High level conclusions

Fuzzers reach 70.46% code coverage.

Fuzzers reach 88.07% of cyclomatic complexity.

Fuzzers reach 77.29% of all functions.

Fuzzer lint is blocked:

The runtime code coverage of lint covers 25.46% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

2162 / 2797

Cyclomatic complexity statically reachable by fuzzers

28424 / 32271

Runtime code coverage of functions

1971 / 2797

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	41	12.4%
gold	[1:9]	40	12.1%
yellow	[10:29]	12	3.63%
greenyellow	[30:49]	3	0.90%
lawngreen	50+	234	70.9%
All colors	330	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	9	xmlInitRandom	call site: 00009	xmlAbort
7	218	xmlURIEscape	call site: 00218	xmlURIEscapeStr
5	323	xmlFuzzDataCleanup	call site: 00323	xmlDictFree
4	134	LLVMFuzzerTestOneInput	call site: 00134	fprintf
4	197	xmlURIEscape	call site: 00197	xmlURIEscapeStr
2	150	xmlSaveUri	call site: 00150	xmlSaveUriRealloc
2	159	xmlSaveUri	call site: 00159	xmlSaveUriRealloc
1	27	xmlInitGlobalsInternal	call site: 00027	xmlResetError
1	45	xmlGetThreadLocalStorage	call site: 00045	pthread_getspecific
1	47	xmlGetThreadLocalStorage	call site: 00047	xmlAbort
1	60	xmlRandom	call site: 00060	xmlHashGrow
1	85	xmlParse3986Host	call site: 00085	xmlParse3986DecOctet

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

26

Reachable functions

117

Percentage of reachable functions covered

77.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/uri.c	1
fuzz/fuzz.c	7
hash.c	4
threads.c	7
dict.c	6
error.c	3
xmlmemory.c	1
globals.c	6
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
uri.c	43
xmlstring.c	12
./include/private/memory.h	1

Fuzzer: regexp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	102	23.3%
gold	[1:9]	49	11.2%
yellow	[10:29]	12	2.74%
greenyellow	[30:49]	2	0.45%
lawngreen	50+	272	62.2%
All colors	437	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	123	xmlVRaiseError	call site: 00123	xmlFormatError
10	409	xmlRegEpxFromParse	call site: 00409	xmlRegexpErrMemory
8	9	xmlInitRandom	call site: 00009	xmlAbort
7	101	xmlVRaiseError	call site: 00101	xmlGetLineNo
5	169	xmlFAGenerateTransitions	call site: 00169	xmlRegCopyAtom
5	429	xmlFuzzDataCleanup	call site: 00429	xmlDictFree
4	175	xmlRegNewRange	call site: 00175	xmlRegexpErrMemory
3	81	__xmlStructuredError	call site: 00081	__xmlStructuredError
3	119	xmlVSetError	call site: 00119	xmlCopyError
3	180	xmlRegFreeAtom	call site: 00180	xmlFAGenerateTransitions
3	318	xmlFACompareAtoms	call site: 00318	xmlRegStrEqualWildcard
2	113	xmlStrVASPrintf	call site: 00113	xmlStrdup

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

41

Reachable functions

182

Percentage of reachable functions covered

77.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/regexp.c	1
fuzz/fuzz.c	6
hash.c	4
threads.c	7
dict.c	6
error.c	13
xmlmemory.c	1
globals.c	12
encoding.c	1
xpath.c	2
xmlIO.c	1
catalog.c	1
xmlschemastypes.c	1
relaxng.c	1
xmlregexp.c	60
xmlstring.c	7
./include/private/memory.h	1
tree.c	2
parserInternals.c	1
chvalid.c	1
./codegen/unicode.inc	35

Fuzzer: html

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	563	45.4%
gold	[1:9]	39	3.15%
yellow	[10:29]	7	0.56%
greenyellow	[30:49]	6	0.48%
lawngreen	50+	623	50.3%
All colors	1238	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
73	906	xmlHashUpdateInternal	call site: 00906	xmlCopyEntity
40	1027	xmlNewDocProp	call site: 01027	xmlNewDocProp
26	694	xmlAllocOutputBuffer	call site: 00694	xmlCharEncOutput
24	166	xmlUnlinkNode	call site: 00166	xmlFreeEntitiesTable
19	982	xmlNewDocProp	call site: 00982	xmlNodeParseAttValue
18	1006	xmlNewText	call site: 01006	xmlNodeParseAttValue
16	1120	xmlNodeGetContent	call site: 01120	xmlBufGetNodeContent
15	320	xmlVRaiseError	call site: 00320	xmlRaiseMemoryError
14	761	htmlNodeDumpInternal	call site: 00761	htmlParseMetaEncoding
13	1068	xmlCopyPropInternal	call site: 01068	xmlSetTreeDoc
12	779	htmlNodeDumpInternal	call site: 00779	xmlNsListDumpOutput
11	137	xmlFreeDtd	call site: 00137	xmlFreeElementTable

Runtime coverage analysis

Covered functions

302

Functions that are reachable but not covered

142

Reachable functions

388

Percentage of reachable functions covered

63.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/html.c	1
fuzz/fuzz.c	7
hash.c	16
threads.c	7
dict.c	18
error.c	14
xmlmemory.c	1
globals.c	15
encoding.c	19
xpath.c	2
xmlIO.c	17
catalog.c	5
xmlschemastypes.c	1
relaxng.c	1
HTMLparser.c	56
SAX2.c	1
parserInternals.c	30
parser.c	8
buf.c	19
tree.c	50
valid.c	33
list.c	3
xmlregexp.c	4
entities.c	8
xmlstring.c	12
./include/private/memory.h	1
./include/private/parser.h	1
HTMLtree.c	9
xmlsave.c	3

Fuzzer: xpath

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1173	34.9%
gold	[1:9]	161	4.79%
yellow	[10:29]	46	1.36%
greenyellow	[30:49]	24	0.71%
lawngreen	50+	1957	58.2%
All colors	3361	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
131	1807	xmlBuildURISafe	call site: 01807	xmlCatalogXMLResolve
58	1947	xmlInitializeCatalog	call site: 01947	xmlACatalogResolve
53	1537	xmlNewNs	call site: 01537	xmlStaticCopyNodeList
39	714	xmlHashLookup	call site: 00714	xmlParseXMLCatalogFile
38	1592	xmlNewDoc	call site: 01592	xmlCopyDtd
32	2190	xmlExpandPEsInEntityValue	call site: 02190	xmlLoadEntityContent
22	666	xmlRMutexUnlock	call site: 00666	xmlCatalogListXMLResolve
22	1424	nodePush	call site: 01424	xmlParseTextDecl
21	2011	xmlSkipBlankCharsPE	call site: 02011	xmlSkipBlankCharsPE
18	1152	xmlParseAttValue	call site: 01152	xmlSkipBlankChars
18	1748	xmlGetPropNodeValueInternal	call site: 01748	xmlParseXMLCatalogNodeList
17	1507	xmlParseReference	call site: 01507	xmlDocCopyNode

Runtime coverage analysis

Covered functions

688

Functions that are reachable but not covered

188

Reachable functions

760

Percentage of reachable functions covered

75.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xpath.c	1
fuzz/fuzz.c	7
hash.c	28
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	140
xmlIO.c	17
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
parser.c	141
parserInternals.c	40
SAX2.c	6
buf.c	19
HTMLparser.c	2
xmlstring.c	16
tree.c	65
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
entities.c	10
valid.c	41
list.c	3
xmlregexp.c	4
xpointer.c	8
./timsort.h	12

Fuzzer: xinclude

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	804	21.5%
gold	[1:9]	233	6.25%
yellow	[10:29]	58	1.55%
greenyellow	[30:49]	48	1.28%
lawngreen	50+	2584	69.3%
All colors	3727	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
70	807	xmlRMutexUnlock	call site: 00807	xmlCatalogListXMLResolve
68	1893	xmlNodeGetBaseSafe	call site: 01893	xmlCatalogXMLResolve
55	1970	xmlInitializeCatalog	call site: 01970	xmlACatalogResolve
18	1274	xmlParseAttValue	call site: 01274	xmlSkipBlankChars
17	1771	xmlGetPropNodeValueInternal	call site: 01771	xmlParseXMLCatalogNodeList
17	1807	xmlGetNsListSafe	call site: 01807	xmlParseXMLCatalogOneNode
14	1259	xmlParseStartTag2	call site: 01259	xmlParseStartTag
14	1375	xmlParseElementEnd	call site: 01375	xmlParseEndTag1
14	1569	xmlSearchNsByHrefSafe	call site: 01569	xmlSearchNsSafe
14	1752	xmlFinishDocument	call site: 01752	xmlFreeDoc
13	626	xmlParsePI	call site: 00626	xmlParseCatalogPI
11	3665	xmlXIncludeLoadTxt	call site: 03665	xmlAddChild

Runtime coverage analysis

Covered functions

812

Functions that are reachable but not covered

131

Reachable functions

823

Percentage of reachable functions covered

84.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xinclude.c	1
fuzz/fuzz.c	12
hash.c	30
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	20
encoding.c	16
xpath.c	139
xmlIO.c	18
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	18
parserInternals.c	42
SAX2.c	6
parser.c	143
buf.c	19
tree.c	83
valid.c	41
list.c	3
xmlregexp.c	4
entities.c	11
HTMLparser.c	2
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	39
xinclude.c	27
xpointer.c	8
./timsort.h	12

Fuzzer: reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1843	32.4%
gold	[1:9]	286	5.04%
yellow	[10:29]	106	1.86%
greenyellow	[30:49]	50	0.88%
lawngreen	50+	3389	59.7%
All colors	5674	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
277	4528	xmlNodeListGetStringInternal	call site: 04528	xmlTextReaderExpand
150	502	xmlCtxtErrIO	call site: 00502	xmlFreeTextReader
86	4222	xmlFACompareAtoms	call site: 04222	xmlFARecurseDeterminism
68	2672	xmlNodeGetBaseSafe	call site: 02672	xmlCatalogXMLResolve
62	4989	htmlIsBooleanAttr	call site: 04989	xmlSaveSwitchEncoding
59	2851	xmlTextReaderValidatePop	call site: 02851	xmlRelaxNGValidatePopElement
55	2749	xmlInitializeCatalog	call site: 02749	xmlACatalogResolve
53	2460	xmlCopyNamespaceList	call site: 02460	xmlCopyDoc
37	1488	xmlRMutexUnlock	call site: 01488	xmlCatalogListXMLResolve
36	4339	xmlRegStateAddTransTo	call site: 04339	xmlFAGenerateTransitions
34	4932	xmlOutputBufferWriteQuotedString	call site: 04932	htmlNodeDumpInternal
33	1526	xmlNewParserCtxt	call site: 01526	xmlParserInputBufferCreateFilename

Runtime coverage analysis

Covered functions

1016

Functions that are reachable but not covered

336

Reachable functions

1198

Percentage of reachable functions covered

71.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/reader.c	2
fuzz/fuzz.c	11
hash.c	30
threads.c	9
dict.c	22
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	139
xmlIO.c	30
catalog.c	35
xmlschemastypes.c	2
relaxng.c	58
xmlstring.c	19
xmlreader.c	85
buf.c	20
SAX2.c	6
parser.c	151
parserInternals.c	43
./include/private/memory.h	1
tree.c	89
valid.c	51
list.c	3
xmlregexp.c	59
entities.c	11
uri.c	39
xinclude.c	29
pattern.c	8
HTMLparser.c	4
xmlschemas.c	43
./include/private/parser.h	2
chvalid.c	1
xpointer.c	8
./timsort.h	12
./codegen/unicode.inc	35
xmlsave.c	31
HTMLtree.c	8

Fuzzer: xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	961	30.3%
gold	[1:9]	120	3.79%
yellow	[10:29]	54	1.70%
greenyellow	[30:49]	38	1.20%
lawngreen	50+	1990	62.9%
All colors	3163	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
73	1891	xmlBuildURISafe	call site: 01891	xmlCatalogXMLResolve
70	810	xmlRMutexUnlock	call site: 00810	xmlCatalogListXMLResolve
61	2641	htmlIsBooleanAttr	call site: 02641	htmlAttrDumpOutput
55	1973	xmlInitializeCatalog	call site: 01973	xmlACatalogResolve
38	1619	xmlNewDoc	call site: 01619	xmlCopyDtd
35	2583	xmlOutputBufferWriteQuotedString	call site: 02583	htmlNodeDumpInternal
27	1800	xmlStrncat	call site: 01800	xmlParseXMLCatalogOneNode
18	1277	xmlParseAttValue	call site: 01277	xmlSkipBlankChars
18	1568	xmlCopyPropInternal	call site: 01568	xmlNewReconciledNs
17	1774	xmlGetPropNodeValueInternal	call site: 01774	xmlParseXMLCatalogNodeList
16	1658	xmlCreateEnumeration	call site: 01658	xmlCopyEntitiesTable
16	1701	xmlNodeGetContent	call site: 01701	xmlBufGetNodeContent

Runtime coverage analysis

Covered functions

605

Functions that are reachable but not covered

166

Reachable functions

694

Percentage of reachable functions covered

76.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/xml.c	1
fuzz/fuzz.c	13
hash.c	29
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	31
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	17
parserInternals.c	43
SAX2.c	6
parser.c	152
buf.c	25
tree.c	67
valid.c	40
list.c	3
xmlregexp.c	4
entities.c	10
HTMLparser.c	4
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
xmlsave.c	35
HTMLtree.c	8

Fuzzer: valid

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	876	27.2%
gold	[1:9]	98	3.05%
yellow	[10:29]	81	2.52%
greenyellow	[30:49]	28	0.87%
lawngreen	50+	2127	66.2%
All colors	3210	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	2626	xmlFACompareAtoms	call site: 02626	xmlFARecurseDeterminism
73	1890	xmlBuildURISafe	call site: 01890	xmlCatalogXMLResolve
70	809	xmlRMutexUnlock	call site: 00809	xmlCatalogListXMLResolve
55	1972	xmlInitializeCatalog	call site: 01972	xmlACatalogResolve
38	1618	xmlNewDoc	call site: 01618	xmlCopyDtd
36	2743	xmlRegStateAddTransTo	call site: 02743	xmlFAGenerateTransitions
33	1799	xmlStrncat	call site: 01799	xmlParseXMLCatalogOneNode
27	1769	xmlSplitQName4	call site: 01769	xmlParseXMLCatalogNodeList
17	2898	xmlRegExecSetErrString	call site: 02898	xmlFARegExecSaveInputString
16	1700	xmlNodeGetContent	call site: 01700	xmlBufGetNodeContent
15	1594	xmlNewDtd	call site: 01594	xmlCopyEntitiesTable
14	1515	xmlCtxtParseEntity	call site: 01515	xmlSetTreeDoc

Runtime coverage analysis

Covered functions

652

Functions that are reachable but not covered

195

Reachable functions

765

Percentage of reachable functions covered

74.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/valid.c	1
fuzz/fuzz.c	13
hash.c	29
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	20
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
xmlstring.c	16
parserInternals.c	43
SAX2.c	6
parser.c	157
buf.c	19
tree.c	70
valid.c	78
list.c	8
xmlregexp.c	58
entities.c	10
HTMLparser.c	3
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	35
./codegen/unicode.inc	35

Fuzzer: api

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	869	16.7%
gold	[1:9]	175	3.37%
yellow	[10:29]	47	0.90%
greenyellow	[30:49]	10	0.19%
lawngreen	50+	4090	78.7%
All colors	5191	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
86	3825	xmlFACompareAtoms	call site: 03825	xmlFARecurseDeterminism
68	1904	xmlNodeGetBaseSafe	call site: 01904	xmlCatalogXMLResolve
56	1981	xmlInitializeCatalog	call site: 01981	xmlACatalogResolve
36	3942	xmlRegStateAddTransTo	call site: 03942	xmlFAGenerateTransitions
32	2224	xmlExpandPEsInEntityValue	call site: 02224	xmlLoadEntityContent
23	2043	xmlParsePERefInternal	call site: 02043	xmlSkipBlankCharsPE
22	804	xmlRMutexUnlock	call site: 00804	xmlCatalogListXMLResolve
20	1460	xmlCtxtParseContentInternal	call site: 01460	xmlParseTextDecl
19	834	xmlHashUpdateInternal	call site: 00834	xmlFetchXMLCatalogFile
17	4097	xmlRegExecSetErrString	call site: 04097	xmlFARegExecSaveInputString
15	1783	xmlGetPropNodeValueInternal	call site: 01783	xmlParseXMLCatalogNodeList
13	630	xmlParsePI	call site: 00630	xmlParseCatalogPI

Runtime coverage analysis

Covered functions

926

Functions that are reachable but not covered

151

Reachable functions

1004

Percentage of reachable functions covered

84.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/api.c	35
fuzz/fuzz.c	11
hash.c	31
threads.c	9
dict.c	21
error.c	15
xmlmemory.c	1
globals.c	23
encoding.c	19
xpath.c	2
xmlIO.c	29
catalog.c	35
xmlschemastypes.c	1
relaxng.c	1
tree.c	155
valid.c	101
list.c	12
xmlregexp.c	58
entities.c	20
parser.c	146
parserInternals.c	38
SAX2.c	6
buf.c	26
HTMLparser.c	7
xmlstring.c	18
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
uri.c	36
HTMLtree.c	20
./codegen/unicode.inc	35
xmlsave.c	49

Fuzzer: schema

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1576	25.5%
gold	[1:9]	414	6.71%
yellow	[10:29]	202	3.27%
greenyellow	[30:49]	83	1.34%
lawngreen	50+	3894	63.1%
All colors	6169	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
65	2604	xmlBuildURI	call site: 02604	xmlCatalogXMLResolve
56	2678	xmlInitializeCatalog	call site: 02678	xmlACatalogResolve
55	2388	xmlCopyNamespaceList	call site: 02388	xmlCopyDoc
40	5529	xmlSchemaBuildContentModelForElement	call site: 05529	xmlSchemaBuildAContentModel
38	686	xmlStrncmp	call site: 00686	xmlCatalogListXMLResolve
33	2202	xmlNewDocNode	call site: 02202	xmlNodeParseAttValue
32	2059	xmlParseStartTag2	call site: 02059	xmlParseStartTag
26	6047	xmlSchemaValidatorPopElem	call site: 06047	xmlAddChild
23	5890	xmlSchemaVAttributesComplex	call site: 05890	xmlNewProp
19	4777	xmlSchemaGetCanonValue	call site: 04777	xmlSchemaDateNormalize
18	2347	xmlCopyPropInternal	call site: 02347	xmlNewReconciledNs
18	5693	xmlSchemaVDocWalk	call site: 05693	xmlSchemaAssembleByXSI

Runtime coverage analysis

Covered functions

1070

Functions that are reachable but not covered

191

Reachable functions

1203

Percentage of reachable functions covered

84.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/schema.c	1
fuzz/fuzz.c	11
hash.c	30
threads.c	9
dict.c	21
error.c	16
xmlmemory.c	1
globals.c	20
encoding.c	15
xpath.c	2
xmlIO.c	19
catalog.c	35
xmlschemastypes.c	71
relaxng.c	1
xmlstring.c	20
xmlschemas.c	335
parserInternals.c	43
buf.c	19
xmlregexp.c	89
tree.c	85
SAX2.c	6
parser.c	144
valid.c	45
list.c	7
entities.c	10
HTMLparser.c	2
uri.c	36
./include/private/memory.h	1
chvalid.c	1
./include/private/parser.h	2
pattern.c	29
xmlreader.c	3
./codegen/unicode.inc	35

Fuzzer: lint

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9981	85.4%
gold	[1:9]	38	0.32%
yellow	[10:29]	70	0.59%
greenyellow	[30:49]	32	0.27%
lawngreen	50+	1564	13.3%
All colors	11685	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1138	5881	xmlPatternCompileSafe	call site: 05881	xmlSchemaParseRedefine
1039	3085	xmlSearchNs	call site: 03085	xmlRelaxReadFile
662	5133	xmlFreePatternInternal	call site: 05133	xmlSchemaParseNewDocWithContext
622	4404	xmlNodeSetContentInternal	call site: 04404	xmlRelaxNGCleanupTree
524	1828	xmlFreeDoc	call site: 01828	xmlSkipBlankCharsPE
471	8580	xmlOpenCharEncodingHandler	call site: 08580	xmlXIncludeLoadFallback
438	9200	xmllintMain	call site: 09200	xmlSchemaValidateStream
338	10047	xmlValidateDocumentInternal	call site: 10047	xmllintShellRNGValidate
281	9640	parseHtml	call site: 09640	htmlCtxtParseDocument
239	2845	xmlNodeGetAttrValue	call site: 02845	xmlRelaxNGParse
229	4173	xmlNewInputFromMemory	call site: 04173	xmlRelaxNGCleanupDoc
229	10956	xmlNodeDumpOutput	call site: 10956	xmllintShellSetContent

Runtime coverage analysis

Covered functions

570

Functions that are reachable but not covered

1496

Reachable functions

2007

Percentage of reachable functions covered

25.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/lint.c	2
xmlmemory.c	8
fuzz/fuzz.c	10
hash.c	31
threads.c	13
dict.c	24
error.c	18
globals.c	25
encoding.c	22
xpath.c	147
xmlIO.c	38
catalog.c	49
xmlschemastypes.c	72
relaxng.c	140
xmlstring.c	20
fuzz/../xmllint.c	30
parser.c	166
parserInternals.c	53
chvalid.c	1
./include/private/memory.h	1
uri.c	40
SAX2.c	7
buf.c	20
tree.c	109
./include/private/parser.h	2
valid.c	90
xmlregexp.c	92
entities.c	11
list.c	12
xmlschemas.c	343
xmlreader.c	48
./codegen/unicode.inc	35
pattern.c	32
HTMLparser.c	62
xinclude.c	29
xpointer.c	8
./timsort.h	12
HTMLtree.c	17
fuzz/../shell.c	21
xmlsave.c	45
c14n.c	39

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
xmlSAX2StartElement	/src/libxml2/SAX2.c	3	['N/A', 'N/A', 'N/A']	22	0	77	15	7	284	0	2945	244
xmlSAX2StartElementNs	/src/libxml2/SAX2.c	9	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A', 'int', 'int', 'N/A']	18	0	982	148	59	254	0	2318	157
xmlXPathSubstringFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	485	88	34	145	0	925	80
xmlCatalogDump	/src/libxml2/catalog.c	1	['N/A']	26	0	37	9	4	305	0	2846	74
xmlCatalogAdd	/src/libxml2/catalog.c	3	['N/A', 'N/A', 'N/A']	40	0	73	12	5	579	0	7142	59
xmlXPathTranslateFunction	/src/libxml2/xpath.c	2	['N/A', 'int']	14	0	435	72	28	137	0	856	48
xmlParseEntity	/src/libxml2/parser.c	1	['N/A']	37	0	15	3	2	583	0	7137	40

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2208 / 2797

Cyclomatic complexity statically reachable by fuzzers

29126 / 32271

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzz/uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlInitRandom', 'xmlURIEscape', 'xmlFuzzDataCleanup', 'LLVMFuzzerTestOneInput', 'xmlSaveUri', 'xmlInitGlobalsInternal', 'xmlGetThreadLocalStorage']

fuzz/regexp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlVRaiseError', 'xmlRegEpxFromParse', 'xmlInitRandom', 'xmlFAGenerateTransitions', 'xmlFuzzDataCleanup', 'xmlRegNewRange', '__xmlStructuredError', 'xmlVSetError', 'xmlRegFreeAtom']

fuzz/html.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlHashUpdateInternal', 'xmlNewDocProp', 'xmlAllocOutputBuffer', 'xmlUnlinkNode', 'xmlNewText', 'xmlNodeGetContent', 'xmlVRaiseError', 'htmlNodeDumpInternal', 'xmlCopyPropInternal']

fuzz/xpath.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'xmlInitializeCatalog', 'xmlNewNs', 'xmlHashLookup', 'xmlNewDoc', 'xmlExpandPEsInEntityValue', 'xmlRMutexUnlock', 'nodePush', 'xmlSkipBlankCharsPE', 'xmlParseAttValue']

fuzz/xinclude.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlRMutexUnlock', 'xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlParseAttValue', 'xmlGetPropNodeValueInternal', 'xmlGetNsListSafe', 'xmlParseStartTag2', 'xmlParseElementEnd', 'xmlSearchNsByHrefSafe', 'xmlFinishDocument']

fuzz/reader.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlNodeListGetStringInternal', 'xmlCtxtErrIO', 'xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'htmlIsBooleanAttr', 'xmlTextReaderValidatePop', 'xmlInitializeCatalog', 'xmlCopyNamespaceList', 'xmlRMutexUnlock', 'xmlRegStateAddTransTo']

fuzz/xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURISafe', 'xmlRMutexUnlock', 'htmlIsBooleanAttr', 'xmlInitializeCatalog', 'xmlNewDoc', 'xmlOutputBufferWriteQuotedString', 'xmlStrncat', 'xmlParseAttValue', 'xmlCopyPropInternal', 'xmlGetPropNodeValueInternal']

fuzz/valid.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlBuildURISafe', 'xmlRMutexUnlock', 'xmlInitializeCatalog', 'xmlNewDoc', 'xmlRegStateAddTransTo', 'xmlStrncat', 'xmlSplitQName4', 'xmlRegExecSetErrString', 'xmlNodeGetContent']

fuzz/api.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlFACompareAtoms', 'xmlNodeGetBaseSafe', 'xmlInitializeCatalog', 'xmlRegStateAddTransTo', 'xmlExpandPEsInEntityValue', 'xmlParsePERefInternal', 'xmlRMutexUnlock', 'xmlCtxtParseContentInternal', 'xmlHashUpdateInternal', 'xmlRegExecSetErrString']

fuzz/schema.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlBuildURI', 'xmlInitializeCatalog', 'xmlCopyNamespaceList', 'xmlSchemaBuildContentModelForElement', 'xmlStrncmp', 'xmlNewDocNode', 'xmlParseStartTag2', 'xmlSchemaValidatorPopElem', 'xmlSchemaVAttributesComplex', 'xmlSchemaGetCanonValue']

fuzz/lint.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['xmlPatternCompileSafe', 'xmlSearchNs', 'xmlFreePatternInternal', 'xmlNodeSetContentInternal', 'xmlFreeDoc', 'xmlOpenCharEncodingHandler', 'xmllintMain', 'xmlValidateDocumentInternal', 'parseHtml', 'xmlNodeGetAttrValue']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
xmlErrString	321	171	53.27%	['html', 'schema', 'xpath', 'xinclude', 'reader', 'lint', 'valid', 'xml', 'api']
xmlXPathCacheObjectCopy	31	17	54.83%	['lint', 'xinclude', 'reader', 'xpath']
xmlXPathRunEval	31	14	45.16%	['lint', 'xinclude', 'reader', 'xpath']
xmlCtxtResolveFromCatalog	32	17	53.12%	['schema', 'xinclude', 'xpath', 'reader', 'lint', 'valid', 'xml', 'api']
xmlTextReaderSetStructuredErrorHandler	39	16	41.02%	['reader']
xmlTextReaderSetup	159	69	43.39%	['lint', 'reader']
xmlIOErr	154	10	6.493%	['schema', 'xinclude', 'xpath', 'reader', 'lint', 'valid', 'xml', 'api']
xmlSchemaItemTypeToStr	44	24	54.54%	['lint', 'schema']
xmlSchemaAddAnnotation	83	12	14.45%	['lint', 'schema']
xmlSchemaCheckSRCRedefineFirst	104	7	6.730%	['lint', 'schema']
xmlSchemaCheckSTPropsCorrect	53	20	37.73%	['lint', 'schema']
xmlSchemaCheckCOSSTRestricts	300	145	48.33%	['lint', 'schema']
xmlSchemaCheckCOSSTDerivedOK	43	20	46.51%	['lint', 'schema']
xmlSchemaCheckAttrUsePropsCorrect	68	12	17.64%	['lint', 'schema']
xmlSchemaCheckCOSCTExtends	56	29	51.78%	['lint', 'schema']
xmlSchemaCheckDerivationOKRestriction	98	41	41.83%	['lint', 'schema']
xmlSchemaLookupNamespace	45	14	31.11%	['lint', 'schema']
xmlSchemaValidateElemDecl	87	44	50.57%	['lint', 'schema']
xmlSchemaGetBuiltInType	99	48	48.48%	['lint', 'schema']
xmlSchemaCopyValue	91	32	35.16%	['lint', 'schema']
xmlSchemaGetCanonValue	260	86	33.07%	['lint', 'schema']
xmlSchemaValidateFacetInternal	168	65	38.69%	['lint', 'schema']
xmlC14NProcessNode	122	24	19.67%	['lint']
xmlC14NCheckForRelativeNamespaces	31	7	22.58%	['lint']
xmlC14NProcessNamespacesAxis	47	22	46.80%	['lint']
xmlExcC14NProcessNamespacesAxis	108	32	29.62%	['lint']
xmlC14NProcessAttrsAxis	112	45	40.17%	['lint']
xmlC11NNormalizeString	85	27	31.76%	['lint']
xmlPatMatch	176	83	47.15%	['lint', 'reader']
xmlValidGetValidElements	64	26	40.62%	['lint']
xmllintResourceLoader	48	13	27.08%	['lint']
streamFile	163	34	20.85%	['lint']
testSAX	49	12	24.48%	['lint']
parseXml	59	25	42.37%	['lint']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libxml2/tree.c	['regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/xmlregexp.c	['regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['regexp', 'reader', 'valid', 'api', 'schema']
/src/libxml2/relaxng.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/error.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/dict.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/pattern.c	['reader', 'schema', 'lint']	['schema', 'lint']
/src/libxml2/fuzz/fuzz.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/fuzz/xml.c	['xml']	['xml']
/src/libxml2/c14n.c	['lint']	['lint']
/src/libxml2/fuzz/xinclude.c	['xinclude']	['xinclude']
/src/libxml2/HTMLtree.c	['html', 'reader', 'xml', 'api', 'lint']	['html', 'reader', 'xml', 'api']
/src/libxml2/encoding.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/threads.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/xinclude.c	['xinclude', 'reader', 'lint']	['xinclude', 'reader', 'lint']
/src/libxml2/./codegen/unicode.inc	['regexp', 'reader', 'valid', 'api', 'schema', 'lint']	[]
/src/libxml2/xmlmemory.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/fuzz/regexp.c	['regexp']	['regexp']
/src/libxml2/fuzz/lint.c	['lint']	['lint']
/src/libxml2/fuzz/schema.c	['schema']	['schema']
/src/libxml2/catalog.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/chvalid.c	['regexp', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['regexp', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema']
/src/libxml2/xmlreader.c	['reader', 'schema', 'lint']	['reader', 'lint']
/src/libxml2/xpath.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/fuzz/reader.c	['reader']	['reader']
/src/libxml2/xmlschemastypes.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/xmlschemas.c	['reader', 'schema', 'lint']	['schema']
/src/libxml2/./include/private/memory.h	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	[]
/src/libxml2/fuzz/xpath.c	['xpath']	['xpath']
/src/libxml2/hash.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/globals.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/xmlIO.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/xpointer.c	['xpath', 'xinclude', 'reader', 'lint']	['xpath', 'xinclude', 'reader']
/src/libxml2/xmlstring.c	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/./include/private/parser.h	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	[]
/src/libxml2/list.c	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/SAX2.c	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/parser.c	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/./timsort.h	['xpath', 'xinclude', 'reader', 'lint']	[]
/src/libxml2/xmlsave.c	['html', 'reader', 'xml', 'api', 'lint']	['reader', 'xml', 'api', 'lint']
/src/libxml2/fuzz/uri.c	['uri']	['uri']
/src/libxml2/valid.c	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/uri.c	['uri', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['uri', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema']
/src/libxml2/parserInternals.c	['regexp', 'html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/fuzz/../shell.c	['lint']	[]
/src/libxml2/fuzz/api.c	['api']	['api']
/src/libxml2/fuzz/../xmllint.c	['lint']	[]
/src/libxml2/entities.c	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema']
/src/libxml2/buf.c	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']
/src/libxml2/HTMLparser.c	['html', 'xpath', 'xinclude', 'reader', 'xml', 'valid', 'api', 'schema', 'lint']	['html', 'xinclude', 'xml', 'valid', 'api', 'lint']
/src/libxml2/fuzz/valid.c	['valid']	['valid']
/src/libxml2/fuzz/html.c	['html']	['html']

Directories in report

Directory
/src/libxml2/./
/src/libxml2/fuzz/../
/src/libxml2/fuzz/
/src/libxml2/./codegen/
/src/libxml2/
/src/libxml2/./include/private/