Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues
Project coverage
Per-fuzzer coverage

Table of contents

Project overview: libxslt
High level conclusions
Reachability and coverage overview
Fuzzers overview
Project functions overview
Fuzzer details
Fuzzer: xpath
Call tree
Fuzz blockers
Runtime coverage analysis
Files reached
Fuzzer: xslt
Call tree
Fuzz blockers
Runtime coverage analysis
Files reached
Analyses and suggestions
Optimal target analysis
Remaining optimal interesting functions
All functions overview
Runtime coverage analysis
Complex functions with low coverage
Files and Directories in report
Files in report
Directories in report
Metadata section
Report generation date: 2022-11-15

Project overview: libxslt

High level conclusions

Reachability and coverage overview

Functions statically reachable by fuzzers
58.5%
1346/2301
Cyclomatic complexity statically reachable by fuzzers
69.07%
19130/27696
Functions covered at runtime
1042

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
xpath libxslt/tests/fuzz/xpath.c 398 1904 44 29 12481 4770 xpath.c
xslt libxslt/tests/fuzz/xslt.c 1343 959 52 50 49501 19120 xslt.c

Project functions overview

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzzer details

Fuzzer: xpath

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 741 50.7%
gold [1:9] 115 7.87%
yellow [10:29] 73 4.99%
greenyellow [30:49] 37 2.53%
lawngreen 50+ 495 33.8%
All colors 1461 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
51480 59542 16 :

['xmlStrchr', 'xmlParseExternalEntityPrivate', 'xmlParseBalancedChunkMemoryInternal', 'xmlAddChildList', 'xmlFreeNodeList', 'xmlErrMsgStr', 'xmlFatalErr', 'xmlParseEntityRef', 'xmlParserEntityCheck', 'xmlSetTreeDoc', 'xmlDictLookup', 'xmlFatalErrMsgStr', 'xmlDocCopyNode', 'xmlAddChild', 'xmlHaltParser', 'xmlStrlen']

51480 59542 xmlParseReference call site /src/libxml2/parser.c:7152
34356 34913 6 :

['xmlCatalogLocalResolve', 'xmlStrdup', 'xmlCatalogResolve', 'xmlCatalogResolveURI', 'xmlNoNetExists', 'xmlCatalogLocalResolveURI']

34356 34913 xmlResolveResourceFromCatalog call site /src/libxml2/xmlIO.c:3910
4652 5533 5 :

['xmlSHRINK', 'xmlParseCommentComplex', 'xmlFatalErrMsgStr', 'xmlErrMemory', 'xmlGROW']

5193 6883 xmlParseComment call site /src/libxml2/parser.c:5029
3085 4245 11 :

['xmlNanoHTTPReturnCode', 'xmlFindCharEncodingHandler', 'xmlNanoHTTPRedir', 'xmlStrstr', 'xmlSwitchInputEncoding', 'xmlStrdup', '__xmlLoaderErr', 'xmlNanoHTTPMimeType', '__xmlErrEncoding', 'xmlNanoHTTPEncoding', 'xmlFreeInputStream']

3085 4245 xmlCheckHTTPInput call site /src/libxml2/xmlIO.c:3801
2968 5440 5 :

['xmlDictLookup', 'xmlPatScanName', 'xmlStrdup', 'xmlStrEqual', 'xmlCompileAttributeTest']

2968 5464 xmlCompileStepPattern call site /src/libxml2/pattern.c:1053
2170 2170 3 :

['xmlUnlinkNode', 'xmlFreeProp', 'xmlHasNsProp']

2170 2170 xmlAddChild call site /src/libxml2/tree.c:3475
2148 2148 1 :

['xmlBufMemoryError']

2148 2148 xmlBufGrowInternal call site /src/libxml2/buf.c:440
2079 2079 2 :

['xmlFreeNode', 'xmlNodeAddContent']

2079 2079 xmlAddChild call site /src/libxml2/tree.c:3468
1623 1623 2 :

['__xmlErrEncoding', 'xmlErrEncodingInt']

1623 4859 xmlNextChar call site /src/libxml2/parserInternals.c:432
1620 3891 5 :

['xmlNextChar', 'xmlBuildQName', 'xmlNsErr', 'xmlDictLookup', 'xmlParseName']

1620 3891 xmlParseQName call site /src/libxml2/parser.c:8903
1616 2173 3 :

['xmlNsWarnMsg', 'xmlSAX2ErrMemory', 'xmlNewNs']

2298 8177 xmlSAX2StartElementNs call site /src/libxml2/SAX2.c:2369
1563 1563 1 :

['xmlXPathNotEqualValues']

1563 2670 xmlXPathCompOpEval call site /src/libxml2/xpath.c:13008

Runtime coverage analysis

Covered functions
581
Functions that are reachable but not covered
126
Reachable functions
398
Percentage of reachable functions covered
68.34%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libxslt/tests/fuzz/xpath.c 1
libxslt/tests/fuzz/fuzz.c 2
libxml2/xpath.c 156
libxml2/xmlstring.c 10
libxml2/error.c 6
libxml2/parserInternals.c 6
libxml2/globals.c 11
libxml2/threads.c 11
libxml2/dict.c 12
libxml2/SAX2.c 6
libxml2/tree.c 21
libxml2/valid.c 20
libxml2/hash.c 14
libxml2/entities.c 11
libxml2/pattern.c 32
libxml2/chvalid.c 1
libxml2/parser.c 1
libxml2/xmlmemory.c 1
libxml2/encoding.c 6
libxml2/HTMLparser.c 3
libxml2/xmlIO.c 4
libxml2/list.c 3
libxml2/buf.c 9
libxml2/./timsort.h 12
libxslt/libxslt/extensions.c 9
libxslt/libxslt/xsltutils.c 2
libxslt/libxslt/imports.c 1
libxslt/libxslt/variables.c 1
libxslt/libxslt/keys.c 4

Fuzzer: xslt

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 4542 57.8%
gold [1:9] 406 5.17%
yellow [10:29] 198 2.52%
greenyellow [30:49] 207 2.63%
lawngreen 50+ 2499 31.8%
All colors 7852 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
18912 60140 14 :

['xmlBufDumpElementDecl', 'xmlOutputBufferWriteEscape', 'xmlNsDumpOutputCtxt', 'xmlOutputBufferWrite', 'xmlBufDumpAttributeDecl', 'xmlNsListDumpOutputCtxt', 'xmlBufDumpEntityDecl', '__xmlIndentTreeOutput', 'xmlDocContentDumpOutput', 'xmlOutputBufferWriteString', 'xmlDtdDumpOutput', 'xmlOutputBufferWriteWSNonSig', 'xmlNodeDumpOutputInternal', 'xmlAttrDumpOutput']

18912 60140 xmlNodeDumpOutputInternal call site /src/libxml2/xmlsave.c:1026
13372 18074 2 :

['xsltEvalAttrValueTemplate', 'xsltApplyAttributeSet']

13372 24802 xsltElement call site /src/libxslt/libxslt/transform.c:4220
13338 13450 4 :

['xsltParseStylesheetCallerParam', 'xsltDoSortFunction', 'xsltTransformError', 'xmlStrEqual']

14316 21570 xsltApplyTemplates call site /src/libxslt/libxslt/transform.c:4988
12555 12555 1 :

['xsltDocumentFunctionLoadDocument']

12555 14427 xsltDocumentFunction call site /src/libxslt/libxslt/functions.c:320
7898 11225 5 :

['xmlStrEqual', 'xsltTestStepMatch', 'xsltTestCompMatchDirect', 'xsltTestPredicateMatch', 'xsltPatPushState']

7898 11225 xsltTestCompMatch call site /src/libxslt/libxslt/pattern.c:1116
6686 6686 1 :

['xsltApplyAttributeSet']

6686 13414 xsltCopy call site /src/libxslt/libxslt/transform.c:3944
5279 14373 4 :

['xmlParsePEReference', 'xmlPopInput', 'xmlParseMarkupDecl', 'xmlParseConditionalSections']

5279 23259 xmlParseInternalSubset call site /src/libxml2/parser.c:8454
4958 4958 1 :

['xsltTestCompMatchList']

4958 4958 xsltTestCompMatchCount call site /src/libxslt/libxslt/numbers.c:565
4702 4702 1 :

['xsltEvalUserParams']

5693 27826 xsltApplyStylesheetInternal call site /src/libxslt/libxslt/transform.c:6009
3642 8336 11 :

['strlen', 'xmlNanoHTTPConnectHost', '__xmlIOErr', 'xmlNanoHTTPBypassProxy', 'xmlNanoHTTPReadLine', 'xmlNanoHTTPScanAnswer', 'strcmp', 'xmlNanoHTTPRecv', 'xmlNanoHTTPNewCtxt', 'xmlHTTPErrMemory', 'xmlNanoHTTPSend']

3642 8438 xmlNanoHTTPMethodRedir call site /src/libxml2/nanohttp.c:1435
3105 7721 8 :

['xmlStaticCopyNode', 'xmlCopyPropList', 'xmlSearchNs', 'xmlNewNs', 'xmlFreeNode', 'xmlCopyNamespaceList', 'xmlNewReconciledNs', 'xmlGetDocEntity']

4177 8793 xmlStaticCopyNode call site /src/libxml2/tree.c:4350
3091 3091 1 :

['xhtmlNodeDumpOutput']

3091 3091 xmlNodeDumpOutput call site /src/libxml2/xmlsave.c:2300

Runtime coverage analysis

Covered functions
965
Functions that are reachable but not covered
463
Reachable functions
1343
Percentage of reachable functions covered
65.52%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libxslt/tests/fuzz/xslt.c 1
libxslt/tests/fuzz/fuzz.c 1
libxml2/parser.c 120
libxml2/threads.c 14
libxml2/globals.c 24
libxml2/xmlmemory.c 1
libxml2/dict.c 14
libxml2/encoding.c 18
libxml2/error.c 12
libxml2/SAX2.c 39
libxml2/xmlstring.c 22
libxml2/parserInternals.c 23
libxml2/tree.c 110
libxml2/valid.c 56
libxml2/hash.c 24
libxml2/entities.c 21
libxml2/HTMLparser.c 8
libxml2/xmlIO.c 31
libxml2/xpath.c 195
libxml2/buf.c 24
libxml2/list.c 8
libxml2/uri.c 34
libxml2/chvalid.c 1
libxml2/catalog.c 11
libxslt/libxslt/xslt.c 35
libxslt/libxslt/xsltutils.c 20
libxslt/libxslt/extra.c 3
libxslt/libxslt/extensions.c 35
libxml2/debugXML.c 27
libxslt/libxslt/preproc.c 29
libxslt/libxslt/templates.c 8
libxslt/libxslt/transform.c 54
libxml2/pattern.c 32
libxml2/./timsort.h 12
libxslt/libxslt/security.c 7
libxslt/libxslt/imports.c 7
libxslt/libxslt/variables.c 32
libxslt/libxslt/keys.c 16
libxslt/libxslt/namespaces.c 5
libxslt/libxslt/attributes.c 20
libxslt/libxslt/attrvt.c 6
libxml2/HTMLtree.c 9
libxml2/xmlsave.c 26
libxslt/libxslt/pattern.c 31
libxslt/libxslt/xsltlocale.c 3
libxslt/libxslt/documents.c 7
libxslt/libxslt/functions.c 12
libxml2/xinclude.c 26
libxml2/xpointer.c 10
libxslt/libxslt/numbers.c 15

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name Functions filename Arg count Args Function depth hitcount instr count bb count cyclomatic complexity Reachable functions Incoming references total cyclomatic complexity Unreached complexity
LLVMFuzzerInitialize /src/libxslt/tests/fuzz/xpath.c 2 ['int *', 'char ***'] 27 0 20 3 2 1512 0 20025 1959
xmlShell /src/libxml2/debugXML.c 4 ['struct._xmlDoc *', 'char *', 'func_type *', 'struct._IO_FILE *'] 32 0 2131 294 84 1008 0 14831 1608
xmlDefaultExternalEntityLoader /src/libxml2/xmlIO.c 3 ['char *', 'char *', 'struct._xmlParserCtxt *'] 29 0 142 22 9 605 2 8754 415
xmlDOMWrapAdoptNode /src/libxml2/tree.c 6 ['struct._xmlDOMWrapCtxt *', 'struct._xmlDoc *', 'struct._xmlNode *', 'struct._xmlDoc *', 'struct._xmlNode *', 'int '] 25 0 766 145 49 100 0 1076 348
xmlNanoHTTPFetch /src/libxml2/nanohttp.c 3 ['char *', 'char *', 'char **'] 35 0 142 24 10 138 0 1479 311
xmlParseSGMLCatalog /src/libxml2/catalog.c 4 ['struct._xmlCatalog *', 'char *', 'char *', 'int '] 30 0 1110 234 79 124 6 1866 254
htmlParseContent /src/libxml2/HTMLparser.c 1 ['struct._xmlParserCtxt *'] 30 0 917 154 58 201 2 2370 144

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers
77.14%
1775/2301
Cyclomatic complexity statically reachable by fuzzers
86.74%
24023 / 27696

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Runtime coverage analysis

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name Function total lines Lines covered at runtime percentage covered Reached by fuzzers
xmlSAX2AttributeNs 94 51 54.25% ['xslt']
xmlBufResize 94 48 51.06% ['xpath', 'xslt']
xmlBufGrowInternal 48 26 54.16% ['xslt']
xmlGetCharEncodingHandler 109 12 11.00% ['xslt']
xmlParseReference 263 104 39.54% ['xslt']
areBlanks 32 5 15.62% ['xslt']
xmlParseAttValueInternal 133 54 40.60% ['xslt']
xmlCtxtGrowAttrs 31 17 54.83% ['xslt']
nsPush 37 20 54.05% ['xslt']
xmlCtxtUseOptionsInternal 116 51 43.96% ['xslt']
xmlInitSAXParserCtxt 170 93 54.70% ['xslt']
xmlSetTreeDoc 32 14 43.75% ['xslt']
xmlAddChild 80 36 45.0% ['xslt']
xmlNodeGetBase 69 30 43.47% ['xslt']
xmlBufGetNodeContent 109 59 54.12% ['xpath', 'xslt']
xmlNodeGetContent 79 39 49.36% ['xpath', 'xslt']
xmlBufferResize 89 41 46.06% ['xslt']
xmlNewPropInternal 65 33 50.76% ['xslt']
xmlSaveUri 256 129 50.39% ['xslt']
xmlCheckHTTPInput 54 9 16.66% []
xmlXPathErr 44 24 54.54% ['xpath', 'xslt']
xmlXPathNodeSetAddNs 41 22 53.65% ['xpath', 'xslt']
xmlXPathCompareValues 97 52 53.60% ['xpath', 'xslt']
xmlXPathNextAncestor 92 31 33.69% ['xpath', 'xslt']
xmlXPathErrMemory 32 15 46.87% ['xpath', 'xslt']
xmlPointerListAddSize 31 17 54.83% ['xpath', 'xslt']
xmlXPathEqualNodeSets 90 17 18.88% ['xpath', 'xslt']
xmlXPathEqualValuesCommon 143 37 25.87% ['xpath', 'xslt']
xmlXPathCompareNodeSets 67 18 26.86% ['xpath', 'xslt']
xmlXPtrEvalChildSeq 31 16 51.61% ['xslt']
xmlXPtrEvalXPtrPart 115 45 39.13% ['xslt']
exsltCryptoRc4DecryptFunction 81 43 53.08% []
exsltStrEncodeUriFunction 32 14 43.75% []
xsltLoadDocument 39 15 38.46% ['xslt']
xsltFormatNumberConversion 326 176 53.98% ['xslt']
xsltCheckRead 38 20 52.63% ['xslt']
xsltFreeRVTs 38 18 47.36% ['xpath', 'xslt']
xsltGetUTF8Char 49 12 24.48% ['xslt']
htmlSetMetaEncoding 105 23 21.90% ['xslt']
htmlNodeDumpFormatOutput 186 88 47.31% ['xslt']
xmlSAX2ExternalSubset 73 6 8.219% ['xslt']
xmlSAX2GetEntity 32 14 43.75% ['xslt']
xmlSAX2EntityDecl 44 11 25.0% ['xslt']
xmlSAX2AttributeDecl 37 19 51.35% ['xslt']
xmlBufWriteQuotedString 39 13 33.33% ['xslt']
xmlParseCatalogFile 46 13 28.26% []
xmlCatalogNormalizePublic 37 8 21.62% ['xslt']
xmlCatalogListXMLResolve 72 22 30.55% []
xmlFetchXMLCatalogFile 52 14 26.92% []
xmlParseXMLCatalogFile 52 11 21.15% []
xmlCatalogListXMLResolveURI 37 12 32.43% []
xmlDictAddQString 43 20 46.51% ['xslt']
UTF16LEToUTF8 68 34 50.0% []
xmlAddEntity 72 35 48.61% ['xslt']
xmlEncodeEntitiesInternal 149 54 36.24% ['xpath', 'xslt']
xmlReportError 172 84 48.83% ['xpath', 'xslt']
xmlNanoHTTPMethodRedir 154 29 18.83% []
xmlNanoHTTPScanURL 46 21 45.65% []
xmlNanoHTTPConnectHost 53 21 39.62% []
xmlStringLenDecodeEntities 153 76 49.67% ['xslt']
xmlParseNotationType 52 23 44.23% ['xslt']
xmlParsePEReference 92 45 48.91% ['xslt']
xmlParseEncodingDecl 77 38 49.35% ['xslt']
xmlParseSDDecl 50 6 12.0% ['xslt']
xmlParseCatalogPI 40 19 47.5% ['xslt']
xmlParseElementChildrenContentDeclPriv 243 109 44.85% ['xslt']
xmlSwitchEncoding 88 30 34.09% ['xslt']
xmlNewEntityInputStream 52 15 28.84% ['xslt']
xmlCreateIntSubset 82 31 37.80% ['xslt']
xmlStringGetNodeList 152 36 23.68% ['xslt']
xmlNewDocProp 33 14 42.42% ['xslt']
xmlAddNextSibling 43 19 44.18% ['xslt']
xmlAddPrevSibling 44 20 45.45% ['xslt']
xmlStaticCopyNode 147 43 29.25% ['xslt']
xmlNodeSetContent 52 23 44.23% ['xslt']
xmlNodeAddContentLen 55 22 40.0% ['xslt']
xmlFreeAttribute 32 16 50.0% ['xpath', 'xslt']
__xmlIOErr 164 81 49.39% ['xslt']
xmlAllocOutputBuffer 31 17 54.83% ['xslt']
xmlOutputBufferWrite 71 27 38.02% ['xslt']
xmlOutputBufferWriteEscape 90 40 44.44% ['xslt']
xmlOutputBufferFlush 38 13 34.21% ['xslt']
xmlNodeDumpOutputInternal 222 64 28.82% ['xslt']
xmlXPathCmpNodes 106 53 50.0% ['xslt']
xmlXPathObjectCopy 33 14 42.42% ['xpath', 'xslt']
xmlXPathNodeValHash 92 26 28.26% ['xpath', 'xslt']
xmlXPathEqualNodeSetString 36 16 44.44% ['xpath', 'xslt']
xmlXPathCompOpEvalLast 109 33 30.27% ['xpath', 'xslt']
xmlXPathNameFunction 50 14 28.00% []
xsltResolveAttrSet 41 12 29.26% ['xslt']
xsltLoadStyleDocument 32 14 43.75% ['xslt']
xsltSystemPropertyFunction 74 11 14.86% ['xslt']
xsltNamespaceAlias 75 36 48.0% ['xslt']
xsltNumberFormatInsertNumbers 69 37 53.62% ['xslt']
xsltTestCompMatch 147 53 36.05% ['xslt']
xsltTestStepMatch 122 26 21.31% ['xslt']
xsltValueOfComp 41 20 48.78% ['xslt']
xsltAttributeComp 59 30 50.84% ['xslt']
xsltCheckWritePath 39 13 33.33% ['xslt']
xsltAttrListTemplateProcess 134 73 54.47% ['xslt']
xsltCopyTextString 57 19 33.33% ['xslt']
xsltDocumentElem 396 58 14.64% ['xslt']
xsltCopy 53 22 41.50% ['xslt']
xsltElement 120 40 33.33% ['xslt']
xsltValueOf 38 19 50.0% ['xslt']
xsltApplyTemplates 165 64 38.78% ['xslt']
xsltApplyXSLTTemplate 85 39 45.88% ['xslt']
xsltApplySequenceConstructor 219 116 52.96% ['xslt']
xsltShallowCopyElem 42 19 45.23% ['xslt']
xsltApplyStylesheetInternal 261 130 49.80% ['xslt']
xsltEvalGlobalVariables 35 13 37.14% ['xslt']
xsltParseStylesheetProcess 61 22 36.06% ['xslt']
exclPrefixPush 31 15 48.38% ['xslt']
xsltParseStylesheetExtPrefix 43 11 25.58% ['xslt']
xsltGatherNamespaces 58 7 12.06% ['xslt']
xsltDefaultRegion 132 43 32.57% ['xslt']
xsltGetQNameURI2 48 12 25.0% ['xslt']
xsltSaveResultTo 139 75 53.95% ['xslt']

Files and Directories in report

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file Reached by Covered by
/src/libxslt/tests/fuzz/xpath.c ['xpath'] ['xpath']
[] []
/src/libxslt/libexslt/math.c [] []
/src/libxml2/globals.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/debugXML.c ['xslt'] []
/src/libxslt/libxslt/functions.c ['xslt'] ['xslt']
/src/libxml2/threads.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/catalog.c ['xslt'] ['xslt']
/src/libxslt/libxslt/extensions.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libxslt/attributes.c ['xslt'] ['xslt']
/src/libxslt/libexslt/exslt.c [] []
/src/libxml2/./timsort.h ['xpath', 'xslt'] []
/src/libxslt/libexslt/strings.c [] []
/src/libxml2/SAX2.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/xmlsave.c ['xslt'] ['xslt']
/src/libxml2/xpointer.c ['xslt'] []
/src/libxslt/libxslt/transform.c ['xslt'] ['xslt']
/src/libxml2/xpath.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libexslt/date.c [] []
/src/libxslt/libexslt/crypto.c [] []
/src/libxslt/libxslt/xslt.c ['xslt'] ['xslt']
/src/libxslt/libxslt/pattern.c ['xslt'] ['xslt']
/src/libxml2/parserInternals.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/tree.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libxslt/attrvt.c ['xslt'] ['xslt']
/src/libxslt/libexslt/saxon.c [] []
/src/libxslt/libxslt/numbers.c ['xslt'] ['xslt']
/src/libxml2/HTMLparser.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/xmlstring.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/pattern.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/xmlmemory.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/HTMLtree.c ['xslt'] ['xslt']
/src/libxml2/chvalid.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/list.c ['xpath', 'xslt'] []
/src/libxml2/valid.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/error.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/hash.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libexslt/common.c [] []
/src/libxslt/libxslt/xsltutils.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libxslt/imports.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxml2/xinclude.c ['xslt'] []
/src/libxml2/uri.c ['xslt'] ['xslt']
/src/libxml2/parser.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libxslt/extra.c ['xslt'] ['xslt']
/src/libxslt/libxslt/keys.c ['xpath', 'xslt'] ['xslt']
/src/libxslt/libxslt/preproc.c ['xslt'] ['xslt']
/src/libxml2/entities.c ['xpath', 'xslt'] ['xslt']
/src/libxml2/encoding.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libexslt/functions.c [] []
/src/libxslt/tests/fuzz/fuzz.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libexslt/dynamic.c [] []
/src/libxml2/buf.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libxslt/documents.c ['xslt'] ['xslt']
/src/libxml2/dict.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libxslt/namespaces.c ['xslt'] ['xslt']
/src/libxslt/libxslt/xsltlocale.c ['xslt'] ['xslt']
/src/libxslt/libexslt/sets.c [] []
/src/libxml2/nanohttp.c [] []
/src/libxslt/tests/fuzz/xslt.c ['xslt'] ['xslt']
/src/libxml2/xmlIO.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libxslt/variables.c ['xpath', 'xslt'] ['xpath', 'xslt']
/src/libxslt/libxslt/templates.c ['xslt'] ['xslt']
/src/libxslt/libxslt/security.c ['xslt'] ['xslt']

Directories in report

Directory
/src/libxslt/tests/fuzz/
/src/libxslt/libxslt/
/src/libxml2/
/src/libxslt/libexslt/
/src/libxml2/./

Metadata section

This sections shows the raw data that is used to produce this report. This is mainly used for further processing and developer debugging.

Fuzzer Calltree file Program data file Coverage file
xpath fuzzerLogFile-0-uEtbxLJvZA.data fuzzerLogFile-0-uEtbxLJvZA.data.yaml xpath.covreport
xslt fuzzerLogFile-0-9T5Sxm5nvk.data fuzzerLogFile-0-9T5Sxm5nvk.data.yaml xslt.covreport