzz/regexp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlVRaiseError', 'xmlRegEpxFromParse', 'xmlInitRandom', 'xmlFAGenerateTransitions', 'xmlFuzzDataCleanup', 'xmlRegNewRange', '__xmlStructuredError', 'xmlVSetError', 'xmlRegFreeAtom']

fuzz/uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlInitRandom', 'xmlURIEscape', 'xmlFuzzDataCleanup', 'LLVMFuzzerTestOneInput', 'xmlSaveUri', 'xmlInitGlobalsInternal', 'xmlGetThreadLocalStorage']

fuzz/html.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlHashUpdateInternal', 'xmlNewDocProp', 'xmlAllocOutputBuffer', 'xmlUnlinkNode', 'xmlNewText', 'xmlNodeGetContent', 'xmlVRaiseError', 'xmlCopyPropInternal', 'htmlNodeDumpInternal']

fuzz/xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'xmlRMutexUnlock', 'htmlIsBooleanAttr', 'xmlInitializeCatalog', 'xmlNewDtd', 'xmlOutputBufferWriteQuotedString', 'xmlStrncat', 'xmlSplitQName4', 'xmlParseAttValue', 'xmlCopyPropInternal']

fuzz/xinclude.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlRMutexUnlock', 'xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlParseAttValue', 'xmlGetPropNodeValueInternal', 'xmlGetNsListSafe', 'xmlParseStartTag2', 'xmlParseElementEnd', 'xmlSearchNsByHrefSafe', 'xmlFinishDocument']

fuzz/xpath.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'xmlNewNs', 'xmlInitializeCatalog', 'xmlHashLookup', 'xmlExpandPEsInEntityValue', 'xmlNewDoc', 'xmlRMutexUnlock', 'nodePush', 'xmlSkipBlankCharsPE', 'xmlParseAttValue']

fuzz/valid.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlBuildURISafe', 'xmlRMutexUnlock', 'xmlInitializeCatalog', 'xmlNewDtd', 'xmlRegStateAddTransTo', 'xmlStrncat', 'xmlSplitQName4', 'xmlCopyPropInternal', 'xmlRegExecSetErrString']

fuzz/api.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlRegStateAddTransTo', 'xmlExpandPEsInEntityValue', 'xmlParsePERefInternal', 'xmlRMutexUnlock', 'xmlCtxtParseContentInternal', 'xmlHashUpdateInternal', 'xmlRegExecSetErrString']

fuzz/lint.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlPatternCompileSafe', 'xmlSearchNs', 'xmlFreePatternInternal', 'xmlNodeSetContentInternal', 'xmlFreeDoc', 'xmllintMain', 'xmlOpenCharEncodingHandler', 'xmlValidateDocumentInternal', 'xmlNewInputFromMemory', 'xmlNodeDumpOutput']

fuzz/schema.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlCopyPropInternal', 'xmlBuildURI', 'xmlInitializeCatalog', 'xmlSchemaBuildContentModelForElement', 'xmlStrncmp', 'xmlNewDocNode', 'xmlParseStartTag2', 'xmlSchemaValidatorPopElem', 'xmlSchemaVAttributesComplex', 'xmlSchemaGetCanonValue']

fuzz/reader.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlNodeListGetStringInternal', 'xmlCtxtErrIO', 'xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'xmlCopyPropInternal', 'htmlIsBooleanAttr', 'xmlTextReaderValidatePop', 'xmlInitializeCatalog', 'xmlRMutexUnlock', 'xmlRegStateAddTransTo']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
xmlErrString	321	171	53.27%	['reader', 'html', 'lint', 'xinclude', 'schema', 'api', 'xml', 'xpath', 'valid']
xmlCtxtResolveFromCatalog	32	17	53.12%	['reader', 'lint', 'xinclude', 'schema', 'api', 'xml', 'xpath', 'valid']
xmlXPathCacheObjectCopy	31	17	54.83%	['reader', 'xinclude', 'xpath', 'lint']
xmlXPathRunEval	31	14	45.16%	['reader', 'xinclude', 'xpath', 'lint']
xmlIOErr	154	10	6.493%	['reader', 'lint', 'xinclude', 'schema', 'api', 'xml', 'xpath', 'valid']
xmlC14NProcessNode	122	33	27.04%	['lint']
xmlC14NCheckForRelativeNamespaces	31	7	22.58%	['lint']
xmlC14NProcessNamespacesAxis	47	22	46.80%	['lint']
xmlExcC14NProcessNamespacesAxis	108	32	29.62%	['lint']
xmlC14NProcessAttrsAxis	112	45	40.17%	['lint']
xmlC11NNormalizeString	85	27	31.76%	['lint']
xmlPatMatch	176	83	47.15%	['reader', 'lint']
xmlValidGetValidElements	64	26	40.62%	['lint']
xmllintResourceLoader	48	16	33.33%	['lint']
streamFile	163	34	20.85%	['lint']
testSAX	49	12	24.48%	['lint']
parseHtml	49	14	28.57%	['lint']
parseXml	59	25	42.37%	['lint']
xmlSchemaItemTypeToStr	44	24	54.54%	['schema', 'lint']
xmlSchemaAddAnnotation	83	12	14.45%	['schema', 'lint']
xmlSchemaCheckSRCRedefineFirst	104	7	6.730%	['schema', 'lint']
xmlSchemaCheckSTPropsCorrect	53	28	52.83%	['schema', 'lint']
xmlSchemaCheckCOSSTRestricts	300	138	46.0%	['schema', 'lint']
xmlSchemaCheckCOSSTDerivedOK	43	20	46.51%	['schema', 'lint']
xmlSchemaCheckAttrUsePropsCorrect	68	12	17.64%	['schema', 'lint']
xmlSchemaCheckCOSCTExtends	56	30	53.57%	['schema', 'lint']
xmlSchemaCheckDerivationOKRestriction	98	41	41.83%	['schema', 'lint']
xmlSchemaLookupNamespace	45	14	31.11%	['schema', 'lint']
xmlSchemaValidateElemDecl	87	44	50.57%	['schema', 'lint']
xmlSchemaGetBuiltInType	99	48	48.48%	['schema', 'lint']
xmlSchemaCopyValue	91	32	35.16%	['schema', 'lint']
xmlSchemaGetCanonValue	260	86	33.07%	['schema', 'lint']
xmlSchemaValidateFacetInternal	168	65	38.69%	['schema', 'lint']
xmlTextReaderSetStructuredErrorHandler	39	16	41.02%	['reader']
xmlTextReaderSetup	159	69	43.39%	['reader', 'lint']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libxml2/HTMLparser.c	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['html', 'xml', 'xinclude', 'valid', 'api', 'lint']
/src/libxml2/parserInternals.c	['regexp', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/entities.c	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['xml', 'xinclude', 'xpath', 'valid', 'api', 'schema', 'reader']
/src/libxml2/fuzz/xinclude.c	['xinclude']	['xinclude']
/src/libxml2/pattern.c	['lint', 'schema', 'reader']	['lint', 'schema']
/src/libxml2/parser.c	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/fuzz/xml.c	['xml']	['xml']
/src/libxml2/catalog.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/xinclude.c	['xinclude', 'lint', 'reader']	['xinclude', 'lint', 'reader']
/src/libxml2/./include/private/parser.h	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	[]
/src/libxml2/xmlsave.c	['html', 'xml', 'api', 'lint', 'reader']	['xml', 'api', 'lint', 'reader']
/src/libxml2/fuzz/../xmllint.c	['lint']	[]
/src/libxml2/fuzz/lint.c	['lint']	['lint']
/src/libxml2/fuzz/uri.c	['uri']	['uri']
/src/libxml2/./include/private/memory.h	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	[]
/src/libxml2/c14n.c	['lint']	['lint']
/src/libxml2/globals.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/threads.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/fuzz/reader.c	['reader']	['reader']
/src/libxml2/buf.c	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/xmlmemory.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/dict.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/valid.c	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/list.c	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/xmlschemastypes.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/xmlreader.c	['lint', 'schema', 'reader']	['lint', 'reader']
/src/libxml2/xmlstring.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/fuzz/api.c	['api']	['api']
/src/libxml2/hash.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/xmlIO.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/fuzz/fuzz.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/SAX2.c	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/xmlregexp.c	['regexp', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'valid', 'api', 'schema', 'reader']
/src/libxml2/fuzz/xpath.c	['xpath']	['xpath']
/src/libxml2/fuzz/valid.c	['valid']	['valid']
/src/libxml2/fuzz/regexp.c	['regexp']	['regexp']
/src/libxml2/error.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/uri.c	['uri', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['uri', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/relaxng.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/HTMLtree.c	['html', 'xml', 'api', 'lint', 'reader']	['html', 'xml', 'api', 'reader']
/src/libxml2/encoding.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/xpointer.c	['xinclude', 'xpath', 'lint', 'reader']	['xinclude', 'xpath', 'reader']
/src/libxml2/chvalid.c	['regexp', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'xml', 'xinclude', 'valid', 'api', 'schema', 'reader']
/src/libxml2/tree.c	['regexp', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/fuzz/html.c	['html']	['html']
/src/libxml2/xpath.c	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']	['regexp', 'uri', 'html', 'xml', 'xinclude', 'xpath', 'valid', 'api', 'lint', 'schema', 'reader']
/src/libxml2/./codegen/unicode.inc	['regexp', 'valid', 'api', 'lint', 'schema', 'reader']	[]
/src/libxml2/fuzz/../shell.c	['lint']	[]
/src/libxml2/fuzz/schema.c	['schema']	['schema']
/src/libxml2/./timsort.h	['xinclude', 'xpath', 'lint', 'reader']	[]
/src/libxml2/xmlschemas.c	['lint', 'schema', 'reader']	['schema']

Directories in report

Directory
/src/libxml2/fuzz/../
/src/libxml2/./codegen/
/src/libxml2/
/src/libxml2/./include/private/
/src/libxml2/fuzz/
/src/libxml2/./