High level conclusions

Fuzzers reach 63.84% of cyclomatic complexity.

Fuzzers reach 55.45% of all functions.

Fuzzer libevtx_file_fuzzer is blocked:

The runtime code coverage of libevtx_file_fuzzer covers 14.43% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer libmsiecf_item_fuzzer is blocked:

The runtime code coverage of libmsiecf_item_fuzzer covers 23.07% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer libewf_handle_fuzzer is blocked:

The runtime code coverage of libewf_handle_fuzzer covers 28.08% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer libfwevt_xml_document_fuzzer is blocked:

The runtime code coverage of libfwevt_xml_document_fuzzer covers 22.51% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer libfvde_volume_fuzzer is blocked:

The runtime code coverage of libfvde_volume_fuzzer covers 27.79% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer libfwsi_item_fuzzer is blocked:

The runtime code coverage of libfwsi_item_fuzzer covers 12.19% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer libfwsi_item_list_fuzzer is blocked:

The runtime code coverage of libfwsi_item_list_fuzzer covers 9.523% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

4233 / 7633

Cyclomatic complexity statically reachable by fuzzers

50320 / 78819

Runtime code coverage of functions

3095 / 7633

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: libcaes_crypt_xts_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	74	80.4%
gold	[1:9]	2	2.17%
yellow	[10:29]	2	2.17%
greenyellow	[30:49]	2	2.17%
lawngreen	50+	12	13.0%
All colors	92	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
85	85	1 : View List ['libcaes_internal_context_set_decryption_key']	85	117	libcaes_context_set_key	call site: 00033	/src/libcaes/libcaes/libcaes_context.c:585
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	68	3 : View List ['free', 'libcaes_context_free', 'libcerror_error_set']	0	68	libcaes_tweaked_context_initialize	call site: 00022	/src/libcaes/libcaes/libcaes_tweaked_context.c:155
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcaes_context_initialize	call site: 00018	/src/libcaes/libcaes/libcaes_context.c:360
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_context_free	call site: 00024	/src/libcaes/libcaes/libcaes_context.c:406
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_context_set_key	call site: 00034	/src/libcaes/libcaes/libcaes_context.c:587
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_initialize_tables	call site: 00018	/src/libcaes/libcaes/libcaes_context.c:644
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_internal_context_set_encryption_key	call site: 00036	/src/libcaes/libcaes/libcaes_context.c:1064
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_tweaked_context_free	call site: 00090	/src/libcaes/libcaes/libcaes_tweaked_context.c:275
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_tweaked_context_set_keys	call site: 00052	/src/libcaes/libcaes/libcaes_tweaked_context.c:435
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_crypt_xts	call site: 00084	/src/libcaes/libcaes/libcaes_tweaked_context.c:1244
0	0	None	0	356	libcaes_crypt_xts	call site: 00075	/src/libcaes/libcaes/libcaes_tweaked_context.c:981

Runtime coverage analysis

Covered functions

12

Functions that are reachable but not covered

6

Reachable functions

18

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libcaes/ossfuzz/crypt_xts_fuzzer.cc	1
libcaes/libcaes/libcaes_tweaked_context.c	4
libcaes/libcerror/libcerror_error.c	3
libcaes/libcaes/libcaes_context.c	7

Fuzzer: libfplist_property_list_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	167	75.9%
gold	[1:9]	4	1.81%
yellow	[10:29]	3	1.36%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	46	20.9%
All colors	220	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
85	85	8 : View List ['getc', 'fread', 'ferror', '__errno_location', 'libfplist_xml_scanner_realloc', 'yy_fatal_error', 'libfplist_xml_scanner_restart', 'clearerr']	85	85	yy_get_next_buffer	call site: 00057	/src/libfplist/libfplist/libfplist_xml_scanner.c:158629
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfplist_xml_tag_initialize	call site: 00099	/src/libfplist/libfplist/libfplist_xml_tag.c:169
0	70	2 : View List ['libfplist_xml_attribute_free', 'libcerror_error_set']	0	70	libfplist_xml_tag_append_attribute	call site: 00159	/src/libfplist/libfplist/libfplist_xml_tag.c:598
0	68	1 : View List ['libfplist_xml_tag_free']	0	68	libfplist_property_list_copy_from_byte_stream	call site: 00215	/src/libfplist/libfplist/libfplist_property_list.c:490
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00123	/src/libfplist/libcdata/libcdata_array.c:823
0	38	1 : View List ['libfplist_xml_attribute_free']	0	38	libfplist_xml_tag_append_attribute	call site: 00160	/src/libfplist/libfplist/libfplist_xml_tag.c:616
0	32	1 : View List ['libcerror_error_set']	0	135	libfplist_xml_parser_parse_buffer	call site: 00167	/src/libfplist/libfplist/libfplist_xml_parser.c:463
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00096	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00103	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_internal_array_resize	call site: 00122	/src/libfplist/libcdata/libcdata_array.c:797
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_get_number_of_entries	call site: 00200	/src/libfplist/libcdata/libcdata_array.c:1052

Runtime coverage analysis

Covered functions

41

Functions that are reachable but not covered

21

Reachable functions

62

Percentage of reachable functions covered

66.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfplist/ossfuzz/property_list_fuzzer.cc	1
libfplist/libfplist/libfplist_property_list.c	4
libfplist/libcerror/libcerror_error.c	3
libfplist/libfplist/libfplist_xml_parser.c	3
libfplist/libfplist/libfplist_xml_scanner.c	17
libfplist/libfplist/libfplist_xml_scanner.l	5
libfplist/libfplist/libfplist_xml_tag.c	8
libfplist/libcdata/libcdata_array.c	7
libfplist/libfplist/libfplist_xml_attribute.c	2

Fuzzer: libhmac_md5_context_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	41	83.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	8	16.3%
All colors	49	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	68	2 : View List ['libhmac_md5_context_free', 'libcerror_error_set']	32	68	libhmac_md5_calculate	call site: 00045	/src/libhmac/libhmac/libhmac_md5.c:196
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_md5_context_transform	call site: 00027	/src/libhmac/libhmac/libhmac_md5_context.c:388
32	32	2 : View List ['free', 'libcerror_error_set']	32	32	libhmac_md5_context_initialize	call site: 00013	/src/libhmac/libhmac/libhmac_md5_context.c:560
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_md5_context_free	call site: 00045	/src/libhmac/libhmac/libhmac_md5_context.c:599
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_md5_context_update	call site: 00032	/src/libhmac/libhmac/libhmac_md5_context.c:955
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_md5_context_finalize	call site: 00042	/src/libhmac/libhmac/libhmac_md5_context.c:1274
0	0	None	192	274	libhmac_md5_context_update	call site: 00019	/src/libhmac/libhmac/libhmac_md5_context.c:856
0	0	None	32	68	libhmac_md5_calculate	call site: 00002	/src/libhmac/libhmac/libhmac_md5.c:153
0	0	None	32	68	libhmac_md5_calculate	call site: 00016	/src/libhmac/libhmac/libhmac_md5.c:166
0	0	None	32	68	libhmac_md5_calculate	call site: 00035	/src/libhmac/libhmac/libhmac_md5.c:181
0	0	None	32	32	libhmac_md5_context_transform	call site: 00022	/src/libhmac/libhmac/libhmac_md5_context.c:235
0	0	None	32	32	libhmac_md5_context_transform	call site: 00023	/src/libhmac/libhmac/libhmac_md5_context.c:246

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

6

Reachable functions

13

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libhmac/ossfuzz/md5_context_fuzzer.cc	1
libhmac/libhmac/libhmac_md5.c	1
libhmac/libhmac/libhmac_md5_context.c	5
libhmac/libcerror/libcerror_error.c	3

Fuzzer: libwrc_message_table_resource_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	56	74.6%
gold	[1:9]	1	1.33%
yellow	[10:29]	3	4.0%
greenyellow	[30:49]	1	1.33%
lawngreen	50+	14	18.6%
All colors	75	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00058	/src/libfplist/libcdata/libcdata_array.c:823
0	37	1 : View List ['libwrc_table_entry_free']	0	37	libwrc_message_table_resource_read	call site: 00062	/src/libwrc/libwrc/libwrc_message_table_resource.c:537
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00021	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00069	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_internal_array_resize	call site: 00057	/src/libfplist/libcdata/libcdata_array.c:797
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_append_entry	call site: 00051	/src/libfplist/libcdata/libcdata_array.c:1609
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libwrc_message_table_resource_initialize	call site: 00013	/src/libwrc/libwrc/libwrc_message_table_resource.c:101
0	32	1 : View List ['libcerror_error_set']	0	32	libwrc_message_table_resource_free	call site: 00073	/src/libwrc/libwrc/libwrc_message_table_resource.c:155
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libwrc_table_entry_initialize	call site: 00036	/src/libwrc/libwrc/libwrc_table_entry.c:76
0	32	1 : View List ['libcerror_error_set']	0	32	libwrc_table_entry_free	call site: 00063	/src/libwrc/libwrc/libwrc_table_entry.c:112
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libwrc_table_entry_set_string	call site: 00044	/src/libwrc/libwrc/libwrc_table_entry.c:211

Runtime coverage analysis

Covered functions

13

Functions that are reachable but not covered

5

Reachable functions

18

Percentage of reachable functions covered

72.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libwrc/ossfuzz/message_table_resource_fuzzer.cc	1
libwrc/libwrc/libwrc_message_table_resource.c	3
libwrc/libcerror/libcerror_error.c	3
libwrc/libcdata/libcdata_array.c	5
libwrc/libwrc/libwrc_table_entry.c	3

Fuzzer: libqcow_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	544	80.4%
gold	[1:9]	7	1.03%
yellow	[10:29]	2	0.29%
greenyellow	[30:49]	28	4.14%
lawngreen	50+	95	14.0%
All colors	676	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00174	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00591	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00622	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00553	/src/libqcow/libfdata/libfdata_segments_array.c:592
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
2	2	1 : View List ['realloc']	2	98	libcdata_internal_array_resize	call site: 00541	/src/libfplist/libcdata/libcdata_array.c:753
0	463	7 : View List ['free', 'libfcache_cache_free', 'libqcow_cluster_table_free', 'libfdata_vector_free', 'libqcow_encryption_free', 'libcerror_error_set', 'libqcow_file_header_free']	0	463	libqcow_internal_file_open_read	call site: 00585	/src/libqcow/libqcow/libqcow_file.c:1630
0	255	1 : View List ['libqcow_file_close']	0	491	libqcow_file_free	call site: 00664	/src/libqcow/libqcow/libqcow_file.c:198
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00421	/src/libqcow/libfdata/libfdata_vector.c:180
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	1080	libqcow_file_close	call site: 00636	/src/libqcow/libqcow/libqcow_file.c:897

Runtime coverage analysis

Covered functions

76

Functions that are reachable but not covered

65

Reachable functions

141

Percentage of reachable functions covered

53.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libqcow/ossfuzz/file_fuzzer.cc	1
libqcow/libbfio/libbfio_memory_range.c	2
libqcow/libcerror/libcerror_error.c	3
libqcow/libbfio/libbfio_memory_range_io_handle.c	3
libqcow/libbfio/libbfio_handle.c	9
libqcow/libcdata/libcdata_range_list.c	15
libqcow/libcdata/libcdata_list_element.c	10
libqcow/libcdata/libcdata_range_list_value.c	3
libqcow/libqcow/libqcow_file.c	6
libqcow/libqcow/libqcow_io_handle.c	5
libqcow/libqcow/libqcow_i18n.c	1
libqcow/libcthreads/libcthreads_read_write_lock.c	4
libqcow/libcerror/libcerror_system.c	2
libqcow/libqcow/libqcow_file_header.c	4
libqcow/libqcow/libqcow_encryption.c	3
libqcow/libcaes/libcaes_context.c	6
libqcow/libqcow/libqcow_cluster_table.c	3
libqcow/libfdata/libfdata_vector.c	4
libqcow/libcdata/libcdata_array.c	8
libqcow/libfcache/libfcache_date_time.c	1
libqcow/libfdata/libfdata_segments_array.c	2
libqcow/libfdata/libfdata_range.c	4
libqcow/libfcache/libfcache_cache.c	3
libqcow/libcdata/libcdata_list.c	7
libqcow/libfcache/libfcache_cache_value.c	6
libqcow/libfdata/libfdata_mapped_range.c	3
libqcow/libqcow/libqcow_cluster_block.c	3

Fuzzer: libfwsi_item_list_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	313	96.9%
gold	[1:9]	1	0.30%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	8	2.47%
lawngreen	50+	1	0.30%
All colors	323	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1067	1067	5 : View List ['libfwsi_item_copy_from_byte_stream', 'libfwsi_item_set_parent_item', 'libfwsi_internal_item_free', 'libcdata_array_append_entry', 'libfwsi_internal_item_initialize']	1067	1259	libfwsi_item_list_copy_from_byte_stream	call site: 00026	/src/libfwsi/libfwsi/libfwsi_item_list.c:234
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00019	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00312	/src/libfplist/libcdata/libcdata_array.c:260
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwsi_item_list_initialize	call site: 00013	/src/libfwsi/libfwsi/libfwsi_item_list.c:96
0	32	1 : View List ['libcerror_error_set']	0	32	libfwsi_item_list_free	call site: 00322	/src/libfwsi/libfwsi/libfwsi_item_list.c:150
0	0	None	0	128	libcdata_array_initialize	call site: 00016	/src/libfplist/libcdata/libcdata_array.c:112
0	0	None	0	32	libcdata_array_initialize	call site: 00013	/src/libfplist/libcdata/libcdata_array.c:46
0	0	None	0	32	libcdata_array_initialize	call site: 00013	/src/libfplist/libcdata/libcdata_array.c:57
0	0	None	0	32	libcdata_array_initialize	call site: 00013	/src/libfplist/libcdata/libcdata_array.c:68
0	0	None	0	32	libcdata_array_initialize	call site: 00014	/src/libfplist/libcdata/libcdata_array.c:82
0	0	None	0	32	libcdata_array_initialize	call site: 00015	/src/libfplist/libcdata/libcdata_array.c:93

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

76

Reachable functions

84

Percentage of reachable functions covered

9.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwsi/ossfuzz/item_list_fuzzer.cc	1
libfwsi/libfwsi/libfwsi_item_list.c	3
libfwsi/libcerror/libcerror_error.c	3
libfwsi/libcdata/libcdata_array.c	5
libfwsi/libfwsi/libfwsi_item.c	5
libfwsi/libfwsi/libfwsi_uri_sub_values.c	2
libfwsi/libfwsi/libfwsi_cdburn_values.c	2
libfwsi/libfwsi/libfwsi_compressed_folder_values.c	2
libfwsi/libfwsi/libfwsi_control_panel_item_values.c	2
libfwsi/libfwsi/libfwsi_control_panel_category_values.c	2
libfwsi/libfwsi/libfwsi_control_panel_cpl_file_values.c	2
libfwsi/libfwsi/libfwsi_delegate_values.c	2
libfwsi/libfwsi/libfwsi_file_entry_values.c	2
libfwsi/libfwsi/libfwsi_game_folder_values.c	2
libfwsi/libfwsi/libfwsi_mtp_file_entry_values.c	2
libfwsi/libfwsi/libfwsi_mtp_volume_values.c	2
libfwsi/libfwsi/libfwsi_network_location_values.c	2
libfwsi/libfwsi/libfwsi_root_folder_values.c	2
libfwsi/libfwsi/libfwsi_uri_values.c	2
libfwsi/libfwsi/libfwsi_users_files_folder_values.c	2
libfwsi/libfwsi/libfwsi_users_property_view_values.c	2
libfwsi/libfwsi/libfwsi_volume_values.c	2
libfwsi/libfwsi/libfwsi_extension_block.c	3
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0000_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0001_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0003_values.c	2
libfwsi/libfwsi/libfwsi_file_entry_extension_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0005_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0006_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef000a_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0013_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0014_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0019_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0025_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0026_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0029_values.c	2

Fuzzer: libvshadow_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	472	73.2%
gold	[1:9]	10	1.55%
yellow	[10:29]	2	0.31%
greenyellow	[30:49]	12	1.86%
lawngreen	50+	148	22.9%
All colors	644	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00219	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00143	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00510	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	298	3 : View List ['libvshadow_block_tree_free', 'libcerror_error_set', 'libvshadow_store_descriptor_free']	0	298	libvshadow_io_handle_read_catalog	call site: 00549	/src/libvshadow/libvshadow/libvshadow_io_handle.c:897
0	253	1 : View List ['libvshadow_volume_close']	0	530	libvshadow_volume_free	call site: 00634	/src/libvshadow/libvshadow/libvshadow_volume.c:193
0	182	4 : View List ['free', 'libcdata_list_free', 'libcerror_error_set', 'libcdata_range_list_free']	0	182	libvshadow_store_descriptor_initialize	call site: 00488	/src/libvshadow/libvshadow/libvshadow_store_descriptor.c:150
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	112	2 : View List ['libcdata_array_get_entry_by_index', 'libvshadow_block_tree_node_free']	0	254	libvshadow_block_tree_node_free	call site: 00118	/src/libvshadow/libvshadow/libvshadow_block_tree_node.c:203
0	105	2 : View List ['libcerror_error_set', 'libvshadow_block_tree_node_free']	0	105	libvshadow_block_tree_insert_block_descriptor_by_offset	call site: 00458	/src/libvshadow/libvshadow/libvshadow_block_tree.c:440
0	104	2 : View List ['libcerror_error_set', 'libvshadow_ntfs_volume_header_free']	0	104	libvshadow_volume_open_read_ntfs_volume_headers	call site: 00390	/src/libvshadow/libvshadow/libvshadow_volume.c:1304

Runtime coverage analysis

Covered functions

79

Functions that are reachable but not covered

44

Reachable functions

123

Percentage of reachable functions covered

64.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvshadow/ossfuzz/volume_fuzzer.cc	1
libvshadow/libbfio/libbfio_memory_range.c	2
libvshadow/libcerror/libcerror_error.c	3
libvshadow/libbfio/libbfio_memory_range_io_handle.c	3
libvshadow/libbfio/libbfio_handle.c	9
libvshadow/libcdata/libcdata_range_list.c	15
libvshadow/libcdata/libcdata_list_element.c	10
libvshadow/libcdata/libcdata_range_list_value.c	3
libvshadow/libvshadow/libvshadow_volume.c	6
libvshadow/libcdata/libcdata_array.c	10
libvshadow/libvshadow/libvshadow_io_handle.c	8
libvshadow/libcthreads/libcthreads_read_write_lock.c	4
libvshadow/libcerror/libcerror_system.c	2
libvshadow/libvshadow/libvshadow_store_descriptor.c	6
libvshadow/libvshadow/libvshadow_block_tree.c	3
libvshadow/libvshadow/libvshadow_block_tree_node.c	6
libvshadow/libvshadow/libvshadow_block_descriptor.c	3
libvshadow/libcdata/libcdata_list.c	3
libvshadow/libvshadow/libvshadow_ntfs_volume_header.c	4
libvshadow/libvshadow/libvshadow_store_block.c	4

Fuzzer: libfsfat_file_entry_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	567	71.6%
gold	[1:9]	20	2.52%
yellow	[10:29]	8	1.01%
greenyellow	[30:49]	3	0.37%
lawngreen	50+	193	24.3%
All colors	791	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
653	653	1 : View List ['libfsfat_internal_file_entry_get_directory']	653	1153	libfsfat_internal_file_entry_get_sub_file_entry_by_index	call site: 00723	/src/libfsfat/libfsfat/libfsfat_file_entry.c:1290
653	653	1 : View List ['libfsfat_internal_file_entry_get_directory']	653	857	libfsfat_file_entry_get_number_of_sub_file_entries	call site: 00696	/src/libfsfat/libfsfat/libfsfat_file_entry.c:1190
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00152	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00344	/src/libqcow/libcdata/libcdata_list.c:238
64	64	1 : View List ['libfdata_stream_free']	64	174	libfsfat_file_entry_free	call site: 00674	/src/libfsfat/libfsfat/libfsfat_file_entry.c:315
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00711	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00624	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	259	5 : View List ['libfsfat_directory_free', 'libfsfat_directory_entry_free', 'libfsfat_block_tree_free', 'libcdata_array_free', 'libcerror_error_set']	0	259	libfsfat_file_system_read_directory	call site: 00591	/src/libfsfat/libfsfat/libfsfat_file_system.c:1082
0	245	1 : View List ['libfsfat_volume_close']	0	444	libfsfat_volume_free	call site: 00784	/src/libfsfat/libfsfat/libfsfat_volume.c:175
0	227	3 : View List ['libfsfat_file_system_free', 'libfsfat_boot_record_free', 'libcerror_error_set']	0	227	libfsfat_internal_volume_open_read	call site: 00600	/src/libfsfat/libfsfat/libfsfat_volume.c:1101

Runtime coverage analysis

Covered functions

103

Functions that are reachable but not covered

49

Reachable functions

152

Percentage of reachable functions covered

67.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsfat/ossfuzz/file_entry_fuzzer.cc	1
libfsfat/libbfio/libbfio_memory_range.c	2
libfsfat/libcerror/libcerror_error.c	3
libfsfat/libbfio/libbfio_memory_range_io_handle.c	3
libfsfat/libbfio/libbfio_handle.c	9
libfsfat/libcdata/libcdata_range_list.c	15
libfsfat/libcdata/libcdata_list_element.c	10
libfsfat/libcdata/libcdata_range_list_value.c	3
libfsfat/libfsfat/libfsfat_volume.c	6
libfsfat/libfsfat/libfsfat_io_handle.c	3
libfsfat/libcthreads/libcthreads_read_write_lock.c	6
libfsfat/libcerror/libcerror_system.c	2
libfsfat/libfsfat/libfsfat_boot_record.c	4
libfsfat/libfsfat/libfsfat_file_system.c	8
libfsfat/libfcache/libfcache_date_time.c	1
libfsfat/libfcache/libfcache_cache.c	2
libfsfat/libcdata/libcdata_array.c	8
libfsfat/libcdata/libcdata_list.c	3
libfsfat/libfcache/libfcache_cache_value.c	1
libfsfat/libfsfat/libfsfat_allocation_table.c	4
libfsfat/libfsfat/libfsfat_directory.c	4
libfsfat/libfsfat/libfsfat_directory_entry.c	13
libfsfat/libfsfat/libfsfat_block_tree.c	3
libfsfat/libfsfat/libfsfat_block_tree_node.c	6
libfsfat/libfsfat/libfsfat_block_descriptor.c	2
libfsfat/libfsfat/libfsfat_file_entry.c	6
libfsfat/libfdata/libfdata_stream.c	1
libfsfat/libfdata/libfdata_range.c	1
libfsfat/libfdata/libfdata_mapped_range.c	1
libfsfat/libfsfat/libfsfat_extent.c	1

Fuzzer: libevt_record_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	580	70.4%
gold	[1:9]	3	0.36%
yellow	[10:29]	13	1.57%
greenyellow	[30:49]	1	0.12%
lawngreen	50+	226	27.4%
All colors	823	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00128	/src/libqcow/libbfio/libbfio_handle.c:1139
93	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	93	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00392	/src/libqcow/libfcache/libfcache_cache.c:801
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00658	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
35	137	4 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element', 'libcdata_list_element_set_elements']	35	137	libcdata_list_remove_element	call site: 00723	/src/libqcow/libcdata/libcdata_list.c:2812
35	102	3 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element']	35	102	libcdata_list_prepend_element	call site: 00421	/src/libqcow/libcdata/libcdata_list.c:1314
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	230	1 : View List ['libevt_file_close']	0	757	libevt_file_free	call site: 00804	/src/libevt/libevt/libevt_file.c:246
0	206	4 : View List ['free', 'libfdata_list_free', 'libevt_io_handle_free', 'libcerror_error_set']	0	206	libevt_file_initialize	call site: 00468	/src/libevt/libevt/libevt_file.c:175
0	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	0	147	libfdata_list_append_element	call site: 00591	/src/libevt/libfdata/libfdata_list.c:1489
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	113	4 : View List ['free', 'libfwnt_security_identifier_free', 'libcerror_error_set', 'libevt_strings_array_free']	0	113	libevt_event_record_read_data	call site: 00334	/src/libevt/libevt/libevt_event_record.c:887

Runtime coverage analysis

Covered functions

130

Functions that are reachable but not covered

36

Reachable functions

166

Percentage of reachable functions covered

78.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libevt/ossfuzz/record_fuzzer.cc	1
libevt/libbfio/libbfio_memory_range.c	2
libevt/libcerror/libcerror_error.c	4
libevt/libbfio/libbfio_memory_range_io_handle.c	3
libevt/libbfio/libbfio_handle.c	10
libevt/libcdata/libcdata_range_list.c	15
libevt/libcdata/libcdata_list_element.c	10
libevt/libcdata/libcdata_range_list_value.c	3
libevt/libevt/libevt_file.c	7
libevt/libevt/libevt_io_handle.c	7
libevt/libfdata/libfdata_list.c	8
libevt/libcdata/libcdata_array.c	10
libevt/libevt/libevt_record_values.c	5
libevt/libevt/libevt_event_record.c	3
libevt/libfwnt/libfwnt_security_identifier.c	4
libevt/libevt/libevt_strings_array.c	3
libevt/libevt/libevt_end_of_file_record.c	3
libevt/libfdata/libfdata_list_element.c	7
libevt/libfdata/libfdata_range.c	4
libevt/libfcache/libfcache_cache.c	5
libevt/libcdata/libcdata_list.c	9
libevt/libfcache/libfcache_cache_value.c	8
libevt/libcthreads/libcthreads_read_write_lock.c	4
libevt/libcerror/libcerror_system.c	2
libevt/libfdata/libfdata_mapped_range.c	3
libevt/libevt/libevt_file_header.c	4
libevt/libfcache/libfcache_date_time.c	1
libevt/libevt/libevt_record.c	2

Fuzzer: libodraw_handle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	524	80.2%
gold	[1:9]	10	1.53%
yellow	[10:29]	2	0.30%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	117	17.9%
All colors	653	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	2 : View List ['libbfio_pool_close_all', 'libbfio_pool_free']	264	776	libodraw_handle_close	call site: 00549	/src/libodraw/libodraw/libodraw_handle.c:1724
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00179	/src/libqcow/libbfio/libbfio_handle.c:1139
168	2074	12 : View List ['libodraw_cue_parser_parse_msf', 'libodraw_handle_append_track', 'libodraw_cue_parser_parse_number', 'yygrowstack', 'libodraw_handle_append_session', 'libodraw_handle_append_data_file', 'memcmp', 'libodraw_cue_scanner_lex', 'libodraw_handle_append_lead_out', 'libodraw_cue_parser_parse_track_type', 'libodraw_cue_scanner_error', 'libcerror_error_set']	168	2074	libodraw_cue_scanner_parse	call site: 00511	/src/libodraw/libodraw/libodraw_cue_parser.c:2177
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
79	79	1 : View List ['libodraw_handle_append_session']	158	373	libodraw_cue_parser_parse_buffer	call site: 00514	/src/libodraw/libodraw/libodraw_cue_parser.c:1186
79	79	1 : View List ['libodraw_handle_append_lead_out']	79	262	libodraw_cue_parser_parse_buffer	call site: 00518	/src/libodraw/libodraw/libodraw_cue_parser.c:1204
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	262	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	262	libodraw_handle_initialize	call site: 00091	/src/libodraw/libodraw/libodraw_handle.c:189
0	254	1 : View List ['libodraw_handle_close']	0	744	libodraw_handle_free	call site: 00634	/src/libodraw/libodraw/libodraw_handle.c:278
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	264	907	libodraw_handle_close	call site: 00541	/src/libodraw/libodraw/libodraw_handle.c:1705
0	69	2 : View List ['libcerror_error_set', 'libodraw_data_file_descriptor_free']	0	69	libodraw_handle_append_data_file	call site: 00400	/src/libodraw/libodraw/libodraw_handle.c:6253

Runtime coverage analysis

Covered functions

68

Functions that are reachable but not covered

62

Reachable functions

130

Percentage of reachable functions covered

52.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libodraw/ossfuzz/handle_fuzzer.cc	1
libodraw/libbfio/libbfio_memory_range.c	2
libodraw/libcerror/libcerror_error.c	3
libodraw/libbfio/libbfio_memory_range_io_handle.c	3
libodraw/libbfio/libbfio_handle.c	9
libodraw/libcdata/libcdata_range_list.c	15
libodraw/libcdata/libcdata_list_element.c	10
libodraw/libcdata/libcdata_range_list_value.c	3
libodraw/libodraw/libodraw_handle.c	9
libodraw/libcdata/libcdata_array.c	8
libodraw/libodraw/libodraw_io_handle.c	3
libodraw/libodraw/libodraw_track_value.c	3
libodraw/libodraw/libodraw_sector_range.c	3
libodraw/libodraw/libodraw_cue_parser.c	6
libodraw/libodraw/libodraw_cue_scanner.c	17
libodraw/libodraw/libodraw_cue_scanner.l	5
libodraw/libodraw/libodraw_data_file_descriptor.c	3
libodraw/libbfio/libbfio_pool.c	3
libodraw/libcdata/libcdata_list.c	3

Fuzzer: libfplist_property_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	192	75.8%
gold	[1:9]	4	1.58%
yellow	[10:29]	3	1.18%
greenyellow	[30:49]	7	2.76%
lawngreen	50+	47	18.5%
All colors	253	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
85	85	8 : View List ['getc', 'fread', 'ferror', '__errno_location', 'libfplist_xml_scanner_realloc', 'yy_fatal_error', 'libfplist_xml_scanner_restart', 'clearerr']	85	85	yy_get_next_buffer	call site: 00057	/src/libfplist/libfplist/libfplist_xml_scanner.c:158629
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
4	4	1 : View List ['memcmp']	4	4	libfplist_xml_tag_get_value_type	call site: 00239	/src/libfplist/libfplist/libfplist_xml_tag.c:340
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfplist_xml_tag_initialize	call site: 00099	/src/libfplist/libfplist/libfplist_xml_tag.c:169
0	70	2 : View List ['libfplist_xml_attribute_free', 'libcerror_error_set']	0	70	libfplist_xml_tag_append_attribute	call site: 00159	/src/libfplist/libfplist/libfplist_xml_tag.c:598
0	68	1 : View List ['libfplist_xml_tag_free']	0	68	libfplist_property_list_copy_from_byte_stream	call site: 00215	/src/libfplist/libfplist/libfplist_property_list.c:490
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00123	/src/libfplist/libcdata/libcdata_array.c:823
0	41	1 : View List ['libfplist_xml_tag_compare_name']	0	169	libfplist_property_initialize	call site: 00222	/src/libfplist/libfplist/libfplist_property.c:84
0	38	1 : View List ['libfplist_xml_attribute_free']	0	38	libfplist_xml_tag_append_attribute	call site: 00160	/src/libfplist/libfplist/libfplist_xml_tag.c:616
0	32	1 : View List ['libcerror_error_set']	0	135	libfplist_xml_parser_parse_buffer	call site: 00167	/src/libfplist/libfplist/libfplist_xml_parser.c:463
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00096	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00103	/src/libfplist/libcdata/libcdata_array.c:260

Runtime coverage analysis

Covered functions

46

Functions that are reachable but not covered

21

Reachable functions

67

Percentage of reachable functions covered

68.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfplist/ossfuzz/property_fuzzer.cc	1
libfplist/libfplist/libfplist_property_list.c	5
libfplist/libcerror/libcerror_error.c	3
libfplist/libfplist/libfplist_xml_parser.c	3
libfplist/libfplist/libfplist_xml_scanner.c	17
libfplist/libfplist/libfplist_xml_scanner.l	5
libfplist/libfplist/libfplist_xml_tag.c	9
libfplist/libcdata/libcdata_array.c	7
libfplist/libfplist/libfplist_xml_attribute.c	2
libfplist/libfplist/libfplist_property.c	3

Fuzzer: libfsapfs_container_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	518	74.1%
gold	[1:9]	6	0.85%
yellow	[10:29]	3	0.42%
greenyellow	[30:49]	49	7.01%
lawngreen	50+	123	17.5%
All colors	699	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
271	718	9 : View List ['libfsapfs_checksum_calculate_fletcher64', 'libfsapfs_key_bag_header_read_data', 'libfsapfs_key_bag_entry_initialize', 'libfsapfs_key_bag_entry_free', 'libfsapfs_key_bag_header_free', 'libfsapfs_key_bag_entry_read_data', 'libfsapfs_key_bag_header_initialize', 'libcdata_array_append_entry', 'libcerror_error_set']	271	718	libfsapfs_container_key_bag_read_data	call site: 00578	/src/libfsapfs/libfsapfs/libfsapfs_container_key_bag.c:504
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00149	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00618	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00654	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00427	/src/libqcow/libfdata/libfdata_segments_array.c:592
38	38	1 : View List ['libcdata_array_set_entry_by_index']	38	74	libfdata_segments_array_append_segment	call site: 00429	/src/libqcow/libfdata/libfdata_segments_array.c:642
36	36	1 : View List ['libfsapfs_fusion_middle_tree_free']	36	571	libfsapfs_container_close	call site: 00678	/src/libfsapfs/libfsapfs/libfsapfs_container.c:922
36	36	1 : View List ['libfsapfs_fusion_middle_tree_free']	36	108	libfsapfs_internal_container_open_read	call site: 00643	/src/libfsapfs/libfsapfs/libfsapfs_container.c:1861
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	270	1 : View List ['libfsapfs_container_close']	0	469	libfsapfs_container_free	call site: 00691	/src/libfsapfs/libfsapfs/libfsapfs_container.c:178
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00396	/src/libqcow/libfdata/libfdata_vector.c:180

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

71

Reachable functions

170

Percentage of reachable functions covered

58.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsapfs/ossfuzz/container_fuzzer.cc	1
libfsapfs/libbfio/libbfio_memory_range.c	2
libfsapfs/libcerror/libcerror_error.c	3
libfsapfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsapfs/libbfio/libbfio_handle.c	8
libfsapfs/libcdata/libcdata_range_list.c	15
libfsapfs/libcdata/libcdata_list_element.c	10
libfsapfs/libcdata/libcdata_range_list_value.c	3
libfsapfs/libfsapfs/libfsapfs_container.c	5
libfsapfs/libfsapfs/libfsapfs_io_handle.c	3
libfsapfs/libcthreads/libcthreads_read_write_lock.c	4
libfsapfs/libcerror/libcerror_system.c	2
libfsapfs/libfsapfs/libfsapfs_container_superblock.c	4
libfsapfs/libfsapfs/libfsapfs_checksum.c	1
libfsapfs/libfsapfs/libfsapfs_object.c	4
libfsapfs/libfsapfs/libfsapfs_checkpoint_map.c	4
libfsapfs/libcdata/libcdata_array.c	6
libfsapfs/libfsapfs/libfsapfs_checkpoint_map_entry.c	3
libfsapfs/libfsapfs/libfsapfs_container_data_handle.c	2
libfsapfs/libfdata/libfdata_vector.c	3
libfsapfs/libfcache/libfcache_date_time.c	1
libfsapfs/libfdata/libfdata_segments_array.c	1
libfsapfs/libfdata/libfdata_mapped_range.c	3
libfsapfs/libfdata/libfdata_range.c	3
libfsapfs/libfsapfs/libfsapfs_object_map.c	4
libfsapfs/libfsapfs/libfsapfs_object_map_btree.c	2
libfsapfs/libfcache/libfcache_cache.c	2
libfsapfs/libcdata/libcdata_list.c	3
libfsapfs/libfsapfs/libfsapfs_container_key_bag.c	4
libfsapfs/libfsapfs/libfsapfs_encryption_context.c	4
libfsapfs/libcaes/libcaes_tweaked_context.c	4
libfsapfs/libcaes/libcaes_context.c	7
libfsapfs/libfsapfs/libfsapfs_key_bag_header.c	3
libfsapfs/libfsapfs/libfsapfs_key_bag_entry.c	3
libfsapfs/libfcache/libfcache_cache_value.c	1
libfsapfs/libfsapfs/libfsapfs_fusion_middle_tree.c	1

Fuzzer: liblnk_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	437	71.5%
gold	[1:9]	19	3.10%
yellow	[10:29]	19	3.10%
greenyellow	[30:49]	27	4.41%
lawngreen	50+	109	17.8%
All colors	611	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00166	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	194	1 : View List ['liblnk_file_close']	0	471	liblnk_file_free	call site: 00599	/src/liblnk/liblnk/liblnk_file.c:201
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	116	3 : View List ['libcerror_error_set', 'libcdata_array_empty', 'liblnk_internal_data_block_free']	0	116	liblnk_internal_file_read_extra_data_blocks	call site: 00457	/src/liblnk/liblnk/liblnk_file.c:1799
0	99	1 : View List ['libbfio_handle_free']	0	966	liblnk_file_close	call site: 00569	/src/liblnk/liblnk/liblnk_file.c:799
0	69	2 : View List ['liblnk_data_string_free', 'libcerror_error_set']	0	69	liblnk_strings_data_block_read	call site: 00470	/src/liblnk/liblnk/liblnk_strings_data_block.c:257
0	69	2 : View List ['liblnk_data_string_free', 'libcerror_error_set']	0	69	liblnk_strings_data_block_read	call site: 00472	/src/liblnk/liblnk/liblnk_strings_data_block.c:291
0	68	2 : View List ['libcerror_error_set', 'libbfio_memory_range_io_handle_free']	0	68	libbfio_memory_range_initialize	call site: 00059	/src/libqcow/libbfio/libbfio_memory_range.c:83
0	68	3 : View List ['free', 'libcerror_error_set', 'liblnk_io_handle_free']	0	68	liblnk_file_initialize	call site: 00083	/src/liblnk/liblnk/liblnk_file.c:142
0	64	1 : View List ['libcerror_error_set']	0	64	libbfio_internal_handle_read_buffer	call site: 00308	/src/libqcow/libbfio/libbfio_handle.c:1164

Runtime coverage analysis

Covered functions

77

Functions that are reachable but not covered

39

Reachable functions

116

Percentage of reachable functions covered

66.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
liblnk/ossfuzz/file_fuzzer.cc	1
liblnk/libbfio/libbfio_memory_range.c	2
liblnk/libcerror/libcerror_error.c	4
liblnk/libbfio/libbfio_memory_range_io_handle.c	3
liblnk/libbfio/libbfio_handle.c	10
liblnk/libcdata/libcdata_range_list.c	15
liblnk/libcdata/libcdata_list_element.c	10
liblnk/libcdata/libcdata_range_list_value.c	3
liblnk/liblnk/liblnk_file.c	6
liblnk/liblnk/liblnk_io_handle.c	3
liblnk/libcdata/libcdata_array.c	6
liblnk/libcthreads/libcthreads_read_write_lock.c	2
liblnk/libcerror/libcerror_system.c	2
liblnk/liblnk/liblnk_file_header.c	4
liblnk/liblnk/liblnk_link_target_identifier.c	3
liblnk/liblnk/liblnk_location_information.c	4
liblnk/liblnk/liblnk_data_string.c	3
liblnk/liblnk/liblnk_data_block.c	6
liblnk/liblnk/liblnk_strings_data_block.c	1
liblnk/liblnk/liblnk_distributed_link_tracking_data_block.c	1
liblnk/liblnk/liblnk_distributed_link_tracker_properties.c	3
liblnk/liblnk/liblnk_special_folder_location.c	4
liblnk/liblnk/liblnk_known_folder_location.c	4

Fuzzer: libfsntfs_mft_metadata_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1416	82.1%
gold	[1:9]	28	1.62%
yellow	[10:29]	11	0.63%
greenyellow	[30:49]	3	0.17%
lawngreen	50+	266	15.4%
All colors	1724	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2617	2727	8 : View List ['libfsntfs_mft_entry_read_attribute_list_data_mft_entry_by_index', 'libfsntfs_mft_entry_read_attribute_list', 'libfsntfs_mft_attribute_get_number_of_data_runs', 'libfsntfs_mft_attribute_get_next_attribute', 'libfsntfs_mft_attribute_get_data_run_by_index', 'libfsntfs_mft_attribute_list_get_number_of_file_references', 'libfdata_vector_append_segment', 'libfsntfs_mft_attribute_list_get_file_reference_by_index']	2617	3489	libfsntfs_file_system_read_mft	call site: 00805	/src/libfsntfs/libfsntfs/libfsntfs_file_system.c:532
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00173	/src/libqcow/libbfio/libbfio_handle.c:1139
259	469	2 : View List ['libcdata_btree_node_split', 'libcdata_btree_node_get_sub_node_by_value']	259	653	libcdata_btree_insert_value	call site: 01533	/src/libfsntfs/libcdata/libcdata_btree.c:591
250	250	1 : View List ['libfsntfs_security_descriptor_index_free']	250	494	libfsntfs_file_system_free	call site: 01648	/src/libfsntfs/libfsntfs/libfsntfs_file_system.c:193
82	82	1 : View List ['libfsntfs_internal_attribute_free']	82	214	libfsntfs_mft_metadata_file_close	call site: 01714	/src/libfsntfs/libfsntfs/libfsntfs_mft_metadata_file.c:950
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
53	53	1 : View List ['libcdata_tree_node_get_sub_node_by_index']	89	385	libcdata_btree_node_get_sub_node_by_value	call site: 01434	/src/libfsntfs/libcdata/libcdata_btree_node.c:193
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01687	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
36	36	1 : View List ['libfsntfs_mft_attribute_get_data_size']	2738	4750	libfsntfs_file_system_read_mft	call site: 00608	/src/libfsntfs/libfsntfs/libfsntfs_file_system.c:391
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	429	1 : View List ['libfsntfs_mft_metadata_file_close']	0	628	libfsntfs_mft_metadata_file_free	call site: 01718	/src/libfsntfs/libfsntfs/libfsntfs_mft_metadata_file.c:181
0	244	3 : View List ['libfsntfs_mft_entry_free', 'libcerror_error_set', 'libcdata_btree_free']	0	244	libfsntfs_file_system_read_mft	call site: 01382	/src/libfsntfs/libfsntfs/libfsntfs_file_system.c:723

Runtime coverage analysis

Covered functions

166

Functions that are reachable but not covered

153

Reachable functions

319

Percentage of reachable functions covered

52.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsntfs/ossfuzz/mft_metadata_file_fuzzer.cc	1
libfsntfs/libbfio/libbfio_memory_range.c	2
libfsntfs/libcerror/libcerror_error.c	3
libfsntfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsntfs/libbfio/libbfio_handle.c	10
libfsntfs/libcdata/libcdata_range_list.c	15
libfsntfs/libcdata/libcdata_list_element.c	10
libfsntfs/libcdata/libcdata_range_list_value.c	3
libfsntfs/libfsntfs/libfsntfs_mft_metadata_file.c	5
libfsntfs/libfsntfs/libfsntfs_io_handle.c	3
libfsntfs/libcthreads/libcthreads_read_write_lock.c	4
libfsntfs/libcerror/libcerror_system.c	2
libfsntfs/libfsntfs/libfsntfs_file_system.c	3
libfsntfs/libfsntfs/libfsntfs_mft_entry.c	14
libfsntfs/libcdata/libcdata_array.c	11
libfsntfs/libfsntfs/libfsntfs_mft_entry_header.c	7
libfsntfs/libfsntfs/libfsntfs_fixup_values.c	1
libfsntfs/libfsntfs/libfsntfs_mft_attribute.c	20
libfsntfs/libfsntfs/libfsntfs_data_run.c	3
libfsntfs/libuna/libuna_utf8_string.c	4
libfsntfs/libuna/libuna_unicode_character.c	7
libfsntfs/libfsntfs/libfsntfs_name.c	1
libfsntfs/libfsntfs/libfsntfs_mft.c	3
libfsntfs/libfdata/libfdata_vector.c	6
libfsntfs/libfcache/libfcache_date_time.c	1
libfsntfs/libfdata/libfdata_segments_array.c	3
libfsntfs/libfdata/libfdata_range.c	5
libfsntfs/libfcache/libfcache_cache.c	4
libfsntfs/libcdata/libcdata_list.c	17
libfsntfs/libfcache/libfcache_cache_value.c	8
libfsntfs/libfsntfs/libfsntfs_mft_attribute_list.c	11
libfsntfs/libfsntfs/libfsntfs_mft_attribute_list_entry.c	4
libfsntfs/libfdata/libfdata_mapped_range.c	4
libfsntfs/libfsntfs/libfsntfs_cluster_block_stream.c	5
libfsntfs/libfsntfs/libfsntfs_buffer_data_handle.c	2
libfsntfs/libfdata/libfdata_stream.c	8
libfsntfs/libfsntfs/libfsntfs_compressed_block_data_handle.c	2
libfsntfs/libfsntfs/libfsntfs_compressed_block_vector.c	2
libfsntfs/libfsntfs/libfsntfs_compression_unit_data_handle.c	4
libfsntfs/libfsntfs/libfsntfs_compression_unit_descriptor.c	3
libfsntfs/libfsntfs/libfsntfs_cluster_block_data.c	1
libfsntfs/libfsntfs/libfsntfs_compressed_block.c	2
libfsntfs/libfsntfs/libfsntfs_compression.c	1
libfsntfs/libfwnt/libfwnt_lznt1.c	2
libfsntfs/libfwnt/libfwnt_lzx.c	7
libfsntfs/libfwnt/libfwnt_bit_stream.c	4
libfsntfs/libcnotify/libcnotify_print.c	1
libfsntfs/libfwnt/libfwnt_huffman_tree.c	4
libfsntfs/libfwnt/libfwnt_lzxpress.c	2
libfsntfs/libfsntfs/libfsntfs_compressed_data_handle.c	2
libfsntfs/libcdata/libcdata_btree.c	3
libfsntfs/libcdata/libcdata_tree_node.c	16
libfsntfs/libcdata/libcdata_btree_values_list.c	1
libfsntfs/libfsntfs/libfsntfs_path_hint.c	1
libfsntfs/libcdata/libcdata_btree_node.c	5
libfsntfs/libfsntfs/libfsntfs_security_descriptor_index.c	1
libfsntfs/libfsntfs/libfsntfs_index.c	1
libfsntfs/libfsntfs/libfsntfs_index_root_header.c	1
libfsntfs/libfsntfs/libfsntfs_index_node.c	1
libfsntfs/libfsntfs/libfsntfs_index_node_header.c	1
libfsntfs/libfsntfs/libfsntfs_index_value.c	1
libfsntfs/libfsntfs/libfsntfs_bitmap_values.c	1
libfsntfs/libfsntfs/libfsntfs_data_stream.c	1
libfsntfs/libfsntfs/libfsntfs_extent.c	1
libfsntfs/libfsntfs/libfsntfs_attribute.c	1

Fuzzer: libscca_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	702	71.8%
gold	[1:9]	3	0.30%
yellow	[10:29]	13	1.33%
greenyellow	[30:49]	15	1.53%
lawngreen	50+	244	24.9%
All colors	977	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00162	/src/libqcow/libbfio/libbfio_handle.c:1139
93	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	93	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
75	75	1 : View List ['libfdata_list_calculate_mapped_ranges']	75	551	libfdata_list_get_element_index_at_offset	call site: 00000	/src/libevt/libfdata/libfdata_list.c:3171
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00435	/src/libqcow/libfcache/libfcache_cache.c:801
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_stream_get_size	call site: 00657	/src/libfsfat/libfdata/libfdata_stream.c:2554
63	63	1 : View List ['libfdata_segments_array_calculate_mapped_ranges']	63	539	libfdata_stream_get_segment_index_at_offset	call site: 00681	/src/libfsfat/libfdata/libfdata_stream.c:1085
35	137	4 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element', 'libcdata_list_element_set_elements']	35	137	libcdata_list_remove_element	call site: 00000	/src/libqcow/libcdata/libcdata_list.c:2812
35	102	3 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element']	35	102	libcdata_list_prepend_element	call site: 00462	/src/libqcow/libcdata/libcdata_list.c:1314
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	180	4 : View List ['free', 'libcdata_array_free', 'libcerror_error_set', 'libscca_filename_strings_free']	0	180	libscca_file_initialize	call site: 00090	/src/libscca/libscca/libscca_file.c:154
0	162	2 : View List ['libfcache_cache_value_get_identifier', 'libfcache_cache_get_value_by_identifier']	0	358	libfdata_list_get_element_value	call site: 00000	/src/libevt/libfdata/libfdata_list.c:3885
0	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	0	147	libfdata_list_append_element_with_mapped_size	call site: 00565	/src/libevt/libfdata/libfdata_list.c:2841

Runtime coverage analysis

Covered functions

163

Functions that are reachable but not covered

362

Reachable functions

525

Percentage of reachable functions covered

31.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libscca/ossfuzz/file_fuzzer.cc	1
libscca/libbfio/libbfio_memory_range.c	2
libscca/libcerror/libcerror_error.c	3
libscca/libbfio/libbfio_memory_range_io_handle.c	3
libscca/libbfio/libbfio_handle.c	10
libscca/libcdata/libcdata_range_list.c	15
libscca/libcdata/libcdata_list_element.c	10
libscca/libcdata/libcdata_range_list_value.c	3
libscca/libscca/libscca_file.c	5
libscca/libcdata/libcdata_array.c	9
libscca/libscca/libscca_filename_strings.c	5
libscca/libscca/libscca_io_handle.c	8
libscca/libscca/libscca_filename_string.c	2
libscca/libfdata/libfdata_list.c	8
libscca/libscca/libscca_compressed_block.c	4
libscca/libfdata/libfdata_list_element.c	9
libscca/libfwnt/libfwnt_lzxpress.c	2
libscca/libfwnt/libfwnt_bit_stream.c	4
libscca/libfwnt/libfwnt_huffman_tree.c	4
libscca/libfdata/libfdata_range.c	4
libscca/libfcache/libfcache_cache.c	3
libscca/libcdata/libcdata_list.c	7
libscca/libfcache/libfcache_cache_value.c	6
libscca/libfdata/libfdata_mapped_range.c	4
libscca/libfcache/libfcache_date_time.c	1
libscca/libscca/libscca_compressed_blocks_stream.c	3
libscca/libfdata/libfdata_stream.c	9
libscca/libfdata/libfdata_segments_array.c	2
libscca/libscca/libscca_file_header.c	4
libscca/libscca/libscca_file_information.c	4
libscca/libscca/libscca_file_metrics.c	3
libscca/libscca/libscca_volume_information.c	2
libscca/libfvalue/libfvalue_value_type.c	3
libscca/libfvalue/libfvalue_value.c	3
libscca/libfvalue/libfvalue_data_handle.c	3
libscca/libfvalue/libfvalue_binary_data.c	1
libscca/libfvalue/libfvalue_floating_point.c	1
libscca/libfvalue/libfvalue_integer.c	1
libscca/libfvalue/libfvalue_string.c	1
libscca/libfdatetime/libfdatetime_fat_date_time.c	1
libscca/libfdatetime/libfdatetime_filetime.c	2
libscca/libfvalue/libfvalue_filetime.c	1
libscca/libfdatetime/libfdatetime_floatingtime.c	1
libscca/libfdatetime/libfdatetime_nsf_timedate.c	1
libscca/libfdatetime/libfdatetime_posix_time.c	2
libscca/libfdatetime/libfdatetime_systemtime.c	1
libscca/libfwnt/libfwnt_security_identifier.c	1
libscca/libfvalue/libfvalue_value_entry.c	1

Fuzzer: libvsapm_partition_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	500	82.2%
gold	[1:9]	3	0.49%
yellow	[10:29]	2	0.32%
greenyellow	[30:49]	52	8.55%
lawngreen	50+	51	8.38%
All colors	608	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00158	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00557	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00367	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00344	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00523	/src/libqcow/libfdata/libfdata_segments_array.c:592
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	181	1 : View List ['libvsapm_volume_close']	0	458	libvsapm_volume_free	call site: 00598	/src/libvsapm/libvsapm/libvsapm_volume.c:190
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00397	/src/libqcow/libfdata/libfdata_vector.c:180
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	375	libvsapm_volume_close	call site: 00581	/src/libvsapm/libvsapm/libvsapm_volume.c:892
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfcache_cache_initialize	call site: 00534	/src/libqcow/libfcache/libfcache_cache.c:123

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

62

Reachable functions

135

Percentage of reachable functions covered

54.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvsapm/ossfuzz/partition_fuzzer.cc	1
libvsapm/libbfio/libbfio_memory_range.c	2
libvsapm/libcerror/libcerror_error.c	3
libvsapm/libbfio/libbfio_memory_range_io_handle.c	3
libvsapm/libbfio/libbfio_handle.c	9
libvsapm/libcdata/libcdata_range_list.c	15
libvsapm/libcdata/libcdata_list_element.c	10
libvsapm/libcdata/libcdata_range_list_value.c	3
libvsapm/libvsapm/libvsapm_volume.c	7
libvsapm/libvsapm/libvsapm_io_handle.c	3
libvsapm/libcdata/libcdata_array.c	9
libvsapm/libcthreads/libcthreads_read_write_lock.c	6
libvsapm/libcerror/libcerror_system.c	2
libvsapm/libvsapm/libvsapm_partition_map_entry.c	6
libvsapm/libvsapm/libvsapm_partition.c	2
libvsapm/libfdata/libfdata_vector.c	4
libvsapm/libfcache/libfcache_date_time.c	1
libvsapm/libvsapm/libvsapm_sector_data.c	4
libvsapm/libfdata/libfdata_segments_array.c	2
libvsapm/libfdata/libfdata_range.c	4
libvsapm/libfcache/libfcache_cache.c	3
libvsapm/libcdata/libcdata_list.c	7
libvsapm/libfcache/libfcache_cache_value.c	6
libvsapm/libfdata/libfdata_mapped_range.c	3

Fuzzer: libwrc_mui_resource_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	53.8%
gold	[1:9]	6	11.5%
yellow	[10:29]	1	1.92%
greenyellow	[30:49]	6	11.5%
lawngreen	50+	11	21.1%
All colors	52	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libwrc_mui_resource_initialize	call site: 00011	/src/libwrc/libwrc/libwrc_mui_resource.c:88
0	32	1 : View List ['libcerror_error_set']	0	32	libwrc_mui_resource_free	call site: 00050	/src/libwrc/libwrc/libwrc_mui_resource.c:125
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libwrc_mui_resource_read	call site: 00048	/src/libwrc/libwrc/libwrc_mui_resource.c:1223
0	0	None	0	32	libwrc_mui_resource_initialize	call site: 00001	/src/libwrc/libwrc/libwrc_mui_resource.c:52
0	0	None	0	32	libwrc_mui_resource_initialize	call site: 00002	/src/libwrc/libwrc/libwrc_mui_resource.c:63
0	0	None	0	32	libwrc_mui_resource_initialize	call site: 00010	/src/libwrc/libwrc/libwrc_mui_resource.c:77
0	0	None	0	32	libwrc_mui_resource_read	call site: 00013	/src/libwrc/libwrc/libwrc_mui_resource.c:190
0	0	None	0	32	libwrc_mui_resource_read	call site: 00014	/src/libwrc/libwrc/libwrc_mui_resource.c:203
0	0	None	0	32	libwrc_mui_resource_read	call site: 00015	/src/libwrc/libwrc/libwrc_mui_resource.c:214
0	0	None	0	32	libwrc_mui_resource_read	call site: 00016	/src/libwrc/libwrc/libwrc_mui_resource.c:225
0	0	None	0	32	libwrc_mui_resource_read	call site: 00017	/src/libwrc/libwrc/libwrc_mui_resource.c:236

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

6

Reachable functions

11

Percentage of reachable functions covered

45.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libwrc/ossfuzz/mui_resource_fuzzer.cc	1
libwrc/libwrc/libwrc_mui_resource.c	3
libwrc/libcerror/libcerror_error.c	3

Fuzzer: libfwsi_item_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	296	96.1%
gold	[1:9]	1	0.32%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	10	3.24%
lawngreen	50+	1	0.32%
All colors	308	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2044	2044	40 : View List ['libfwsi_uri_values_initialize', 'libfwsi_network_location_values_read_data', 'libfwsi_extension_block_copy_from_byte_stream', 'libfwsi_mtp_volume_values_read_data', 'libfwsi_delegate_values_initialize', 'libfwsi_mtp_volume_values_initialize', 'libfwsi_network_location_values_initialize', 'libfwsi_volume_values_initialize', 'libfwsi_volume_values_read_data', 'libfwsi_file_entry_values_read_data', 'libfwsi_compressed_folder_values_initialize', 'libfwsi_internal_extension_block_free', 'libfwsi_game_folder_values_read_data', 'libfwsi_users_files_folder_values_read_data', 'libfwsi_file_entry_values_initialize', 'libfwsi_uri_values_read_data', 'libfwsi_mtp_file_entry_values_read_data', 'memcmp', 'libfwsi_compressed_folder_values_read_data', 'libfwsi_control_panel_item_values_initialize', 'libfwsi_control_panel_category_values_initialize', 'libfwsi_item_get_parent_item', 'libfwsi_delegate_values_read_data', 'libfwsi_cdburn_values_read_data', 'libfwsi_uri_sub_values_read_data', 'libfwsi_users_property_view_values_initialize', 'libfwsi_cdburn_values_initialize', 'libfwsi_control_panel_item_values_read_data', 'libfwsi_game_folder_values_initialize', 'libfwsi_control_panel_category_values_read_data', 'libfwsi_extension_block_initialize', 'libfwsi_users_property_view_values_read_data', 'libfwsi_mtp_file_entry_values_initialize', 'libfwsi_control_panel_cpl_file_values_read_data', 'libfwsi_users_files_folder_values_initialize', 'libfwsi_root_folder_values_initialize', 'libfwsi_root_folder_values_read_data', 'libfwsi_uri_sub_values_initialize', 'libfwsi_control_panel_cpl_file_values_initialize', 'libcdata_array_append_entry']	2044	3324	libfwsi_item_copy_from_byte_stream	call site: 00032	/src/libfwsi/libfwsi/libfwsi_item.c:375
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00024	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00300	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libfwsi_item_initialize	call site: 00011	/src/libfwsi/libfwsi/libfwsi_item.c:91
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwsi_internal_item_initialize	call site: 00016	/src/libfwsi/libfwsi/libfwsi_item.c:169
0	32	1 : View List ['libcerror_error_set']	0	32	libfwsi_item_free	call site: 00297	/src/libfwsi/libfwsi/libfwsi_item.c:224
0	32	1 : View List ['libcerror_error_set']	0	32	libfwsi_internal_item_free	call site: 00305	/src/libfwsi/libfwsi/libfwsi_item.c:285
0	0	None	0	128	libcdata_array_initialize	call site: 00021	/src/libfplist/libcdata/libcdata_array.c:112
0	0	None	0	110	libfwsi_internal_item_free	call site: 00297	/src/libfwsi/libfwsi/libfwsi_item.c:266
0	0	None	0	32	libcdata_array_initialize	call site: 00016	/src/libfplist/libcdata/libcdata_array.c:46
0	0	None	0	32	libcdata_array_initialize	call site: 00017	/src/libfplist/libcdata/libcdata_array.c:57

Runtime coverage analysis

Covered functions

10

Functions that are reachable but not covered

72

Reachable functions

82

Percentage of reachable functions covered

12.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwsi/ossfuzz/item_fuzzer.cc	1
libfwsi/libfwsi/libfwsi_item.c	6
libfwsi/libcerror/libcerror_error.c	3
libfwsi/libcdata/libcdata_array.c	5
libfwsi/libfwsi/libfwsi_uri_sub_values.c	2
libfwsi/libfwsi/libfwsi_cdburn_values.c	2
libfwsi/libfwsi/libfwsi_compressed_folder_values.c	2
libfwsi/libfwsi/libfwsi_control_panel_item_values.c	2
libfwsi/libfwsi/libfwsi_control_panel_category_values.c	2
libfwsi/libfwsi/libfwsi_control_panel_cpl_file_values.c	2
libfwsi/libfwsi/libfwsi_delegate_values.c	2
libfwsi/libfwsi/libfwsi_file_entry_values.c	2
libfwsi/libfwsi/libfwsi_game_folder_values.c	2
libfwsi/libfwsi/libfwsi_mtp_file_entry_values.c	2
libfwsi/libfwsi/libfwsi_mtp_volume_values.c	2
libfwsi/libfwsi/libfwsi_network_location_values.c	2
libfwsi/libfwsi/libfwsi_root_folder_values.c	2
libfwsi/libfwsi/libfwsi_uri_values.c	2
libfwsi/libfwsi/libfwsi_users_files_folder_values.c	2
libfwsi/libfwsi/libfwsi_users_property_view_values.c	2
libfwsi/libfwsi/libfwsi_volume_values.c	2
libfwsi/libfwsi/libfwsi_extension_block.c	3
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0000_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0001_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0003_values.c	2
libfwsi/libfwsi/libfwsi_file_entry_extension_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0005_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0006_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef000a_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0013_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0014_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0019_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0025_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0026_values.c	2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0029_values.c	2

Fuzzer: libregf_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	551	82.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	9	1.35%
greenyellow	[30:49]	2	0.30%
lawngreen	50+	104	15.6%
All colors	666	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00152	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00581	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00622	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	38	147	libfdata_list_append_element	call site: 00561	/src/libevt/libfdata/libfdata_list.c:1489
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	253	1 : View List ['libregf_file_close']	0	452	libregf_file_free	call site: 00656	/src/libregf/libregf/libregf_file.c:183
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	101	3 : View List ['free', 'libfdata_list_free', 'libcerror_error_set']	0	101	libregf_hive_bins_list_initialize	call site: 00502	/src/libregf/libregf/libregf_hive_bins_list.c:135
0	99	1 : View List ['libbfio_handle_free']	0	592	libregf_file_close	call site: 00637	/src/libregf/libregf/libregf_file.c:862
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfcache_cache_initialize	call site: 00505	/src/libqcow/libfcache/libfcache_cache.c:123
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfdata_list_initialize	call site: 00329	/src/libevt/libfdata/libfdata_list.c:163

Runtime coverage analysis

Covered functions

80

Functions that are reachable but not covered

69

Reachable functions

149

Percentage of reachable functions covered

53.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libregf/ossfuzz/file_fuzzer.cc	1
libregf/libbfio/libbfio_memory_range.c	2
libregf/libcerror/libcerror_error.c	3
libregf/libbfio/libbfio_memory_range_io_handle.c	3
libregf/libbfio/libbfio_handle.c	10
libregf/libcdata/libcdata_range_list.c	15
libregf/libcdata/libcdata_list_element.c	10
libregf/libcdata/libcdata_range_list_value.c	3
libregf/libregf/libregf_file.c	7
libregf/libregf/libregf_io_handle.c	3
libregf/libcthreads/libcthreads_read_write_lock.c	4
libregf/libcerror/libcerror_system.c	2
libregf/libregf/libregf_file_header.c	4
libregf/libregf/libregf_checksum.c	1
libregf/libregf/libregf_hive_bins_list.c	5
libregf/libfdata/libfdata_list.c	4
libregf/libcdata/libcdata_array.c	8
libregf/libregf/libregf_hive_bin_header.c	4
libregf/libregf/libregf_hive_bin.c	4
libregf/libregf/libregf_hive_bin_cell.c	2
libregf/libfdata/libfdata_list_element.c	7
libregf/libfdata/libfdata_range.c	4
libregf/libfcache/libfcache_cache.c	3
libregf/libcdata/libcdata_list.c	7
libregf/libfcache/libfcache_cache_value.c	6
libregf/libfdata/libfdata_mapped_range.c	3
libregf/libfcache/libfcache_date_time.c	1
libregf/libregf/libregf_dirty_vector.c	4

Fuzzer: libfsfat_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	476	71.9%
gold	[1:9]	21	3.17%
yellow	[10:29]	7	1.05%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	158	23.8%
All colors	662	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00152	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00344	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00624	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	259	5 : View List ['libfsfat_directory_free', 'libfsfat_directory_entry_free', 'libfsfat_block_tree_free', 'libcdata_array_free', 'libcerror_error_set']	0	259	libfsfat_file_system_read_directory	call site: 00591	/src/libfsfat/libfsfat/libfsfat_file_system.c:1082
0	245	1 : View List ['libfsfat_volume_close']	0	444	libfsfat_volume_free	call site: 00655	/src/libfsfat/libfsfat/libfsfat_volume.c:175
0	227	3 : View List ['libfsfat_file_system_free', 'libfsfat_boot_record_free', 'libcerror_error_set']	0	227	libfsfat_internal_volume_open_read	call site: 00600	/src/libfsfat/libfsfat/libfsfat_volume.c:1101
0	190	4 : View List ['libfsfat_directory_free', 'libcerror_error_set', 'libcdata_array_free', 'libfsfat_directory_entry_free']	0	190	libfsfat_file_system_read_directory_by_range	call site: 00468	/src/libfsfat/libfsfat/libfsfat_file_system.c:1440
0	126	3 : View List ['free', 'libfcache_cache_free', 'libcerror_error_set']	0	126	libfsfat_file_system_initialize	call site: 00337	/src/libfsfat/libfsfat/libfsfat_file_system.c:154
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	105	2 : View List ['libfsfat_block_tree_node_free', 'libcerror_error_set']	0	105	libfsfat_block_tree_insert_block_descriptor_by_offset	call site: 00527	/src/libfsfat/libfsfat/libfsfat_block_tree.c:443

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

43

Reachable functions

127

Percentage of reachable functions covered

66.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsfat/ossfuzz/volume_fuzzer.cc	1
libfsfat/libbfio/libbfio_memory_range.c	2
libfsfat/libcerror/libcerror_error.c	3
libfsfat/libbfio/libbfio_memory_range_io_handle.c	3
libfsfat/libbfio/libbfio_handle.c	9
libfsfat/libcdata/libcdata_range_list.c	15
libfsfat/libcdata/libcdata_list_element.c	10
libfsfat/libcdata/libcdata_range_list_value.c	3
libfsfat/libfsfat/libfsfat_volume.c	5
libfsfat/libfsfat/libfsfat_io_handle.c	3
libfsfat/libcthreads/libcthreads_read_write_lock.c	4
libfsfat/libcerror/libcerror_system.c	2
libfsfat/libfsfat/libfsfat_boot_record.c	4
libfsfat/libfsfat/libfsfat_file_system.c	7
libfsfat/libfcache/libfcache_date_time.c	1
libfsfat/libfcache/libfcache_cache.c	2
libfsfat/libcdata/libcdata_array.c	8
libfsfat/libcdata/libcdata_list.c	3
libfsfat/libfcache/libfcache_cache_value.c	1
libfsfat/libfsfat/libfsfat_allocation_table.c	4
libfsfat/libfsfat/libfsfat_directory.c	2
libfsfat/libfsfat/libfsfat_directory_entry.c	5
libfsfat/libfsfat/libfsfat_block_tree.c	3
libfsfat/libfsfat/libfsfat_block_tree_node.c	6
libfsfat/libfsfat/libfsfat_block_descriptor.c	2

Fuzzer: libfsext_extended_attribute_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	699	61.8%
gold	[1:9]	32	2.82%
yellow	[10:29]	23	2.03%
greenyellow	[30:49]	27	2.38%
lawngreen	50+	350	30.9%
All colors	1131	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00156	/src/libqcow/libbfio/libbfio_handle.c:1139
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00756	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
36	36	1 : View List ['libfsext_bitmap_free']	36	108	libfsext_internal_volume_read_block_groups	call site: 00363	/src/libfsext/libfsext/libfsext_volume.c:1588
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	440	1 : View List ['libfsext_internal_file_entry_get_extended_attributes']	0	753	libfsext_file_entry_get_extended_attribute_by_index	call site: 01083	/src/libfsext/libfsext/libfsext_file_entry.c:2559
0	249	1 : View List ['libfsext_volume_close']	0	526	libfsext_volume_free	call site: 01123	/src/libfsext/libfsext/libfsext_volume.c:194
0	212	5 : View List ['libfsext_extents_header_free', 'libfsext_extent_index_free', 'libfsext_extent_free', 'libcerror_error_set', 'libfsext_extents_footer_free']	0	212	libfsext_extents_read_data	call site: 00512	/src/libfsext/libfsext/libfsext_extents.c:640
0	174	2 : View List ['libfsext_file_entry_free', 'libcerror_error_set']	0	174	libfsext_volume_get_file_entry_by_utf8_path	call site: 01037	/src/libfsext/libfsext/libfsext_volume.c:3835
0	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	0	142	libfdata_segments_array_append_segment	call site: 00707	/src/libqcow/libfdata/libfdata_segments_array.c:592
0	132	3 : View List ['libfdata_stream_free', 'libfsext_buffer_data_handle_free', 'libcerror_error_set']	0	132	libfsext_block_stream_initialize_from_data	call site: 00999	/src/libfsext/libfsext/libfsext_block_stream.c:122
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00378	/src/libqcow/libfdata/libfdata_vector.c:180

Runtime coverage analysis

Covered functions

180

Functions that are reachable but not covered

39

Reachable functions

219

Percentage of reachable functions covered

82.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsext/ossfuzz/extended_attribute_fuzzer.cc	1
libfsext/libbfio/libbfio_memory_range.c	2
libfsext/libcerror/libcerror_error.c	3
libfsext/libbfio/libbfio_memory_range_io_handle.c	3
libfsext/libbfio/libbfio_handle.c	10
libfsext/libcdata/libcdata_range_list.c	15
libfsext/libcdata/libcdata_list_element.c	10
libfsext/libcdata/libcdata_range_list_value.c	3
libfsext/libfsext/libfsext_volume.c	8
libfsext/libfsext/libfsext_io_handle.c	3
libfsext/libcdata/libcdata_array.c	10
libfsext/libcthreads/libcthreads_read_write_lock.c	4
libfsext/libcerror/libcerror_system.c	2
libfsext/libfsext/libfsext_superblock.c	4
libfsext/libfsext/libfsext_group_descriptor.c	4
libfsext/libfsext/libfsext_bitmap.c	1
libfsext/libfsext/libfsext_inode_table.c	3
libfsext/libfdata/libfdata_vector.c	6
libfsext/libfcache/libfcache_date_time.c	1
libfsext/libfsext/libfsext_inode.c	11
libfsext/libfsext/libfsext_attributes_block.c	3
libfsext/libfsext/libfsext_attribute_values.c	3
libfsext/libfsext/libfsext_extents.c	4
libfsext/libfsext/libfsext_extents_header.c	3
libfsext/libfsext/libfsext_extent.c	3
libfsext/libfsext/libfsext_extent_index.c	3
libfsext/libfsext/libfsext_extents_footer.c	3
libfsext/libfsext/libfsext_data_blocks.c	4
libfsext/libfsext/libfsext_block.c	3
libfsext/libfdata/libfdata_segments_array.c	2
libfsext/libfdata/libfdata_range.c	4
libfsext/libfcache/libfcache_cache.c	4
libfsext/libcdata/libcdata_list.c	9
libfsext/libfcache/libfcache_cache_value.c	8
libfsext/libfdata/libfdata_mapped_range.c	3
libfsext/libfsext/libfsext_directory.c	6
libfsext/libfsext/libfsext_directory_entry.c	6
libfsext/libfsext/libfsext_block_vector.c	2
libfsext/libuna/libuna_unicode_character.c	1
libfsext/libuna/libuna_utf8_string.c	1
libfsext/libfsext/libfsext_file_entry.c	5
libfsext/libfsext/libfsext_block_stream.c	3
libfsext/libfsext/libfsext_buffer_data_handle.c	2
libfsext/libfdata/libfdata_stream.c	4
libfsext/libfsext/libfsext_block_data_handle.c	1
libfsext/libfsext/libfsext_extended_attribute.c	2

Fuzzer: libesedb_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	666	66.4%
gold	[1:9]	14	1.39%
yellow	[10:29]	22	2.19%
greenyellow	[30:49]	12	1.19%
lawngreen	50+	288	28.7%
All colors	1002	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00142	/src/libqcow/libbfio/libbfio_handle.c:1139
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00462	/src/libqcow/libfcache/libfcache_cache.c:801
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
36	36	1 : View List ['libesedb_root_page_header_free']	36	325	libesedb_page_tree_free	call site: 00601	/src/libesedb/libesedb/libesedb_page_tree.c:235
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	308	1 : View List ['libesedb_file_close']	0	408	libesedb_file_free	call site: 00997	/src/libesedb/libesedb/libesedb_file.c:179
0	268	4 : View List ['free', 'libesedb_block_tree_free', 'libesedb_page_tree_free', 'libcerror_error_set']	0	268	libesedb_catalog_initialize	call site: 00840	/src/libesedb/libesedb/libesedb_catalog.c:158
0	199	3 : View List ['free', 'libesedb_page_tree_free', 'libcerror_error_set']	0	199	libesedb_database_initialize	call site: 00598	/src/libesedb/libesedb/libesedb_database.c:140
0	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	0	142	libfdata_segments_array_append_segment	call site: 00547	/src/libqcow/libfdata/libfdata_segments_array.c:592
0	136	3 : View List ['libesedb_table_definition_free', 'libesedb_catalog_definition_free', 'libcerror_error_set']	0	136	libesedb_catalog_read_value_data	call site: 00904	/src/libesedb/libesedb/libesedb_catalog.c:410
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00333	/src/libqcow/libfdata/libfdata_vector.c:180
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

159

Functions that are reachable but not covered

37

Reachable functions

196

Percentage of reachable functions covered

81.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libesedb/ossfuzz/file_fuzzer.cc	1
libesedb/libbfio/libbfio_memory_range.c	2
libesedb/libcerror/libcerror_error.c	4
libesedb/libbfio/libbfio_memory_range_io_handle.c	3
libesedb/libbfio/libbfio_handle.c	9
libesedb/libcdata/libcdata_range_list.c	15
libesedb/libcdata/libcdata_list_element.c	10
libesedb/libcdata/libcdata_range_list_value.c	3
libesedb/libesedb/libesedb_file.c	5
libesedb/libesedb/libesedb_io_handle.c	5
libesedb/libesedb/libesedb_i18n.c	1
libesedb/libesedb/libesedb_file_header.c	4
libesedb/libesedb/libesedb_checksum.c	2
libesedb/libfdata/libfdata_vector.c	5
libesedb/libcdata/libcdata_array.c	10
libesedb/libfcache/libfcache_date_time.c	1
libesedb/libesedb/libesedb_page.c	13
libesedb/libesedb/libesedb_page_header.c	6
libesedb/libcnotify/libcnotify_print.c	1
libesedb/libesedb/libesedb_page_value.c	2
libesedb/libfdata/libfdata_segments_array.c	2
libesedb/libfdata/libfdata_range.c	4
libesedb/libfcache/libfcache_cache.c	4
libesedb/libcdata/libcdata_list.c	9
libesedb/libfcache/libfcache_cache_value.c	8
libesedb/libfdata/libfdata_mapped_range.c	3
libesedb/libesedb/libesedb_database.c	4
libesedb/libesedb/libesedb_page_tree.c	5
libesedb/libesedb/libesedb_block_tree.c	3
libesedb/libesedb/libesedb_block_tree_node.c	6
libesedb/libcdata/libcdata_btree.c	2
libesedb/libcdata/libcdata_tree_node.c	6
libesedb/libesedb/libesedb_block_descriptor.c	2
libesedb/libesedb/libesedb_root_page_header.c	1
libesedb/libcdata/libcdata_btree_values_list.c	1
libesedb/libesedb/libesedb_leaf_page_descriptor.c	1
libesedb/libesedb/libesedb_page_tree_value.c	3
libesedb/libesedb/libesedb_catalog.c	5
libesedb/libesedb/libesedb_catalog_definition.c	3
libesedb/libesedb/libesedb_table_definition.c	6

Fuzzer: libregf_key_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	841	73.1%
gold	[1:9]	10	0.87%
yellow	[10:29]	16	1.39%
greenyellow	[30:49]	8	0.69%
lawngreen	50+	274	23.8%
All colors	1149	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00152	/src/libqcow/libbfio/libbfio_handle.c:1139
75	75	1 : View List ['libfdata_list_calculate_mapped_ranges']	75	551	libfdata_list_get_element_index_at_offset	call site: 00659	/src/libevt/libfdata/libfdata_list.c:3171
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00430	/src/libqcow/libfcache/libfcache_cache.c:801
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00622	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	253	1 : View List ['libregf_file_close']	0	452	libregf_file_free	call site: 01144	/src/libregf/libregf/libregf_file.c:183
0	171	3 : View List ['free', 'libcerror_error_set', 'libregf_key_item_free']	0	171	libregf_key_initialize	call site: 01078	/src/libregf/libregf/libregf_key.c:155
0	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	0	147	libfdata_list_append_element	call site: 00561	/src/libevt/libfdata/libfdata_list.c:1489
0	131	3 : View List ['libregf_sub_key_list_free', 'libcdata_array_empty', 'libcerror_error_set']	0	131	libregf_key_item_read_sub_keys_list	call site: 00927	/src/libregf/libregf/libregf_key_item.c:1453
0	124	3 : View List ['libcerror_error_set', 'libregf_hive_bin_header_free', 'libregf_hive_bin_free']	0	124	libregf_hive_bins_list_read_element_data	call site: 00497	/src/libregf/libregf/libregf_hive_bins_list.c:736
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

158

Functions that are reachable but not covered

96

Reachable functions

254

Percentage of reachable functions covered

62.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libregf/ossfuzz/key_fuzzer.cc	1
libregf/libbfio/libbfio_memory_range.c	2
libregf/libcerror/libcerror_error.c	3
libregf/libbfio/libbfio_memory_range_io_handle.c	3
libregf/libbfio/libbfio_handle.c	10
libregf/libcdata/libcdata_range_list.c	15
libregf/libcdata/libcdata_list_element.c	10
libregf/libcdata/libcdata_range_list_value.c	3
libregf/libregf/libregf_file.c	8
libregf/libregf/libregf_io_handle.c	3
libregf/libcthreads/libcthreads_read_write_lock.c	4
libregf/libcerror/libcerror_system.c	2
libregf/libregf/libregf_file_header.c	4
libregf/libregf/libregf_checksum.c	1
libregf/libregf/libregf_hive_bins_list.c	7
libregf/libfdata/libfdata_list.c	9
libregf/libcdata/libcdata_array.c	10
libregf/libregf/libregf_hive_bin_header.c	4
libregf/libregf/libregf_hive_bin.c	5
libregf/libregf/libregf_hive_bin_cell.c	2
libregf/libfdata/libfdata_list_element.c	8
libregf/libfdata/libfdata_range.c	4
libregf/libfcache/libfcache_cache.c	4
libregf/libcdata/libcdata_list.c	9
libregf/libfcache/libfcache_cache_value.c	8
libregf/libfdata/libfdata_mapped_range.c	4
libregf/libfcache/libfcache_date_time.c	1
libregf/libregf/libregf_dirty_vector.c	4
libregf/libregf/libregf_key.c	4
libregf/libregf/libregf_key_item.c	11
libregf/libregf/libregf_named_key.c	3
libregf/libuna/libuna_unicode_character.c	4
libregf/libuna/libuna_codepage_koi8_r.c	1
libregf/libuna/libuna_codepage_koi8_u.c	1
libregf/libuna/libuna_codepage_mac_arabic.c	1
libregf/libuna/libuna_codepage_mac_celtic.c	1
libregf/libuna/libuna_codepage_mac_centraleurroman.c	1
libregf/libuna/libuna_codepage_mac_croatian.c	1
libregf/libuna/libuna_codepage_mac_cyrillic.c	1
libregf/libuna/libuna_codepage_mac_dingbats.c	1
libregf/libuna/libuna_codepage_mac_farsi.c	1
libregf/libuna/libuna_codepage_mac_gaelic.c	1
libregf/libuna/libuna_codepage_mac_greek.c	1
libregf/libuna/libuna_codepage_mac_icelandic.c	1
libregf/libuna/libuna_codepage_mac_inuit.c	1
libregf/libuna/libuna_codepage_mac_roman.c	1
libregf/libuna/libuna_codepage_mac_romanian.c	1
libregf/libuna/libuna_codepage_mac_russian.c	1
libregf/libuna/libuna_codepage_mac_symbol.c	1
libregf/libuna/libuna_codepage_mac_thai.c	1
libregf/libuna/libuna_codepage_mac_turkish.c	1
libregf/libuna/libuna_codepage_mac_ukrainian.c	1
libregf/libuna/libuna_codepage_windows_874.c	1
libregf/libuna/libuna_codepage_windows_932.c	1
libregf/libuna/libuna_codepage_windows_936.c	1
libregf/libuna/libuna_codepage_windows_949.c	1
libregf/libuna/libuna_codepage_windows_950.c	1
libregf/libuna/libuna_codepage_windows_1250.c	1
libregf/libuna/libuna_codepage_windows_1251.c	1
libregf/libuna/libuna_codepage_windows_1252.c	1
libregf/libuna/libuna_codepage_windows_1253.c	1
libregf/libuna/libuna_codepage_windows_1254.c	1
libregf/libuna/libuna_codepage_windows_1255.c	1
libregf/libuna/libuna_codepage_windows_1256.c	1
libregf/libuna/libuna_codepage_windows_1257.c	1
libregf/libuna/libuna_codepage_windows_1258.c	1
libregf/libregf/libregf_security_key.c	3
libregf/libregf/libregf_sub_key_list.c	3
libregf/libregf/libregf_key_descriptor.c	2
libregf/libregf/libregf_value_item.c	6
libregf/libregf/libregf_value_key.c	4
libregf/libregf/libregf_data_block_key.c	3
libregf/libfdata/libfdata_stream.c	4
libregf/libregf/libregf_data_block_stream.c	1
libregf/libfdata/libfdata_segments_array.c	1
libregf/libuna/libuna_utf16_string.c	1

Fuzzer: libfshfs_extended_attribute_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	869	63.0%
gold	[1:9]	55	3.99%
yellow	[10:29]	29	2.10%
greenyellow	[30:49]	20	1.45%
lawngreen	50+	405	29.3%
All colors	1378	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00143	/src/libqcow/libbfio/libbfio_handle.c:1139
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00589	/src/libqcow/libfcache/libfcache_cache.c:801
64	64	1 : View List ['libfdata_stream_free']	64	344	libfshfs_file_entry_free	call site: 01217	/src/libfshfs/libfshfs/libfshfs_file_entry.c:320
64	64	1 : View List ['libfdata_stream_free']	64	174	libfshfs_extended_attribute_free	call site: 01344	/src/libfshfs/libfshfs/libfshfs_extended_attribute.c:197
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01057	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
36	36	1 : View List ['libfshfs_compressed_data_header_free']	100	490	libfshfs_file_entry_free	call site: 01213	/src/libfshfs/libfshfs/libfshfs_file_entry.c:287
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	1841	1 : View List ['libfshfs_internal_file_entry_get_attributes']	0	2155	libfshfs_file_entry_get_extended_attribute_by_index	call site: 01332	/src/libfshfs/libfshfs/libfshfs_file_entry.c:3592
0	1653	1 : View List ['libfshfs_catalog_btree_file_get_directory_entry_by_identifier']	0	1745	libfshfs_catalog_btree_file_get_directory_entry_by_utf8_path	call site: 01079	/src/libfshfs/libfshfs/libfshfs_catalog_btree_file.c:2628
0	309	1 : View List ['libfshfs_volume_close']	0	508	libfshfs_volume_free	call site: 01373	/src/libfshfs/libfshfs/libfshfs_volume.c:171
0	198	3 : View List ['libcerror_error_set', 'libfshfs_btree_file_free', 'libfshfs_btree_node_cache_free']	0	198	libfshfs_file_system_read_catalog_file	call site: 00712	/src/libfshfs/libfshfs/libfshfs_file_system.c:591

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

75

Reachable functions

279

Percentage of reachable functions covered

73.12%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfshfs/ossfuzz/extended_attribute_fuzzer.cc	1
libfshfs/libbfio/libbfio_memory_range.c	2
libfshfs/libcerror/libcerror_error.c	3
libfshfs/libbfio/libbfio_memory_range_io_handle.c	3
libfshfs/libbfio/libbfio_handle.c	8
libfshfs/libcdata/libcdata_range_list.c	15
libfshfs/libcdata/libcdata_list_element.c	10
libfshfs/libcdata/libcdata_range_list_value.c	3
libfshfs/libfshfs/libfshfs_volume.c	6
libfshfs/libfshfs/libfshfs_io_handle.c	3
libfshfs/libcthreads/libcthreads_read_write_lock.c	4
libfshfs/libcerror/libcerror_system.c	2
libfshfs/libfshfs/libfshfs_master_directory_block.c	4
libfshfs/libfshfs/libfshfs_fork_descriptor.c	5
libfshfs/libfshfs/libfshfs_extents_record.c	1
libfshfs/libfshfs/libfshfs_volume_header.c	4
libfshfs/libfshfs/libfshfs_file_system.c	9
libfshfs/libfshfs/libfshfs_btree_file.c	5
libfshfs/libcdata/libcdata_array.c	9
libfshfs/libfshfs/libfshfs_btree_header.c	3
libfshfs/libfshfs/libfshfs_extent.c	2
libfshfs/libfshfs/libfshfs_btree_node_descriptor.c	3
libfshfs/libfshfs/libfshfs_btree_node_vector.c	3
libfshfs/libfcache/libfcache_date_time.c	1
libfshfs/libfshfs/libfshfs_btree_node_cache.c	2
libfshfs/libfcache/libfcache_cache.c	4
libfshfs/libcdata/libcdata_list.c	9
libfshfs/libfshfs/libfshfs_extents_btree_file.c	6
libfshfs/libfcache/libfcache_cache_value.c	8
libfshfs/libfshfs/libfshfs_btree_node.c	8
libfshfs/libfshfs/libfshfs_btree_node_record.c	2
libfshfs/libfshfs/libfshfs_extents_btree_key.c	3
libfshfs/libfshfs/libfshfs_catalog_btree_file.c	13
libfshfs/libfshfs/libfshfs_catalog_btree_key.c	5
libfshfs/libfshfs/libfshfs_thread_record.c	3
libfshfs/libfshfs/libfshfs_name.c	4
libfshfs/libuna/libuna_unicode_character.c	3
libfshfs/libuna/libuna_codepage_koi8_r.c	1
libfshfs/libuna/libuna_codepage_koi8_u.c	1
libfshfs/libuna/libuna_codepage_mac_arabic.c	1
libfshfs/libuna/libuna_codepage_mac_celtic.c	1
libfshfs/libuna/libuna_codepage_mac_centraleurroman.c	1
libfshfs/libuna/libuna_codepage_mac_croatian.c	1
libfshfs/libuna/libuna_codepage_mac_cyrillic.c	1
libfshfs/libuna/libuna_codepage_mac_dingbats.c	1
libfshfs/libuna/libuna_codepage_mac_farsi.c	1
libfshfs/libuna/libuna_codepage_mac_gaelic.c	1
libfshfs/libuna/libuna_codepage_mac_greek.c	1
libfshfs/libuna/libuna_codepage_mac_icelandic.c	1
libfshfs/libuna/libuna_codepage_mac_inuit.c	1
libfshfs/libuna/libuna_codepage_mac_roman.c	1
libfshfs/libuna/libuna_codepage_mac_romanian.c	1
libfshfs/libuna/libuna_codepage_mac_russian.c	1
libfshfs/libuna/libuna_codepage_mac_symbol.c	1
libfshfs/libuna/libuna_codepage_mac_thai.c	1
libfshfs/libuna/libuna_codepage_mac_turkish.c	1
libfshfs/libuna/libuna_codepage_mac_ukrainian.c	1
libfshfs/libuna/libuna_codepage_windows_874.c	1
libfshfs/libuna/libuna_codepage_windows_932.c	1
libfshfs/libuna/libuna_codepage_windows_936.c	1
libfshfs/libuna/libuna_codepage_windows_949.c	1
libfshfs/libuna/libuna_codepage_windows_950.c	1
libfshfs/libuna/libuna_codepage_windows_1250.c	1
libfshfs/libuna/libuna_codepage_windows_1251.c	1
libfshfs/libuna/libuna_codepage_windows_1252.c	1
libfshfs/libuna/libuna_codepage_windows_1253.c	1
libfshfs/libuna/libuna_codepage_windows_1254.c	1
libfshfs/libuna/libuna_codepage_windows_1255.c	1
libfshfs/libuna/libuna_codepage_windows_1256.c	1
libfshfs/libuna/libuna_codepage_windows_1257.c	1
libfshfs/libuna/libuna_codepage_windows_1258.c	1
libfshfs/libfshfs/libfshfs_directory_record.c	6
libfshfs/libfshfs/libfshfs_file_record.c	7
libfshfs/libfshfs/libfshfs_directory_entry.c	9
libfshfs/libfshfs/libfshfs_file_entry.c	6
libfshfs/libfshfs/libfshfs_compressed_data_header.c	1
libfshfs/libfdata/libfdata_stream.c	1
libfshfs/libfdata/libfdata_range.c	1
libfshfs/libfdata/libfdata_mapped_range.c	1
libfshfs/libfshfs/libfshfs_attribute_record.c	4
libfshfs/libfshfs/libfshfs_attributes_btree_file.c	6
libfshfs/libfshfs/libfshfs_attributes_btree_key.c	3
libfshfs/libfshfs/libfshfs_extended_attribute.c	2

Fuzzer: libhmac_sha224_context_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	84.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	8	16.0%
All colors	50	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	68	2 : View List ['libhmac_sha224_context_free', 'libcerror_error_set']	32	68	libhmac_sha224_calculate	call site: 00046	/src/libhmac/libhmac/libhmac_sha224.c:196
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha224_context_transform	call site: 00027	/src/libhmac/libhmac/libhmac_sha224_context.c:420
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha224_context_initialize	call site: 00013	/src/libhmac/libhmac/libhmac_sha224_context.c:592
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha224_context_free	call site: 00046	/src/libhmac/libhmac/libhmac_sha224_context.c:631
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha224_context_update	call site: 00032	/src/libhmac/libhmac/libhmac_sha224_context.c:987
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha224_context_finalize	call site: 00043	/src/libhmac/libhmac/libhmac_sha224_context.c:1330
0	0	None	192	274	libhmac_sha224_context_update	call site: 00019	/src/libhmac/libhmac/libhmac_sha224_context.c:888
0	0	None	32	68	libhmac_sha224_calculate	call site: 00002	/src/libhmac/libhmac/libhmac_sha224.c:153
0	0	None	32	68	libhmac_sha224_calculate	call site: 00016	/src/libhmac/libhmac/libhmac_sha224.c:166
0	0	None	32	68	libhmac_sha224_calculate	call site: 00035	/src/libhmac/libhmac/libhmac_sha224.c:181
0	0	None	32	32	libhmac_sha224_context_transform	call site: 00022	/src/libhmac/libhmac/libhmac_sha224_context.c:248
0	0	None	32	32	libhmac_sha224_context_transform	call site: 00023	/src/libhmac/libhmac/libhmac_sha224_context.c:259

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

6

Reachable functions

13

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libhmac/ossfuzz/sha224_context_fuzzer.cc	1
libhmac/libhmac/libhmac_sha224.c	1
libhmac/libhmac/libhmac_sha224_context.c	5
libhmac/libcerror/libcerror_error.c	3

Fuzzer: libhmac_sha1_context_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	84.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	8	16.0%
All colors	50	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	68	2 : View List ['libhmac_sha1_context_free', 'libcerror_error_set']	32	68	libhmac_sha1_calculate	call site: 00046	/src/libhmac/libhmac/libhmac_sha1.c:196
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha1_context_transform	call site: 00027	/src/libhmac/libhmac/libhmac_sha1_context.c:461
32	32	2 : View List ['free', 'libcerror_error_set']	32	32	libhmac_sha1_context_initialize	call site: 00013	/src/libhmac/libhmac/libhmac_sha1_context.c:633
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha1_context_free	call site: 00046	/src/libhmac/libhmac/libhmac_sha1_context.c:672
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha1_context_update	call site: 00032	/src/libhmac/libhmac/libhmac_sha1_context.c:1028
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha1_context_finalize	call site: 00043	/src/libhmac/libhmac/libhmac_sha1_context.c:1362
0	0	None	192	274	libhmac_sha1_context_update	call site: 00019	/src/libhmac/libhmac/libhmac_sha1_context.c:929
0	0	None	32	68	libhmac_sha1_calculate	call site: 00002	/src/libhmac/libhmac/libhmac_sha1.c:153
0	0	None	32	68	libhmac_sha1_calculate	call site: 00016	/src/libhmac/libhmac/libhmac_sha1.c:166
0	0	None	32	68	libhmac_sha1_calculate	call site: 00035	/src/libhmac/libhmac/libhmac_sha1.c:181
0	0	None	32	32	libhmac_sha1_context_transform	call site: 00022	/src/libhmac/libhmac/libhmac_sha1_context.c:287
0	0	None	32	32	libhmac_sha1_context_transform	call site: 00023	/src/libhmac/libhmac/libhmac_sha1_context.c:298

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

6

Reachable functions

13

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libhmac/ossfuzz/sha1_context_fuzzer.cc	1
libhmac/libhmac/libhmac_sha1.c	1
libhmac/libhmac/libhmac_sha1_context.c	5
libhmac/libcerror/libcerror_error.c	3

Fuzzer: libfsxfs_file_entry_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	693	60.3%
gold	[1:9]	25	2.17%
yellow	[10:29]	17	1.48%
greenyellow	[30:49]	21	1.82%
lawngreen	50+	392	34.1%
All colors	1148	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00145	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
63	63	1 : View List ['libfdata_segments_array_calculate_mapped_ranges']	63	539	libfdata_stream_get_segment_index_at_offset	call site: 01035	/src/libfsfat/libfdata/libfdata_stream.c:1085
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00837	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00403	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00662	/src/libqcow/libfdata/libfdata_segments_array.c:592
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	601	1 : View List ['libfsxfs_internal_file_entry_get_directory']	0	2378	libfsxfs_file_entry_get_sub_file_entry_by_index	call site: 00845	/src/libfsxfs/libfsxfs/libfsxfs_file_entry.c:2940
0	490	1 : View List ['libfsxfs_extent_btree_get_extents_from_branch_node']	0	682	libfsxfs_extent_btree_get_extents_from_node	call site: 00577	/src/libfsxfs/libfsxfs/libfsxfs_extent_btree.c:698
0	206	1 : View List ['libfsxfs_volume_close']	0	405	libfsxfs_volume_free	call site: 01142	/src/libfsxfs/libfsxfs/libfsxfs_volume.c:180
0	174	2 : View List ['libcerror_error_set', 'libfsxfs_file_entry_free']	0	174	libfsxfs_volume_get_root_directory	call site: 00711	/src/libfsxfs/libfsxfs/libfsxfs_volume.c:1721
0	166	4 : View List ['libfsxfs_block_directory_free', 'libfsxfs_directory_table_free', 'libcdata_array_empty', 'libcerror_error_set']	0	166	libfsxfs_directory_read_file_io_handle	call site: 00771	/src/libfsxfs/libfsxfs/libfsxfs_directory.c:301

Runtime coverage analysis

Covered functions

188

Functions that are reachable but not covered

46

Reachable functions

234

Percentage of reachable functions covered

80.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsxfs/ossfuzz/file_entry_fuzzer.cc	1
libfsxfs/libbfio/libbfio_memory_range.c	2
libfsxfs/libcerror/libcerror_error.c	3
libfsxfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsxfs/libbfio/libbfio_handle.c	9
libfsxfs/libcdata/libcdata_range_list.c	15
libfsxfs/libcdata/libcdata_list_element.c	10
libfsxfs/libcdata/libcdata_range_list_value.c	3
libfsxfs/libfsxfs/libfsxfs_volume.c	6
libfsxfs/libfsxfs/libfsxfs_io_handle.c	3
libfsxfs/libcthreads/libcthreads_read_write_lock.c	6
libfsxfs/libcerror/libcerror_system.c	2
libfsxfs/libfsxfs/libfsxfs_superblock.c	4
libfsxfs/libfsxfs/libfsxfs_file_system.c	4
libfsxfs/libfsxfs/libfsxfs_inode_btree.c	7
libfsxfs/libcdata/libcdata_array.c	9
libfsxfs/libfsxfs/libfsxfs_inode_information.c	4
libfsxfs/libfsxfs/libfsxfs_btree_block.c	4
libfsxfs/libfsxfs/libfsxfs_btree_header.c	3
libfsxfs/libfsxfs/libfsxfs_inode_btree_record.c	3
libfsxfs/libfsxfs/libfsxfs_inode.c	17
libfsxfs/libfsxfs/libfsxfs_extent_list.c	1
libfsxfs/libfsxfs/libfsxfs_extents.c	2
libfsxfs/libfsxfs/libfsxfs_extent.c	3
libfsxfs/libfsxfs/libfsxfs_extent_btree.c	5
libfsxfs/libfsxfs/libfsxfs_file_entry.c	24
libfsxfs/libfsxfs/libfsxfs_data_stream.c	3
libfsxfs/libfsxfs/libfsxfs_buffer_data_handle.c	2
libfsxfs/libfdata/libfdata_stream.c	9
libfsxfs/libfdata/libfdata_segments_array.c	2
libfsxfs/libfdata/libfdata_mapped_range.c	4
libfsxfs/libfdata/libfdata_range.c	4
libfsxfs/libfsxfs/libfsxfs_block_data_handle.c	1
libfsxfs/libfsxfs/libfsxfs_directory_entry.c	5
libfsxfs/libfsxfs/libfsxfs_attribute_values.c	1
libfsxfs/libfsxfs/libfsxfs_directory.c	5
libfsxfs/libfsxfs/libfsxfs_directory_table.c	3
libfsxfs/libfsxfs/libfsxfs_directory_table_header.c	3
libfsxfs/libfsxfs/libfsxfs_block_directory.c	4
libfsxfs/libfsxfs/libfsxfs_block_directory_header.c	3
libfsxfs/libfsxfs/libfsxfs_block_directory_footer.c	3
libfsxfs/libuna/libuna_utf8_string.c	3
libfsxfs/libuna/libuna_unicode_character.c	3

Fuzzer: libmodi_handle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1350	79.2%
gold	[1:9]	28	1.64%
yellow	[10:29]	7	0.41%
greenyellow	[30:49]	16	0.93%
lawngreen	50+	303	17.7%
All colors	1704	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	2 : View List ['libbfio_pool_close_all', 'libbfio_pool_free']	264	1102	libmodi_handle_close	call site: 01650	/src/libmodi/libmodi/libmodi_handle.c:2324
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00162	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 01285	/src/libqcow/libcdata/libcdata_list.c:238
85	85	8 : View List ['getc', 'fread', 'ferror', '__errno_location', 'libfplist_xml_scanner_realloc', 'yy_fatal_error', 'libfplist_xml_scanner_restart', 'clearerr']	85	85	yy_get_next_buffer	call site: 00907	/src/libfplist/libfplist/libfplist_xml_scanner.c:158629
80	80	1 : View List ['libfvalue_utf8_string_copy_to_integer']	80	112	libfplist_property_get_value_integer	call site: 01387	/src/libfplist/libfplist/libfplist_property.c:591
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01638	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	346	1 : View List ['libmodi_handle_close']	0	545	libmodi_handle_free	call site: 01697	/src/libmodi/libmodi/libmodi_handle.c:206
0	341	2 : View List ['libfplist_property_get_value_integer', 'libfplist_property_get_sub_property_by_utf8_name']	0	1007	libmodi_sparse_bundle_xml_plist_read_data	call site: 01384	/src/libmodi/libmodi/libmodi_sparse_bundle_xml_plist.c:285
0	251	4 : View List ['libmodi_block_chunks_data_handle_free', 'libmodi_udif_xml_plist_free', 'libcerror_error_set', 'libmodi_udif_resource_file_free']	0	251	libmodi_internal_handle_open_read_udif_image	call site: 01277	/src/libmodi/libmodi/libmodi_handle.c:3489
0	205	3 : View List ['libfplist_property_free', 'libcerror_error_set', 'libfplist_property_list_free']	0	205	libmodi_udif_xml_plist_read_data	call site: 01194	/src/libmodi/libmodi/libmodi_udif_xml_plist.c:652

Runtime coverage analysis

Covered functions

163

Functions that are reachable but not covered

152

Reachable functions

315

Percentage of reachable functions covered

51.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libmodi/ossfuzz/handle_fuzzer.cc	1
libmodi/libbfio/libbfio_memory_range.c	2
libmodi/libcerror/libcerror_error.c	3
libmodi/libbfio/libbfio_memory_range_io_handle.c	3
libmodi/libbfio/libbfio_handle.c	9
libmodi/libcdata/libcdata_range_list.c	15
libmodi/libcdata/libcdata_list_element.c	10
libmodi/libcdata/libcdata_range_list_value.c	3
libmodi/libmodi/libmodi_handle.c	8
libmodi/libmodi/libmodi_io_handle.c	3
libmodi/libmodi/libmodi_i18n.c	1
libmodi/libcthreads/libcthreads_read_write_lock.c	4
libmodi/libcerror/libcerror_system.c	2
libmodi/libmodi/libmodi_udif_resource_file.c	4
libmodi/libmodi/libmodi_block_chunks_data_handle.c	4
libmodi/libfdata/libfdata_list.c	13
libmodi/libcdata/libcdata_array.c	8
libmodi/libmodi/libmodi_data_block.c	4
libmodi/libfdata/libfdata_list_element.c	9
libmodi/libmodi/libmodi_compression.c	1
libmodi/libfmos/libfmos_adc.c	1
libmodi/libmodi/libmodi_bzip.c	13
libmodi/libmodi/libmodi_bit_stream.c	3
libmodi/libmodi/libmodi_huffman_tree.c	4
libmodi/libmodi/libmodi_deflate.c	8
libmodi/libfmos/libfmos_lzfse.c	9
libmodi/libfmos/libfmos_lzfse_decoder.c	2
libmodi/libfmos/libfmos_lzfse_bit_stream.c	3
libmodi/libfmos/libfmos_lzvn.c	1
libmodi/libfdata/libfdata_range.c	5
libmodi/libfcache/libfcache_cache.c	4
libmodi/libcdata/libcdata_list.c	9
libmodi/libfcache/libfcache_cache_value.c	8
libmodi/libfdata/libfdata_mapped_range.c	4
libmodi/libmodi/libmodi_udif_xml_plist.c	8
libmodi/libfplist/libfplist_property_list.c	5
libmodi/libfplist/libfplist_xml_parser.c	3
libmodi/libfplist/libfplist_xml_scanner.c	17
libmodi/libfplist/libfplist_xml_scanner.l	5
libmodi/libfplist/libfplist_xml_tag.c	9
libmodi/libfplist/libfplist_xml_attribute.c	2
libmodi/libfplist/libfplist_property.c	8
libmodi/libuna/libuna_base64_stream.c	5
libmodi/libmodi/libmodi_udif_block_table.c	5
libmodi/libmodi/libmodi_udif_block_table_entry.c	3
libmodi/libfcache/libfcache_date_time.c	1
libmodi/libmodi/libmodi_sparse_image_header.c	4
libmodi/libmodi/libmodi_bands_data_handle.c	4
libmodi/libfdata/libfdata_vector.c	7
libmodi/libfdata/libfdata_segments_array.c	3
libmodi/libmodi/libmodi_sparse_bundle_xml_plist.c	4
libmodi/libfvalue/libfvalue_integer.c	2
libmodi/libfdata/libfdata_stream.c	3
libmodi/libbfio/libbfio_pool.c	3

Fuzzer: libfcrypto_crypt_serpent_cbc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	43	84.3%
gold	[1:9]	1	1.96%
yellow	[10:29]	1	1.96%
greenyellow	[30:49]	1	1.96%
lawngreen	50+	5	9.80%
All colors	51	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfcrypto_serpent_context_initialize	call site: 00011	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:609
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_serpent_context_free	call site: 00049	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:663
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_serpent_context_set_key	call site: 00018	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:775
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_internal_serpent_context_encrypt_block	call site: 00034	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:1541
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_serpent_crypt_cbc	call site: 00046	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:2564
0	0	None	41	274	libfcrypto_serpent_crypt_cbc	call site: 00029	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:2426
0	0	None	0	32	libfcrypto_serpent_context_initialize	call site: 00001	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:573
0	0	None	0	32	libfcrypto_serpent_context_initialize	call site: 00002	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:584
0	0	None	0	32	libfcrypto_serpent_context_initialize	call site: 00010	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:598
0	0	None	0	32	libfcrypto_serpent_context_free	call site: 00048	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:647
0	0	None	0	32	libfcrypto_serpent_context_set_key	call site: 00013	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:706

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

6

Reachable functions

13

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfcrypto/ossfuzz/crypt_serpent_cbc_fuzzer.cc	1
libfcrypto/libfcrypto/libfcrypto_serpent_context.c	6
libfcrypto/libcerror/libcerror_error.c	3

Fuzzer: libcreg_value_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	595	62.0%
gold	[1:9]	16	1.66%
yellow	[10:29]	6	0.62%
greenyellow	[30:49]	8	0.83%
lawngreen	50+	334	34.8%
All colors	959	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00614	/src/libqcow/libfcache/libfcache_cache.c:801
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00725	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	264	1 : View List ['libcdata_range_list_insert_range']	0	360	libbfio_internal_handle_read_buffer	call site: 00147	/src/libqcow/libbfio/libbfio_handle.c:1139
0	255	1 : View List ['libcreg_file_close']	0	454	libcreg_file_free	call site: 00952	/src/libcreg/libcreg/libcreg_file.c:176
0	215	6 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcdata_list_element_set_elements', 'libcdata_range_list_value_free', 'libcerror_error_set']	0	215	libcdata_internal_range_list_insert_range_before_element	call site: 00207	/src/libqcow/libcdata/libcdata_range_list.c:1813
0	190	3 : View List ['libfdata_area_free', 'libfcache_cache_free', 'libcerror_error_set']	0	190	libcreg_key_navigation_read_file_io_handle	call site: 00472	/src/libcreg/libcreg/libcreg_key_navigation.c:446
0	165	3 : View List ['libfdata_list_free', 'libcreg_data_block_free', 'libcerror_error_set']	0	165	libcreg_key_navigation_read_data_blocks	call site: 00688	/src/libcreg/libcreg/libcreg_key_navigation.c:680
0	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	0	147	libfdata_list_append_element	call site: 00678	/src/libevt/libfdata/libfdata_list.c:1489
0	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	0	142	libfdata_segments_array_append_segment	call site: 00463	/src/libqcow/libfdata/libfdata_segments_array.c:592
0	140	3 : View List ['free', 'libcreg_key_item_free', 'libcerror_error_set']	0	140	libcreg_key_initialize	call site: 00867	/src/libcreg/libcreg/libcreg_key.c:143
0	137	4 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element', 'libcdata_list_element_set_elements']	0	137	libcdata_list_remove_element	call site: 00819	/src/libqcow/libcdata/libcdata_list.c:2812

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

19

Reachable functions

190

Percentage of reachable functions covered

90.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libcreg/ossfuzz/value_fuzzer.cc	1
libcreg/libbfio/libbfio_memory_range.c	2
libcreg/libcerror/libcerror_error.c	3
libcreg/libbfio/libbfio_memory_range_io_handle.c	3
libcreg/libbfio/libbfio_handle.c	10
libcreg/libcdata/libcdata_range_list.c	16
libcreg/libcdata/libcdata_list_element.c	10
libcreg/libcdata/libcdata_range_list_value.c	3
libcreg/libcreg/libcreg_file.c	6
libcreg/libcreg/libcreg_io_handle.c	5
libcreg/libcthreads/libcthreads_read_write_lock.c	4
libcreg/libcerror/libcerror_system.c	2
libcreg/libcreg/libcreg_key_navigation.c	8
libcreg/libfdata/libfdata_area.c	5
libcreg/libcdata/libcdata_array.c	9
libcreg/libfcache/libfcache_date_time.c	1
libcreg/libcreg/libcreg_key_hierarchy_entry.c	3
libcreg/libfdata/libfdata_segments_array.c	2
libcreg/libfdata/libfdata_range.c	5
libcreg/libfcache/libfcache_cache.c	7
libcreg/libfcache/libfcache_cache_value.c	8
libcreg/libcdata/libcdata_list.c	9
libcreg/libfdata/libfdata_mapped_range.c	3
libcreg/libfdata/libfdata_list.c	7
libcreg/libcreg/libcreg_data_block.c	5
libcreg/libcreg/libcreg_key_name_entry.c	6
libcreg/libcreg/libcreg_value_entry.c	3
libcreg/libfdata/libfdata_list_element.c	7
libcreg/libcreg/libcreg_key.c	6
libcreg/libcreg/libcreg_key_item.c	7
libcreg/libcreg/libcreg_key_descriptor.c	2
libcreg/libcreg/libcreg_value.c	3

Fuzzer: libfsext_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	759	80.9%
gold	[1:9]	5	0.53%
yellow	[10:29]	5	0.53%
greenyellow	[30:49]	7	0.74%
lawngreen	50+	162	17.2%
All colors	938	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00156	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00735	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00774	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00756	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00707	/src/libqcow/libfdata/libfdata_segments_array.c:592
36	36	1 : View List ['libfsext_bitmap_free']	36	108	libfsext_internal_volume_read_block_groups	call site: 00363	/src/libfsext/libfsext/libfsext_volume.c:1588
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	249	1 : View List ['libfsext_volume_close']	0	526	libfsext_volume_free	call site: 00929	/src/libfsext/libfsext/libfsext_volume.c:194
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00378	/src/libqcow/libfdata/libfdata_vector.c:180
0	118	1 : View List ['libfsext_inode_table_free']	0	198	libfsext_internal_volume_open_read	call site: 00728	/src/libfsext/libfsext/libfsext_volume.c:1059
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

95

Functions that are reachable but not covered

93

Reachable functions

188

Percentage of reachable functions covered

50.53%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsext/ossfuzz/volume_fuzzer.cc	1
libfsext/libbfio/libbfio_memory_range.c	2
libfsext/libcerror/libcerror_error.c	3
libfsext/libbfio/libbfio_memory_range_io_handle.c	3
libfsext/libbfio/libbfio_handle.c	10
libfsext/libcdata/libcdata_range_list.c	15
libfsext/libcdata/libcdata_list_element.c	10
libfsext/libcdata/libcdata_range_list_value.c	3
libfsext/libfsext/libfsext_volume.c	16
libfsext/libfsext/libfsext_io_handle.c	3
libfsext/libcdata/libcdata_array.c	9
libfsext/libcthreads/libcthreads_read_write_lock.c	6
libfsext/libcerror/libcerror_system.c	2
libfsext/libfsext/libfsext_superblock.c	9
libfsext/libfsext/libfsext_group_descriptor.c	4
libfsext/libfsext/libfsext_bitmap.c	1
libfsext/libfsext/libfsext_inode_table.c	2
libfsext/libfdata/libfdata_vector.c	4
libfsext/libfcache/libfcache_date_time.c	1
libfsext/libfsext/libfsext_inode.c	6
libfsext/libfsext/libfsext_attributes_block.c	1
libfsext/libfsext/libfsext_attribute_values.c	3
libfsext/libfsext/libfsext_extents.c	4
libfsext/libfsext/libfsext_extents_header.c	3
libfsext/libfsext/libfsext_extent.c	3
libfsext/libfsext/libfsext_extent_index.c	3
libfsext/libfsext/libfsext_extents_footer.c	3
libfsext/libfsext/libfsext_data_blocks.c	4
libfsext/libfsext/libfsext_block.c	3
libfsext/libfdata/libfdata_segments_array.c	2
libfsext/libfdata/libfdata_range.c	4
libfsext/libfcache/libfcache_cache.c	3
libfsext/libcdata/libcdata_list.c	7
libfsext/libfcache/libfcache_cache_value.c	6
libfsext/libfdata/libfdata_mapped_range.c	3
libfsext/libuna/libuna_utf8_string.c	3
libfsext/libuna/libuna_unicode_character.c	3

Fuzzer: libfsext_file_entry_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	826	60.9%
gold	[1:9]	28	2.06%
yellow	[10:29]	19	1.40%
greenyellow	[30:49]	24	1.77%
lawngreen	50+	458	33.8%
All colors	1355	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00156	/src/libqcow/libbfio/libbfio_handle.c:1139
63	63	1 : View List ['libfdata_segments_array_calculate_mapped_ranges']	63	539	libfdata_stream_get_segment_index_at_offset	call site: 01236	/src/libfsfat/libfdata/libfdata_stream.c:1085
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 01018	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00756	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
36	36	1 : View List ['libfsext_bitmap_free']	36	108	libfsext_internal_volume_read_block_groups	call site: 00363	/src/libfsext/libfsext/libfsext_volume.c:1588
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	838	1 : View List ['libfsext_internal_file_entry_get_directory']	0	2204	libfsext_internal_file_entry_get_sub_file_entry_by_index	call site: 01030	/src/libfsext/libfsext/libfsext_file_entry.c:3396
0	249	1 : View List ['libfsext_volume_close']	0	526	libfsext_volume_free	call site: 01347	/src/libfsext/libfsext/libfsext_volume.c:194
0	212	5 : View List ['libfsext_extents_header_free', 'libfsext_extent_index_free', 'libfsext_extent_free', 'libcerror_error_set', 'libfsext_extents_footer_free']	0	212	libfsext_extents_read_data	call site: 00512	/src/libfsext/libfsext/libfsext_extents.c:640
0	174	2 : View List ['libfsext_file_entry_free', 'libcerror_error_set']	0	174	libfsext_volume_get_root_directory	call site: 00911	/src/libfsext/libfsext/libfsext_volume.c:3082
0	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	0	142	libfdata_segments_array_append_segment	call site: 00707	/src/libqcow/libfdata/libfdata_segments_array.c:592

Runtime coverage analysis

Covered functions

225

Functions that are reachable but not covered

37

Reachable functions

262

Percentage of reachable functions covered

85.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsext/ossfuzz/file_entry_fuzzer.cc	1
libfsext/libbfio/libbfio_memory_range.c	2
libfsext/libcerror/libcerror_error.c	3
libfsext/libbfio/libbfio_memory_range_io_handle.c	3
libfsext/libbfio/libbfio_handle.c	10
libfsext/libcdata/libcdata_range_list.c	15
libfsext/libcdata/libcdata_list_element.c	10
libfsext/libcdata/libcdata_range_list_value.c	3
libfsext/libfsext/libfsext_volume.c	8
libfsext/libfsext/libfsext_io_handle.c	3
libfsext/libcdata/libcdata_array.c	10
libfsext/libcthreads/libcthreads_read_write_lock.c	6
libfsext/libcerror/libcerror_system.c	2
libfsext/libfsext/libfsext_superblock.c	4
libfsext/libfsext/libfsext_group_descriptor.c	4
libfsext/libfsext/libfsext_bitmap.c	1
libfsext/libfsext/libfsext_inode_table.c	3
libfsext/libfdata/libfdata_vector.c	6
libfsext/libfcache/libfcache_date_time.c	1
libfsext/libfsext/libfsext_inode.c	21
libfsext/libfsext/libfsext_attributes_block.c	1
libfsext/libfsext/libfsext_attribute_values.c	3
libfsext/libfsext/libfsext_extents.c	4
libfsext/libfsext/libfsext_extents_header.c	3
libfsext/libfsext/libfsext_extent.c	3
libfsext/libfsext/libfsext_extent_index.c	3
libfsext/libfsext/libfsext_extents_footer.c	3
libfsext/libfsext/libfsext_data_blocks.c	4
libfsext/libfsext/libfsext_block.c	3
libfsext/libfdata/libfdata_segments_array.c	3
libfsext/libfdata/libfdata_range.c	5
libfsext/libfcache/libfcache_cache.c	4
libfsext/libcdata/libcdata_list.c	9
libfsext/libfcache/libfcache_cache_value.c	8
libfsext/libfdata/libfdata_mapped_range.c	4
libfsext/libfsext/libfsext_file_entry.c	26
libfsext/libfsext/libfsext_block_stream.c	3
libfsext/libfsext/libfsext_buffer_data_handle.c	2
libfsext/libfdata/libfdata_stream.c	9
libfsext/libfsext/libfsext_block_data_handle.c	1
libfsext/libfsext/libfsext_directory_entry.c	6
libfsext/libfsext/libfsext_directory.c	7
libfsext/libfsext/libfsext_block_vector.c	2
libfsext/libuna/libuna_utf8_string.c	3
libfsext/libuna/libuna_unicode_character.c	3

Fuzzer: libesedb_record_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1075	65.3%
gold	[1:9]	38	2.30%
yellow	[10:29]	35	2.12%
greenyellow	[30:49]	20	1.21%
lawngreen	50+	478	29.0%
All colors	1646	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00142	/src/libqcow/libbfio/libbfio_handle.c:1139
72	359	6 : View List ['libcdata_tree_node_free', 'libcdata_list_free', 'libcdata_tree_node_remove_node', 'libcdata_tree_node_set_value', 'libcerror_error_set', 'libcdata_tree_node_empty']	72	359	libcdata_btree_node_split	call site: 01332	/src/libfsntfs/libcdata/libcdata_btree_node.c:1561
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00462	/src/libqcow/libfcache/libfcache_cache.c:801
63	63	1 : View List ['libfdata_segments_array_calculate_mapped_ranges']	63	539	libfdata_vector_get_element_index_at_offset	call site: 01453	/src/libqcow/libfdata/libfdata_vector.c:1078
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
36	36	1 : View List ['libesedb_root_page_header_free']	36	325	libesedb_page_tree_free	call site: 00601	/src/libesedb/libesedb/libesedb_page_tree.c:235
36	36	1 : View List ['libcdata_tree_node_get_previous_node']	36	68	libcdata_tree_node_get_sub_node_by_index	call site: 01171	/src/libfsntfs/libcdata/libcdata_tree_node.c:3940
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	854	1 : View List ['libesedb_page_tree_get_number_of_leaf_values']	0	2368	libesedb_page_tree_get_leaf_value_by_index	call site: 01376	/src/libesedb/libesedb/libesedb_page_tree.c:2357
0	308	1 : View List ['libesedb_file_close']	0	408	libesedb_file_free	call site: 01641	/src/libesedb/libesedb/libesedb_file.c:179
0	268	4 : View List ['free', 'libesedb_block_tree_free', 'libesedb_page_tree_free', 'libcerror_error_set']	0	268	libesedb_catalog_initialize	call site: 00840	/src/libesedb/libesedb/libesedb_catalog.c:158
0	199	3 : View List ['free', 'libesedb_page_tree_free', 'libcerror_error_set']	0	199	libesedb_database_initialize	call site: 00598	/src/libesedb/libesedb/libesedb_database.c:140

Runtime coverage analysis

Covered functions

227

Functions that are reachable but not covered

375

Reachable functions

602

Percentage of reachable functions covered

37.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libesedb/ossfuzz/record_fuzzer.cc	1
libesedb/libbfio/libbfio_memory_range.c	2
libesedb/libcerror/libcerror_error.c	4
libesedb/libbfio/libbfio_memory_range_io_handle.c	3
libesedb/libbfio/libbfio_handle.c	9
libesedb/libcdata/libcdata_range_list.c	15
libesedb/libcdata/libcdata_list_element.c	10
libesedb/libcdata/libcdata_range_list_value.c	3
libesedb/libesedb/libesedb_file.c	7
libesedb/libesedb/libesedb_io_handle.c	5
libesedb/libesedb/libesedb_i18n.c	1
libesedb/libesedb/libesedb_file_header.c	4
libesedb/libesedb/libesedb_checksum.c	2
libesedb/libfdata/libfdata_vector.c	7
libesedb/libcdata/libcdata_array.c	10
libesedb/libfcache/libfcache_date_time.c	1
libesedb/libesedb/libesedb_page.c	13
libesedb/libesedb/libesedb_page_header.c	6
libesedb/libcnotify/libcnotify_print.c	1
libesedb/libesedb/libesedb_page_value.c	2
libesedb/libfdata/libfdata_segments_array.c	3
libesedb/libfdata/libfdata_range.c	5
libesedb/libfcache/libfcache_cache.c	4
libesedb/libcdata/libcdata_list.c	17
libesedb/libfcache/libfcache_cache_value.c	8
libesedb/libfdata/libfdata_mapped_range.c	4
libesedb/libesedb/libesedb_database.c	4
libesedb/libesedb/libesedb_page_tree.c	9
libesedb/libesedb/libesedb_block_tree.c	3
libesedb/libesedb/libesedb_block_tree_node.c	6
libesedb/libcdata/libcdata_btree.c	4
libesedb/libcdata/libcdata_tree_node.c	16
libesedb/libesedb/libesedb_block_descriptor.c	2
libesedb/libesedb/libesedb_root_page_header.c	1
libesedb/libcdata/libcdata_btree_values_list.c	1
libesedb/libesedb/libesedb_leaf_page_descriptor.c	3
libesedb/libesedb/libesedb_page_tree_value.c	3
libesedb/libesedb/libesedb_catalog.c	8
libesedb/libesedb/libesedb_catalog_definition.c	4
libesedb/libesedb/libesedb_table_definition.c	8
libesedb/libuna/libuna_utf8_string.c	1
libesedb/libuna/libuna_unicode_character.c	2
libesedb/libuna/libuna_codepage_koi8_r.c	1
libesedb/libuna/libuna_codepage_koi8_u.c	1
libesedb/libuna/libuna_codepage_mac_arabic.c	1
libesedb/libuna/libuna_codepage_mac_celtic.c	1
libesedb/libuna/libuna_codepage_mac_centraleurroman.c	1
libesedb/libuna/libuna_codepage_mac_croatian.c	1
libesedb/libuna/libuna_codepage_mac_cyrillic.c	1
libesedb/libuna/libuna_codepage_mac_dingbats.c	1
libesedb/libuna/libuna_codepage_mac_farsi.c	1
libesedb/libuna/libuna_codepage_mac_gaelic.c	1
libesedb/libuna/libuna_codepage_mac_greek.c	1
libesedb/libuna/libuna_codepage_mac_icelandic.c	1
libesedb/libuna/libuna_codepage_mac_inuit.c	1
libesedb/libuna/libuna_codepage_mac_roman.c	1
libesedb/libuna/libuna_codepage_mac_romanian.c	1
libesedb/libuna/libuna_codepage_mac_russian.c	1
libesedb/libuna/libuna_codepage_mac_symbol.c	1
libesedb/libuna/libuna_codepage_mac_thai.c	1
libesedb/libuna/libuna_codepage_mac_turkish.c	1
libesedb/libuna/libuna_codepage_mac_ukrainian.c	1
libesedb/libuna/libuna_codepage_windows_874.c	1
libesedb/libuna/libuna_codepage_windows_932.c	1
libesedb/libuna/libuna_codepage_windows_936.c	1
libesedb/libuna/libuna_codepage_windows_949.c	1
libesedb/libuna/libuna_codepage_windows_950.c	1
libesedb/libuna/libuna_codepage_windows_1250.c	1
libesedb/libuna/libuna_codepage_windows_1251.c	1
libesedb/libuna/libuna_codepage_windows_1252.c	1
libesedb/libuna/libuna_codepage_windows_1253.c	1
libesedb/libuna/libuna_codepage_windows_1254.c	1
libesedb/libuna/libuna_codepage_windows_1255.c	1
libesedb/libuna/libuna_codepage_windows_1256.c	1
libesedb/libuna/libuna_codepage_windows_1257.c	1
libesedb/libuna/libuna_codepage_windows_1258.c	1
libesedb/libesedb/libesedb_table.c	4
libesedb/libcdata/libcdata_btree_node.c	5
libesedb/libesedb/libesedb_data_definition.c	3
libesedb/libesedb/libesedb_record.c	2
libesedb/libfvalue/libfvalue_value.c	3
libesedb/libfvalue/libfvalue_data_handle.c	6
libesedb/libfvalue/libfvalue_value_entry.c	2
libesedb/libesedb/libesedb_value_data_handle.c	1
libesedb/libfvalue/libfvalue_value_type.c	2
libesedb/libfvalue/libfvalue_binary_data.c	1
libesedb/libfvalue/libfvalue_floating_point.c	1
libesedb/libfvalue/libfvalue_integer.c	1
libesedb/libfvalue/libfvalue_string.c	1
libesedb/libfdatetime/libfdatetime_fat_date_time.c	1
libesedb/libfdatetime/libfdatetime_filetime.c	2
libesedb/libfvalue/libfvalue_filetime.c	1
libesedb/libfdatetime/libfdatetime_floatingtime.c	1
libesedb/libfdatetime/libfdatetime_nsf_timedate.c	1
libesedb/libfdatetime/libfdatetime_posix_time.c	2
libesedb/libfdatetime/libfdatetime_systemtime.c	1
libesedb/libfguid/libfguid_identifier.c	1
libesedb/libfwnt/libfwnt_security_identifier.c	1

Fuzzer: libfshfs_file_entry_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1099	59.0%
gold	[1:9]	35	1.88%
yellow	[10:29]	40	2.14%
greenyellow	[30:49]	25	1.34%
lawngreen	50+	662	35.5%
All colors	1861	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
841	841	2 : View List ['libfshfs_allocation_block_stream_initialize_from_data', 'libfshfs_allocation_block_stream_initialize_from_compressed_stream']	841	3041	libfshfs_internal_file_entry_get_data_stream	call site: 01598	/src/libfshfs/libfshfs/libfshfs_file_entry.c:618
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00143	/src/libqcow/libbfio/libbfio_handle.c:1139
98	230	3 : View List ['libcdata_array_get_number_of_entries', 'libfdata_stream_get_segment_index_at_offset', 'libcerror_error_set']	98	230	libfdata_stream_seek_offset	call site: 01487	/src/libfsfat/libfdata/libfdata_stream.c:2419
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00589	/src/libqcow/libfcache/libfcache_cache.c:801
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 01120	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01057	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
36	36	1 : View List ['libfshfs_compressed_data_header_free']	36	490	libfshfs_file_entry_free	call site: 01821	/src/libfshfs/libfshfs/libfshfs_file_entry.c:287
36	36	1 : View List ['libfshfs_directory_record_get_flags']	36	68	libfshfs_directory_entry_get_flags	call site: 01687	/src/libfshfs/libfshfs/libfshfs_directory_entry.c:557
36	36	1 : View List ['libfshfs_compressed_data_header_free']	36	36	libfshfs_internal_file_entry_get_data_size	call site: 01803	/src/libfshfs/libfshfs/libfshfs_file_entry.c:5404
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	891	1 : View List ['libfshfs_file_system_get_directory_entries']	0	1444	libfshfs_file_entry_get_sub_file_entry_by_index	call site: 01192	/src/libfshfs/libfshfs/libfshfs_file_entry.c:4433

Runtime coverage analysis

Covered functions

287

Functions that are reachable but not covered

109

Reachable functions

396

Percentage of reachable functions covered

72.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfshfs/ossfuzz/file_entry_fuzzer.cc	1
libfshfs/libbfio/libbfio_memory_range.c	2
libfshfs/libcerror/libcerror_error.c	3
libfshfs/libbfio/libbfio_memory_range_io_handle.c	3
libfshfs/libbfio/libbfio_handle.c	9
libfshfs/libcdata/libcdata_range_list.c	15
libfshfs/libcdata/libcdata_list_element.c	10
libfshfs/libcdata/libcdata_range_list_value.c	3
libfshfs/libfshfs/libfshfs_volume.c	6
libfshfs/libfshfs/libfshfs_io_handle.c	3
libfshfs/libcthreads/libcthreads_read_write_lock.c	6
libfshfs/libcerror/libcerror_system.c	2
libfshfs/libfshfs/libfshfs_master_directory_block.c	4
libfshfs/libfshfs/libfshfs_fork_descriptor.c	6
libfshfs/libfshfs/libfshfs_extents_record.c	1
libfshfs/libfshfs/libfshfs_volume_header.c	4
libfshfs/libfshfs/libfshfs_file_system.c	10
libfshfs/libfshfs/libfshfs_btree_file.c	5
libfshfs/libcdata/libcdata_array.c	9
libfshfs/libfshfs/libfshfs_btree_header.c	3
libfshfs/libfshfs/libfshfs_extent.c	2
libfshfs/libfshfs/libfshfs_btree_node_descriptor.c	3
libfshfs/libfshfs/libfshfs_btree_node_vector.c	3
libfshfs/libfcache/libfcache_date_time.c	1
libfshfs/libfshfs/libfshfs_btree_node_cache.c	2
libfshfs/libfcache/libfcache_cache.c	4
libfshfs/libcdata/libcdata_list.c	9
libfshfs/libfshfs/libfshfs_extents_btree_file.c	6
libfshfs/libfcache/libfcache_cache_value.c	8
libfshfs/libfshfs/libfshfs_btree_node.c	8
libfshfs/libfshfs/libfshfs_btree_node_record.c	2
libfshfs/libfshfs/libfshfs_extents_btree_key.c	3
libfshfs/libfshfs/libfshfs_catalog_btree_file.c	13
libfshfs/libfshfs/libfshfs_catalog_btree_key.c	4
libfshfs/libfshfs/libfshfs_thread_record.c	3
libfshfs/libfshfs/libfshfs_name.c	3
libfshfs/libuna/libuna_unicode_character.c	6
libfshfs/libuna/libuna_codepage_koi8_r.c	1
libfshfs/libuna/libuna_codepage_koi8_u.c	1
libfshfs/libuna/libuna_codepage_mac_arabic.c	1
libfshfs/libuna/libuna_codepage_mac_celtic.c	1
libfshfs/libuna/libuna_codepage_mac_centraleurroman.c	1
libfshfs/libuna/libuna_codepage_mac_croatian.c	1
libfshfs/libuna/libuna_codepage_mac_cyrillic.c	1
libfshfs/libuna/libuna_codepage_mac_dingbats.c	1
libfshfs/libuna/libuna_codepage_mac_farsi.c	1
libfshfs/libuna/libuna_codepage_mac_gaelic.c	1
libfshfs/libuna/libuna_codepage_mac_greek.c	1
libfshfs/libuna/libuna_codepage_mac_icelandic.c	1
libfshfs/libuna/libuna_codepage_mac_inuit.c	1
libfshfs/libuna/libuna_codepage_mac_roman.c	1
libfshfs/libuna/libuna_codepage_mac_romanian.c	1
libfshfs/libuna/libuna_codepage_mac_russian.c	1
libfshfs/libuna/libuna_codepage_mac_symbol.c	1
libfshfs/libuna/libuna_codepage_mac_thai.c	1
libfshfs/libuna/libuna_codepage_mac_turkish.c	1
libfshfs/libuna/libuna_codepage_mac_ukrainian.c	1
libfshfs/libuna/libuna_codepage_windows_874.c	1
libfshfs/libuna/libuna_codepage_windows_932.c	1
libfshfs/libuna/libuna_codepage_windows_936.c	1
libfshfs/libuna/libuna_codepage_windows_949.c	1
libfshfs/libuna/libuna_codepage_windows_950.c	1
libfshfs/libuna/libuna_codepage_windows_1250.c	1
libfshfs/libuna/libuna_codepage_windows_1251.c	1
libfshfs/libuna/libuna_codepage_windows_1252.c	1
libfshfs/libuna/libuna_codepage_windows_1253.c	1
libfshfs/libuna/libuna_codepage_windows_1254.c	1
libfshfs/libuna/libuna_codepage_windows_1255.c	1
libfshfs/libuna/libuna_codepage_windows_1256.c	1
libfshfs/libuna/libuna_codepage_windows_1257.c	1
libfshfs/libuna/libuna_codepage_windows_1258.c	1
libfshfs/libfshfs/libfshfs_directory_record.c	13
libfshfs/libfshfs/libfshfs_file_record.c	17
libfshfs/libfshfs/libfshfs_directory_entry.c	21
libfshfs/libfshfs/libfshfs_file_entry.c	32
libfshfs/libfshfs/libfshfs_allocation_block_stream.c	4
libfshfs/libfdata/libfdata_stream.c	9
libfshfs/libfshfs/libfshfs_block_data_handle.c	1
libfshfs/libfdata/libfdata_segments_array.c	2
libfshfs/libfdata/libfdata_mapped_range.c	4
libfshfs/libfdata/libfdata_range.c	4
libfshfs/libuna/libuna_utf8_string.c	4
libfshfs/libfshfs/libfshfs_buffer_data_handle.c	2
libfshfs/libfshfs/libfshfs_compressed_data_handle.c	2
libfshfs/libfshfs/libfshfs_attributes_btree_file.c	6
libfshfs/libfshfs/libfshfs_attributes_btree_key.c	3
libfshfs/libfshfs/libfshfs_attribute_record.c	5
libfshfs/libfshfs/libfshfs_compressed_data_header.c	3

Fuzzer: libfmapi_lzfu_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	58.6%
gold	[1:9]	3	10.3%
yellow	[10:29]	3	10.3%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	6	20.6%
All colors	29	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	1 : View List ['libcerror_error_set']	0	32	libfmapi_checksum_calculate_weak_crc32	call site: 00020	/src/libfmapi/libfmapi/libfmapi_checksum.c:174
0	0	None	0	32	libfmapi_checksum_calculate_weak_crc32	call site: 00018	/src/libfmapi/libfmapi/libfmapi_checksum.c:152
0	0	None	0	32	libfmapi_checksum_calculate_weak_crc32	call site: 00019	/src/libfmapi/libfmapi/libfmapi_checksum.c:163
0	0	None	0	32	libfmapi_lzfu_decompress	call site: 00001	/src/libfmapi/libfmapi/libfmapi_lzfu.c:288
0	0	None	0	32	libfmapi_lzfu_decompress	call site: 00010	/src/libfmapi/libfmapi/libfmapi_lzfu.c:311
0	0	None	0	32	libfmapi_lzfu_decompress	call site: 00011	/src/libfmapi/libfmapi/libfmapi_lzfu.c:322
0	0	None	0	32	libfmapi_lzfu_decompress	call site: 00012	/src/libfmapi/libfmapi/libfmapi_lzfu.c:347
0	0	None	0	32	libfmapi_lzfu_decompress	call site: 00013	/src/libfmapi/libfmapi/libfmapi_lzfu.c:363
0	0	None	0	32	libfmapi_lzfu_decompress	call site: 00018	/src/libfmapi/libfmapi/libfmapi_lzfu.c:472
0	0	None	0	32	libfmapi_lzfu_decompress	call site: 00024	/src/libfmapi/libfmapi/libfmapi_lzfu.c:519

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

5

Reachable functions

10

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfmapi/ossfuzz/lzfu_fuzzer.cc	1
libfmapi/libfmapi/libfmapi_lzfu.c	1
libfmapi/libcerror/libcerror_error.c	3
libfmapi/libfmapi/libfmapi_checksum.c	2

Fuzzer: libfwnt_lzxpress_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	54.1%
gold	[1:9]	3	12.5%
yellow	[10:29]	3	12.5%
greenyellow	[30:49]	2	8.33%
lawngreen	50+	3	12.5%
All colors	24	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	0	None	0	32	libfwnt_lzxpress_decompress	call site: 00001	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:115
0	0	None	0	32	libfwnt_lzxpress_decompress	call site: 00010	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:138
0	0	None	0	32	libfwnt_lzxpress_decompress	call site: 00011	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:149
0	0	None	0	32	libfwnt_lzxpress_decompress	call site: 00012	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:160
0	0	None	0	32	libfwnt_lzxpress_decompress	call site: 00021	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:410
0	0	None	0	32	libfwnt_lzxpress_decompress	call site: 00022	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:421

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

5

Reachable functions

8

Percentage of reachable functions covered

37.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwnt/ossfuzz/lzxpress_fuzzer.cc	1
libfwnt/libfwnt/libfwnt_lzxpress.c	1
libfwnt/libcerror/libcerror_error.c	3

Fuzzer: libvsbsdl_partition_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	510	81.8%
gold	[1:9]	3	0.48%
yellow	[10:29]	2	0.32%
greenyellow	[30:49]	7	1.12%
lawngreen	50+	101	16.2%
All colors	623	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00162	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00579	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00393	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00370	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00545	/src/libqcow/libfdata/libfdata_segments_array.c:592
38	38	1 : View List ['libcdata_array_set_entry_by_index']	38	74	libfdata_segments_array_append_segment	call site: 00547	/src/libqcow/libfdata/libfdata_segments_array.c:642
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
2	2	1 : View List ['realloc']	2	98	libcdata_internal_array_resize	call site: 00333	/src/libfplist/libcdata/libcdata_array.c:753
0	189	1 : View List ['libvsbsdl_volume_close']	0	388	libvsbsdl_volume_free	call site: 00615	/src/libvsbsdl/libvsbsdl/libvsbsdl_volume.c:169
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00426	/src/libqcow/libfdata/libfdata_vector.c:180
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

78

Functions that are reachable but not covered

63

Reachable functions

141

Percentage of reachable functions covered

55.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvsbsdl/ossfuzz/partition_fuzzer.cc	1
libvsbsdl/libbfio/libbfio_memory_range.c	2
libvsbsdl/libcerror/libcerror_error.c	3
libvsbsdl/libbfio/libbfio_memory_range_io_handle.c	3
libvsbsdl/libbfio/libbfio_handle.c	9
libvsbsdl/libcdata/libcdata_range_list.c	15
libvsbsdl/libcdata/libcdata_list_element.c	10
libvsbsdl/libcdata/libcdata_range_list_value.c	3
libvsbsdl/libvsbsdl/libvsbsdl_volume.c	7
libvsbsdl/libvsbsdl/libvsbsdl_io_handle.c	3
libvsbsdl/libcthreads/libcthreads_read_write_lock.c	6
libvsbsdl/libcerror/libcerror_system.c	2
libvsbsdl/libvsbsdl/libvsbsdl_disklabel.c	7
libvsbsdl/libcdata/libcdata_array.c	9
libvsbsdl/libvsbsdl/libvsbsdl_partition_entry.c	5
libvsbsdl/libvsbsdl/libvsbsdl_partition.c	2
libvsbsdl/libfdata/libfdata_vector.c	4
libvsbsdl/libfcache/libfcache_date_time.c	1
libvsbsdl/libvsbsdl/libvsbsdl_sector_data.c	4
libvsbsdl/libfdata/libfdata_segments_array.c	2
libvsbsdl/libfdata/libfdata_range.c	4
libvsbsdl/libfcache/libfcache_cache.c	3
libvsbsdl/libcdata/libcdata_list.c	7
libvsbsdl/libfcache/libfcache_cache_value.c	6
libvsbsdl/libfdata/libfdata_mapped_range.c	3

Fuzzer: libvsbsdl_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	351	85.1%
gold	[1:9]	2	0.48%
yellow	[10:29]	11	2.66%
greenyellow	[30:49]	3	0.72%
lawngreen	50+	45	10.9%
All colors	412	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00162	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00370	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
2	2	1 : View List ['realloc']	2	98	libcdata_internal_array_resize	call site: 00333	/src/libfplist/libcdata/libcdata_array.c:753
0	189	1 : View List ['libvsbsdl_volume_close']	0	388	libvsbsdl_volume_free	call site: 00401	/src/libvsbsdl/libvsbsdl/libvsbsdl_volume.c:169
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	386	libvsbsdl_volume_close	call site: 00385	/src/libvsbsdl/libvsbsdl/libvsbsdl_volume.c:857
0	87	2 : View List ['libvsbsdl_disklabel_free', 'libcerror_error_set']	0	87	libvsbsdl_internal_volume_open_read	call site: 00350	/src/libvsbsdl/libvsbsdl/libvsbsdl_volume.c:1016
0	68	2 : View List ['libcerror_error_set', 'libbfio_memory_range_io_handle_free']	0	68	libbfio_memory_range_initialize	call site: 00059	/src/libqcow/libbfio/libbfio_memory_range.c:83
0	64	1 : View List ['libcerror_error_set']	0	64	libbfio_internal_handle_read_buffer	call site: 00299	/src/libqcow/libbfio/libbfio_handle.c:1164
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00336	/src/libfplist/libcdata/libcdata_array.c:823

Runtime coverage analysis

Covered functions

50

Functions that are reachable but not covered

42

Reachable functions

92

Percentage of reachable functions covered

54.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvsbsdl/ossfuzz/volume_fuzzer.cc	1
libvsbsdl/libbfio/libbfio_memory_range.c	2
libvsbsdl/libcerror/libcerror_error.c	3
libvsbsdl/libbfio/libbfio_memory_range_io_handle.c	3
libvsbsdl/libbfio/libbfio_handle.c	9
libvsbsdl/libcdata/libcdata_range_list.c	15
libvsbsdl/libcdata/libcdata_list_element.c	10
libvsbsdl/libcdata/libcdata_range_list_value.c	3
libvsbsdl/libvsbsdl/libvsbsdl_volume.c	5
libvsbsdl/libvsbsdl/libvsbsdl_io_handle.c	3
libvsbsdl/libcthreads/libcthreads_read_write_lock.c	4
libvsbsdl/libcerror/libcerror_system.c	2
libvsbsdl/libvsbsdl/libvsbsdl_disklabel.c	5
libvsbsdl/libcdata/libcdata_array.c	6
libvsbsdl/libvsbsdl/libvsbsdl_partition_entry.c	3

Fuzzer: libvmdk_handle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	920	78.0%
gold	[1:9]	26	2.20%
yellow	[10:29]	12	1.01%
greenyellow	[30:49]	8	0.67%
lawngreen	50+	213	18.0%
All colors	1179	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	2 : View List ['libbfio_pool_close_all', 'libbfio_pool_free']	300	929	libvmdk_handle_close	call site: 01120	/src/libvmdk/libvmdk/libvmdk_handle.c:1907
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00220	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00135	/src/libqcow/libcdata/libcdata_list.c:238
64	64	1 : View List ['libfdata_stream_free']	64	128	libvmdk_extent_table_clear	call site: 00150	/src/libvmdk/libvmdk/libvmdk_extent_table.c:235
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01111	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
36	36	1 : View List ['libvmdk_grain_table_free']	36	464	libvmdk_handle_close	call site: 01159	/src/libvmdk/libvmdk/libvmdk_handle.c:1969
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	342	1 : View List ['libvmdk_handle_close']	0	794	libvmdk_handle_free	call site: 01167	/src/libvmdk/libvmdk/libvmdk_handle.c:230
0	257	5 : View List ['free', 'libvmdk_extent_table_free', 'libvmdk_io_handle_free', 'libcdata_array_free', 'libcerror_error_set']	0	257	libvmdk_handle_initialize	call site: 00090	/src/libvmdk/libvmdk/libvmdk_handle.c:156
0	192	4 : View List ['free', 'libvmdk_descriptor_file_free', 'libvmdk_extent_file_free', 'libcerror_error_set']	0	192	libvmdk_internal_handle_open_read	call site: 01102	/src/libvmdk/libvmdk/libvmdk_handle.c:2280
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

85

Functions that are reachable but not covered

113

Reachable functions

198

Percentage of reachable functions covered

42.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvmdk/ossfuzz/handle_fuzzer.cc	1
libvmdk/libbfio/libbfio_memory_range.c	2
libvmdk/libcerror/libcerror_error.c	3
libvmdk/libbfio/libbfio_memory_range_io_handle.c	3
libvmdk/libbfio/libbfio_handle.c	12
libvmdk/libcdata/libcdata_range_list.c	15
libvmdk/libcdata/libcdata_list_element.c	10
libvmdk/libcdata/libcdata_range_list_value.c	3
libvmdk/libvmdk/libvmdk_handle.c	6
libvmdk/libvmdk/libvmdk_io_handle.c	3
libvmdk/libcdata/libcdata_array.c	9
libvmdk/libvmdk/libvmdk_extent_table.c	3
libvmdk/libcthreads/libcthreads_read_write_lock.c	4
libvmdk/libcerror/libcerror_system.c	2
libvmdk/libfdata/libfdata_list.c	5
libvmdk/libfdata/libfdata_list_element.c	8
libvmdk/libfdata/libfdata_range.c	4
libvmdk/libfdata/libfdata_mapped_range.c	3
libvmdk/libfcache/libfcache_cache.c	3
libvmdk/libcdata/libcdata_list.c	9
libvmdk/libfcache/libfcache_cache_value.c	6
libvmdk/libfdata/libfdata_stream.c	1
libvmdk/libcsplit/libcsplit_narrow_string.c	1
libvmdk/libcsplit/libcsplit_narrow_split_string.c	6
libvmdk/libvmdk/libvmdk_descriptor_file.c	11
libvmdk/libfvalue/libfvalue_integer.c	2
libvmdk/libclocale/libclocale_codepage.c	1
libvmdk/libvmdk/libvmdk_extent_values.c	4
libvmdk/libvmdk/libvmdk_extent_file.c	6
libvmdk/libbfio/libbfio_pool.c	9
libvmdk/libvmdk/libvmdk_grain_data.c	4
libvmdk/libvmdk/libvmdk_compression.c	1
libvmdk/libvmdk/libvmdk_deflate.c	8
libvmdk/libvmdk/libvmdk_bit_stream.c	3
libvmdk/libvmdk/libvmdk_huffman_tree.c	4
libvmdk/libvmdk/libvmdk_grain_group.c	1
libvmdk/libfcache/libfcache_date_time.c	1
libvmdk/libvmdk/libvmdk_grain_table.c	1

Fuzzer: libfsapfs_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	884	67.1%
gold	[1:9]	41	3.11%
yellow	[10:29]	51	3.87%
greenyellow	[30:49]	24	1.82%
lawngreen	50+	317	24.0%
All colors	1317	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
778	778	4 : View List ['libfsapfs_container_key_bag_get_volume_key_bag_extent_by_identifier', 'libfsapfs_encryption_context_initialize', 'libfsapfs_volume_key_bag_initialize', 'libfsapfs_volume_key_bag_read_file_io_handle']	881	2838	libfsapfs_internal_volume_open_read	call site: 00965	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:554
423	423	5 : View List ['libfsapfs_encryption_context_crypt', 'libfsapfs_container_key_bag_read_data', 'malloc', 'libfsapfs_encryption_context_initialize', 'libfsapfs_encryption_context_set_keys']	517	709	libfsapfs_container_key_bag_read_file_io_handle	call site: 00472	/src/libfsapfs/libfsapfs/libfsapfs_container_key_bag.c:275
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00149	/src/libqcow/libbfio/libbfio_handle.c:1139
142	174	2 : View List ['libfsapfs_file_system_free', 'libcerror_error_set']	142	174	libfsapfs_internal_volume_close	call site: 01186	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:1095
103	653	11 : View List ['libfsapfs_object_map_free', 'libfsapfs_volume_key_bag_free', 'libfsapfs_volume_superblock_free', 'libfsapfs_object_map_btree_free', 'libfdata_vector_free', 'libcdata_array_free', 'libfsapfs_encryption_context_free', 'libfsapfs_container_data_handle_free', 'libfsapfs_snapshot_metadata_tree_free', 'libfsapfs_file_system_data_handle_free', 'libcerror_error_set']	103	653	libfsapfs_internal_volume_open_read	call site: 01140	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:794
95	127	3 : View List ['free', 'libfsapfs_encryption_context_crypt', 'libcerror_error_set']	95	127	libfsapfs_data_block_read	call site: 00000	/src/libfsapfs/libfsapfs/libfsapfs_data_block.c:374
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00825	/src/libqcow/libfcache/libfcache_cache.c:801
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
56	56	1 : View List ['libfsapfs_volume_key_bag_free']	245	437	libfsapfs_internal_volume_close	call site: 01181	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:1050
56	56	1 : View List ['libfsapfs_volume_key_bag_free']	56	474	libfsapfs_internal_volume_open_read	call site: 01144	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:833
47	47	1 : View List ['libfsapfs_encryption_context_free']	189	349	libfsapfs_internal_volume_close	call site: 01182	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:1066
47	47	1 : View List ['libfsapfs_encryption_context_free']	103	521	libfsapfs_internal_volume_open_read	call site: 01143	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:827

Runtime coverage analysis

Covered functions

185

Functions that are reachable but not covered

69

Reachable functions

254

Percentage of reachable functions covered

72.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsapfs/ossfuzz/volume_fuzzer.cc	1
libfsapfs/libbfio/libbfio_memory_range.c	2
libfsapfs/libcerror/libcerror_error.c	3
libfsapfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsapfs/libbfio/libbfio_handle.c	8
libfsapfs/libcdata/libcdata_range_list.c	15
libfsapfs/libcdata/libcdata_list_element.c	10
libfsapfs/libcdata/libcdata_range_list_value.c	3
libfsapfs/libfsapfs/libfsapfs_container.c	7
libfsapfs/libfsapfs/libfsapfs_io_handle.c	3
libfsapfs/libcthreads/libcthreads_read_write_lock.c	6
libfsapfs/libcerror/libcerror_system.c	2
libfsapfs/libfsapfs/libfsapfs_container_superblock.c	4
libfsapfs/libfsapfs/libfsapfs_checksum.c	1
libfsapfs/libfsapfs/libfsapfs_object.c	4
libfsapfs/libfsapfs/libfsapfs_checkpoint_map.c	4
libfsapfs/libcdata/libcdata_array.c	9
libfsapfs/libfsapfs/libfsapfs_checkpoint_map_entry.c	3
libfsapfs/libfsapfs/libfsapfs_container_data_handle.c	2
libfsapfs/libfdata/libfdata_vector.c	4
libfsapfs/libfcache/libfcache_date_time.c	1
libfsapfs/libfdata/libfdata_segments_array.c	2
libfsapfs/libfdata/libfdata_mapped_range.c	3
libfsapfs/libfdata/libfdata_range.c	4
libfsapfs/libfsapfs/libfsapfs_object_map.c	4
libfsapfs/libfsapfs/libfsapfs_object_map_btree.c	7
libfsapfs/libfcache/libfcache_cache.c	4
libfsapfs/libcdata/libcdata_list.c	9
libfsapfs/libfsapfs/libfsapfs_container_key_bag.c	5
libfsapfs/libfsapfs/libfsapfs_encryption_context.c	4
libfsapfs/libcaes/libcaes_tweaked_context.c	4
libfsapfs/libcaes/libcaes_context.c	7
libfsapfs/libfsapfs/libfsapfs_key_bag_header.c	3
libfsapfs/libfsapfs/libfsapfs_key_bag_entry.c	3
libfsapfs/libfcache/libfcache_cache_value.c	8
libfsapfs/libfsapfs/libfsapfs_fusion_middle_tree.c	1
libfsapfs/libfsapfs/libfsapfs_btree_node.c	7
libfsapfs/libfsapfs/libfsapfs_btree_node_header.c	3
libfsapfs/libfsapfs/libfsapfs_btree_footer.c	3
libfsapfs/libfsapfs/libfsapfs_btree_entry.c	4
libfsapfs/libfsapfs/libfsapfs_object_map_descriptor.c	4
libfsapfs/libfsapfs/libfsapfs_volume.c	10
libfsapfs/libfsapfs/libfsapfs_volume_superblock.c	7
libfsapfs/libfsapfs/libfsapfs_volume_key_bag.c	4
libfsapfs/libfsapfs/libfsapfs_snapshot_metadata_tree.c	8
libfsapfs/libfsapfs/libfsapfs_snapshot_metadata.c	4
libfsapfs/libfsapfs/libfsapfs_file_system_data_handle.c	2
libfsapfs/libfsapfs/libfsapfs_file_system.c	1
libfsapfs/libfsapfs/libfsapfs_file_system_btree.c	1
libfsapfs/libuna/libuna_utf8_string.c	3
libfsapfs/libuna/libuna_unicode_character.c	3

Fuzzer: libhmac_sha512_context_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	84.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	8	16.0%
All colors	50	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	68	2 : View List ['libhmac_sha512_context_free', 'libcerror_error_set']	32	68	libhmac_sha512_calculate	call site: 00046	/src/libhmac/libhmac/libhmac_sha512.c:196
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha512_context_transform	call site: 00027	/src/libhmac/libhmac/libhmac_sha512_context.c:456
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha512_context_initialize	call site: 00013	/src/libhmac/libhmac/libhmac_sha512_context.c:628
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha512_context_free	call site: 00046	/src/libhmac/libhmac/libhmac_sha512_context.c:667
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha512_context_update	call site: 00032	/src/libhmac/libhmac/libhmac_sha512_context.c:1023
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha512_context_finalize	call site: 00043	/src/libhmac/libhmac/libhmac_sha512_context.c:1369
0	0	None	192	274	libhmac_sha512_context_update	call site: 00019	/src/libhmac/libhmac/libhmac_sha512_context.c:924
0	0	None	32	68	libhmac_sha512_calculate	call site: 00002	/src/libhmac/libhmac/libhmac_sha512.c:153
0	0	None	32	68	libhmac_sha512_calculate	call site: 00016	/src/libhmac/libhmac/libhmac_sha512.c:166
0	0	None	32	68	libhmac_sha512_calculate	call site: 00035	/src/libhmac/libhmac/libhmac_sha512.c:181
0	0	None	32	32	libhmac_sha512_context_transform	call site: 00022	/src/libhmac/libhmac/libhmac_sha512_context.c:284
0	0	None	32	32	libhmac_sha512_context_transform	call site: 00023	/src/libhmac/libhmac/libhmac_sha512_context.c:295

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

6

Reachable functions

13

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libhmac/ossfuzz/sha512_context_fuzzer.cc	1
libhmac/libhmac/libhmac_sha512.c	1
libhmac/libhmac/libhmac_sha512_context.c	5
libhmac/libcerror/libcerror_error.c	3

Fuzzer: libwrc_stream_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	390	78.6%
gold	[1:9]	2	0.40%
yellow	[10:29]	2	0.40%
greenyellow	[30:49]	13	2.62%
lawngreen	50+	89	17.9%
All colors	496	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00140	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	167	1 : View List ['libwrc_stream_close']	0	267	libwrc_stream_free	call site: 00489	/src/libwrc/libwrc/libwrc_stream.c:158
0	137	4 : View List ['libcdata_tree_node_set_previous_node', 'libcerror_error_set', 'libcdata_tree_node_set_next_node', 'libcdata_tree_node_set_nodes']	0	137	libcdata_internal_tree_node_insert_node_before_sub_node	call site: 00395	/src/libfsntfs/libcdata/libcdata_tree_node.c:2697
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	102	3 : View List ['libcdata_tree_node_set_previous_node', 'libcerror_error_set', 'libcdata_tree_node_set_next_node']	0	102	libcdata_internal_tree_node_set_last_sub_node	call site: 00382	/src/libfsntfs/libcdata/libcdata_tree_node.c:1692
0	99	1 : View List ['libbfio_handle_free']	0	308	libwrc_stream_close	call site: 00472	/src/libwrc/libwrc/libwrc_stream.c:729
0	68	2 : View List ['libcerror_error_set', 'libbfio_memory_range_io_handle_free']	0	68	libbfio_memory_range_initialize	call site: 00059	/src/libqcow/libbfio/libbfio_memory_range.c:83
0	68	2 : View List ['libcdata_tree_node_get_next_node', 'libcerror_error_set']	0	68	libcdata_tree_node_get_sub_node_by_index	call site: 00428	/src/libfsntfs/libcdata/libcdata_tree_node.c:3948
0	68	2 : View List ['libcdata_tree_node_get_previous_node', 'libcerror_error_set']	0	68	libcdata_tree_node_get_sub_node_by_index	call site: 00430	/src/libfsntfs/libcdata/libcdata_tree_node.c:3979
0	64	1 : View List ['libcerror_error_set']	0	64	libbfio_internal_handle_read_buffer	call site: 00280	/src/libqcow/libbfio/libbfio_handle.c:1164

Runtime coverage analysis

Covered functions

68

Functions that are reachable but not covered

34

Reachable functions

102

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libwrc/ossfuzz/stream_fuzzer.cc	1
libwrc/libbfio/libbfio_memory_range.c	2
libwrc/libcerror/libcerror_error.c	3
libwrc/libbfio/libbfio_memory_range_io_handle.c	3
libwrc/libbfio/libbfio_handle.c	10
libwrc/libcdata/libcdata_range_list.c	15
libwrc/libcdata/libcdata_list_element.c	10
libwrc/libcdata/libcdata_range_list_value.c	3
libwrc/libwrc/libwrc_stream.c	5
libwrc/libwrc/libwrc_io_handle.c	3
libwrc/libcdata/libcdata_tree_node.c	19
libwrc/libwrc/libwrc_resource_node_tree.c	1
libwrc/libwrc/libwrc_resource_node_header.c	4
libwrc/libwrc/libwrc_resource_node_entry.c	6
libwrc/libwrc/libwrc_data_descriptor.c	4

Fuzzer: libfsntfs_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1220	65.0%
gold	[1:9]	47	2.50%
yellow	[10:29]	26	1.38%
greenyellow	[30:49]	35	1.86%
lawngreen	50+	547	29.1%
All colors	1875	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
774	1029	6 : View List ['libfdata_vector_get_element_value_by_index', 'libfdata_vector_get_number_of_elements', 'libfdata_vector_get_number_of_segments', 'libfcache_cache_initialize', 'libfdata_vector_get_segment_by_index', 'libfsntfs_cluster_block_vector_initialize']	774	1943	libfsntfs_bitmap_values_read_from_mft_attribute	call site: 01632	/src/libfsntfs/libfsntfs/libfsntfs_bitmap_values.c:497
676	772	3 : View List ['libfsntfs_cluster_block_stream_initialize_from_compressed_stream', 'libfdata_stream_free', 'libcerror_error_set']	676	772	libfsntfs_cluster_block_stream_initialize	call site: 01241	/src/libfsntfs/libfsntfs/libfsntfs_cluster_block_stream.c:945
124	194	2 : View List ['libcdata_btree_get_value_by_value', 'libfsntfs_mft_attribute_list_initialize']	124	1400	libfsntfs_mft_entry_read_attributes	call site: 01457	/src/libfsntfs/libfsntfs/libfsntfs_mft_entry.c:1132
82	82	1 : View List ['libfsntfs_internal_attribute_free']	82	580	libfsntfs_volume_close	call site: 01861	/src/libfsntfs/libfsntfs/libfsntfs_volume.c:957
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_stream_get_size	call site: 01286	/src/libfsfat/libfdata/libfdata_stream.c:2554
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_vector_get_size	call site: 01225	/src/libqcow/libfdata/libfdata_vector.c:1910
63	63	1 : View List ['libfdata_segments_array_calculate_mapped_ranges']	63	539	libfdata_stream_get_segment_index_at_offset	call site: 00986	/src/libfsfat/libfdata/libfdata_stream.c:1085
63	63	1 : View List ['libfdata_segments_array_calculate_mapped_ranges']	63	539	libfdata_vector_get_element_index_at_offset	call site: 00000	/src/libqcow/libfdata/libfdata_vector.c:1078
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01837	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
40	40	1 : View List ['libbfio_handle_get_size']	40	4754	libfsntfs_file_system_read_mft	call site: 00655	/src/libfsntfs/libfsntfs/libfsntfs_file_system.c:391
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	435	1 : View List ['libfsntfs_volume_close']	0	634	libfsntfs_volume_free	call site: 01868	/src/libfsntfs/libfsntfs/libfsntfs_volume.c:187

Runtime coverage analysis

Covered functions

285

Functions that are reachable but not covered

83

Reachable functions

368

Percentage of reachable functions covered

77.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsntfs/ossfuzz/volume_fuzzer.cc	1
libfsntfs/libbfio/libbfio_memory_range.c	2
libfsntfs/libcerror/libcerror_error.c	3
libfsntfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsntfs/libbfio/libbfio_handle.c	10
libfsntfs/libcdata/libcdata_range_list.c	15
libfsntfs/libcdata/libcdata_list_element.c	10
libfsntfs/libcdata/libcdata_range_list_value.c	3
libfsntfs/libfsntfs/libfsntfs_volume.c	5
libfsntfs/libfsntfs/libfsntfs_io_handle.c	3
libfsntfs/libcthreads/libcthreads_read_write_lock.c	4
libfsntfs/libcerror/libcerror_system.c	2
libfsntfs/libfsntfs/libfsntfs_volume_header.c	9
libfsntfs/libfsntfs/libfsntfs_file_system.c	4
libfsntfs/libfsntfs/libfsntfs_mft_entry.c	17
libfsntfs/libcdata/libcdata_array.c	11
libfsntfs/libfsntfs/libfsntfs_mft_entry_header.c	7
libfsntfs/libfsntfs/libfsntfs_fixup_values.c	1
libfsntfs/libfsntfs/libfsntfs_mft_attribute.c	21
libfsntfs/libfsntfs/libfsntfs_data_run.c	3
libfsntfs/libuna/libuna_utf8_string.c	4
libfsntfs/libuna/libuna_unicode_character.c	7
libfsntfs/libfsntfs/libfsntfs_name.c	1
libfsntfs/libfsntfs/libfsntfs_mft.c	3
libfsntfs/libfdata/libfdata_vector.c	9
libfsntfs/libfcache/libfcache_date_time.c	1
libfsntfs/libfdata/libfdata_segments_array.c	4
libfsntfs/libfdata/libfdata_range.c	5
libfsntfs/libfcache/libfcache_cache.c	4
libfsntfs/libcdata/libcdata_list.c	9
libfsntfs/libfcache/libfcache_cache_value.c	8
libfsntfs/libfsntfs/libfsntfs_mft_attribute_list.c	11
libfsntfs/libfsntfs/libfsntfs_mft_attribute_list_entry.c	4
libfsntfs/libfdata/libfdata_mapped_range.c	4
libfsntfs/libfsntfs/libfsntfs_cluster_block_stream.c	5
libfsntfs/libfsntfs/libfsntfs_buffer_data_handle.c	2
libfsntfs/libfdata/libfdata_stream.c	8
libfsntfs/libfsntfs/libfsntfs_compressed_block_data_handle.c	2
libfsntfs/libfsntfs/libfsntfs_compressed_block_vector.c	2
libfsntfs/libfsntfs/libfsntfs_compression_unit_data_handle.c	4
libfsntfs/libfsntfs/libfsntfs_compression_unit_descriptor.c	3
libfsntfs/libfsntfs/libfsntfs_cluster_block_data.c	1
libfsntfs/libfsntfs/libfsntfs_compressed_block.c	2
libfsntfs/libfsntfs/libfsntfs_compression.c	1
libfsntfs/libfwnt/libfwnt_lznt1.c	2
libfsntfs/libfwnt/libfwnt_lzx.c	7
libfsntfs/libfwnt/libfwnt_bit_stream.c	4
libfsntfs/libcnotify/libcnotify_print.c	1
libfsntfs/libfwnt/libfwnt_huffman_tree.c	4
libfsntfs/libfwnt/libfwnt_lzxpress.c	2
libfsntfs/libfsntfs/libfsntfs_compressed_data_handle.c	2
libfsntfs/libcdata/libcdata_btree.c	3
libfsntfs/libcdata/libcdata_tree_node.c	11
libfsntfs/libcdata/libcdata_btree_values_list.c	1
libfsntfs/libfsntfs/libfsntfs_path_hint.c	1
libfsntfs/libcdata/libcdata_btree_node.c	2
libfsntfs/libfsntfs/libfsntfs_file_name_values.c	5
libfsntfs/libfsntfs/libfsntfs_security_descriptor_index.c	3
libfsntfs/libfsntfs/libfsntfs_data_stream.c	2
libfsntfs/libfsntfs/libfsntfs_extent.c	2
libfsntfs/libfsntfs/libfsntfs_index.c	8
libfsntfs/libfsntfs/libfsntfs_index_root_header.c	6
libfsntfs/libfsntfs/libfsntfs_bitmap_values.c	4
libfsntfs/libfsntfs/libfsntfs_cluster_block_vector.c	2
libfsntfs/libfsntfs/libfsntfs_cluster_block.c	4
libfsntfs/libfsntfs/libfsntfs_index_node.c	4
libfsntfs/libfsntfs/libfsntfs_index_node_header.c	3
libfsntfs/libfsntfs/libfsntfs_index_value.c	3
libfsntfs/libfsntfs/libfsntfs_index_entry_vector.c	2
libfsntfs/libfsntfs/libfsntfs_index_entry.c	3
libfsntfs/libfsntfs/libfsntfs_index_entry_header.c	5
libfsntfs/libfsntfs/libfsntfs_attribute.c	1

Fuzzer: libesedb_table_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	774	66.6%
gold	[1:9]	36	3.10%
yellow	[10:29]	27	2.32%
greenyellow	[30:49]	18	1.55%
lawngreen	50+	306	26.3%
All colors	1161	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00142	/src/libqcow/libbfio/libbfio_handle.c:1139
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00462	/src/libqcow/libfcache/libfcache_cache.c:801
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
36	36	1 : View List ['libesedb_root_page_header_free']	36	325	libesedb_page_tree_free	call site: 00601	/src/libesedb/libesedb/libesedb_page_tree.c:235
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	308	1 : View List ['libesedb_file_close']	0	408	libesedb_file_free	call site: 01156	/src/libesedb/libesedb/libesedb_file.c:179
0	268	4 : View List ['free', 'libesedb_block_tree_free', 'libesedb_page_tree_free', 'libcerror_error_set']	0	268	libesedb_catalog_initialize	call site: 00840	/src/libesedb/libesedb/libesedb_catalog.c:158
0	199	3 : View List ['free', 'libesedb_page_tree_free', 'libcerror_error_set']	0	199	libesedb_database_initialize	call site: 00598	/src/libesedb/libesedb/libesedb_database.c:140
0	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	0	142	libfdata_segments_array_append_segment	call site: 00547	/src/libqcow/libfdata/libfdata_segments_array.c:592
0	136	3 : View List ['libesedb_table_definition_free', 'libesedb_catalog_definition_free', 'libcerror_error_set']	0	136	libesedb_catalog_read_value_data	call site: 00904	/src/libesedb/libesedb/libesedb_catalog.c:410
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00333	/src/libqcow/libfdata/libfdata_vector.c:180
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

70

Reachable functions

241

Percentage of reachable functions covered

70.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libesedb/ossfuzz/table_fuzzer.cc	1
libesedb/libbfio/libbfio_memory_range.c	2
libesedb/libcerror/libcerror_error.c	4
libesedb/libbfio/libbfio_memory_range_io_handle.c	3
libesedb/libbfio/libbfio_handle.c	9
libesedb/libcdata/libcdata_range_list.c	15
libesedb/libcdata/libcdata_list_element.c	10
libesedb/libcdata/libcdata_range_list_value.c	3
libesedb/libesedb/libesedb_file.c	7
libesedb/libesedb/libesedb_io_handle.c	5
libesedb/libesedb/libesedb_i18n.c	1
libesedb/libesedb/libesedb_file_header.c	4
libesedb/libesedb/libesedb_checksum.c	2
libesedb/libfdata/libfdata_vector.c	5
libesedb/libcdata/libcdata_array.c	10
libesedb/libfcache/libfcache_date_time.c	1
libesedb/libesedb/libesedb_page.c	13
libesedb/libesedb/libesedb_page_header.c	6
libesedb/libcnotify/libcnotify_print.c	1
libesedb/libesedb/libesedb_page_value.c	2
libesedb/libfdata/libfdata_segments_array.c	2
libesedb/libfdata/libfdata_range.c	4
libesedb/libfcache/libfcache_cache.c	4
libesedb/libcdata/libcdata_list.c	9
libesedb/libfcache/libfcache_cache_value.c	8
libesedb/libfdata/libfdata_mapped_range.c	3
libesedb/libesedb/libesedb_database.c	4
libesedb/libesedb/libesedb_page_tree.c	5
libesedb/libesedb/libesedb_block_tree.c	3
libesedb/libesedb/libesedb_block_tree_node.c	6
libesedb/libcdata/libcdata_btree.c	2
libesedb/libcdata/libcdata_tree_node.c	6
libesedb/libesedb/libesedb_block_descriptor.c	2
libesedb/libesedb/libesedb_root_page_header.c	1
libesedb/libcdata/libcdata_btree_values_list.c	1
libesedb/libesedb/libesedb_leaf_page_descriptor.c	1
libesedb/libesedb/libesedb_page_tree_value.c	3
libesedb/libesedb/libesedb_catalog.c	8
libesedb/libesedb/libesedb_catalog_definition.c	4
libesedb/libesedb/libesedb_table_definition.c	6
libesedb/libuna/libuna_utf8_string.c	1
libesedb/libuna/libuna_unicode_character.c	2
libesedb/libuna/libuna_codepage_koi8_r.c	1
libesedb/libuna/libuna_codepage_koi8_u.c	1
libesedb/libuna/libuna_codepage_mac_arabic.c	1
libesedb/libuna/libuna_codepage_mac_celtic.c	1
libesedb/libuna/libuna_codepage_mac_centraleurroman.c	1
libesedb/libuna/libuna_codepage_mac_croatian.c	1
libesedb/libuna/libuna_codepage_mac_cyrillic.c	1
libesedb/libuna/libuna_codepage_mac_dingbats.c	1
libesedb/libuna/libuna_codepage_mac_farsi.c	1
libesedb/libuna/libuna_codepage_mac_gaelic.c	1
libesedb/libuna/libuna_codepage_mac_greek.c	1
libesedb/libuna/libuna_codepage_mac_icelandic.c	1
libesedb/libuna/libuna_codepage_mac_inuit.c	1
libesedb/libuna/libuna_codepage_mac_roman.c	1
libesedb/libuna/libuna_codepage_mac_romanian.c	1
libesedb/libuna/libuna_codepage_mac_russian.c	1
libesedb/libuna/libuna_codepage_mac_symbol.c	1
libesedb/libuna/libuna_codepage_mac_thai.c	1
libesedb/libuna/libuna_codepage_mac_turkish.c	1
libesedb/libuna/libuna_codepage_mac_ukrainian.c	1
libesedb/libuna/libuna_codepage_windows_874.c	1
libesedb/libuna/libuna_codepage_windows_932.c	1
libesedb/libuna/libuna_codepage_windows_936.c	1
libesedb/libuna/libuna_codepage_windows_949.c	1
libesedb/libuna/libuna_codepage_windows_950.c	1
libesedb/libuna/libuna_codepage_windows_1250.c	1
libesedb/libuna/libuna_codepage_windows_1251.c	1
libesedb/libuna/libuna_codepage_windows_1252.c	1
libesedb/libuna/libuna_codepage_windows_1253.c	1
libesedb/libuna/libuna_codepage_windows_1254.c	1
libesedb/libuna/libuna_codepage_windows_1255.c	1
libesedb/libuna/libuna_codepage_windows_1256.c	1
libesedb/libuna/libuna_codepage_windows_1257.c	1
libesedb/libuna/libuna_codepage_windows_1258.c	1
libesedb/libesedb/libesedb_table.c	2

Fuzzer: libpff_record_set_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1499	65.9%
gold	[1:9]	57	2.50%
yellow	[10:29]	44	1.93%
greenyellow	[30:49]	28	1.23%
lawngreen	50+	646	28.4%
All colors	2274	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
267	363	4 : View List ['free', 'libpff_decompress_data', 'malloc', 'libcerror_error_set']	267	363	libpff_data_block_read_file_io_handle	call site: 00846	/src/libpff/libpff/libpff_data_block.c:831
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00130	/src/libqcow/libbfio/libbfio_handle.c:1139
167	206	3 : View List ['libcdata_btree_get_value_by_value', 'libpff_index_values_list_get_value_by_index', 'libpff_index_value_initialize']	167	370	libpff_descriptors_index_get_index_value_by_identifier	call site: 00713	/src/libpff/libpff/libpff_descriptors_index.c:258
167	206	3 : View List ['libcdata_btree_get_value_by_value', 'libpff_index_values_list_get_value_by_index', 'libpff_index_value_initialize']	167	370	libpff_offsets_index_get_index_value_by_identifier	call site: 00816	/src/libpff/libpff/libpff_offsets_index.c:250
133	341	4 : View List ['free', 'libpff_item_values_free', 'libcerror_error_set', 'libcdata_tree_node_clone']	133	341	libpff_item_initialize	call site: 02185	/src/libpff/libpff/libpff_item.c:188
98	230	3 : View List ['libcdata_array_get_number_of_entries', 'libfdata_stream_get_segment_index_at_offset', 'libcerror_error_set']	98	230	libfdata_stream_seek_offset	call site: 01772	/src/libfsfat/libfdata/libfdata_stream.c:2419
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 01156	/src/libqcow/libfcache/libfcache_cache.c:801
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_stream_get_size	call site: 01756	/src/libfsfat/libfdata/libfdata_stream.c:2554
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
36	84	2 : View List ['libpff_record_entry_get_data_size', 'libpff_table_get_record_entry_by_index']	36	4274	libpff_table_read_entry_value	call site: 01679	/src/libpff/libpff/libpff_table.c:9109
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	3009	1 : View List ['libpff_item_values_read']	0	3148	libpff_item_get_record_set_by_index	call site: 02224	/src/libpff/libpff/libpff_item.c:986

Runtime coverage analysis

Covered functions

292

Functions that are reachable but not covered

70

Reachable functions

362

Percentage of reachable functions covered

80.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpff/ossfuzz/record_set_fuzzer.cc	1
libpff/libbfio/libbfio_memory_range.c	2
libpff/libcerror/libcerror_error.c	4
libpff/libbfio/libbfio_memory_range_io_handle.c	3
libpff/libbfio/libbfio_handle.c	8
libpff/libcdata/libcdata_range_list.c	15
libpff/libcdata/libcdata_list_element.c	10
libpff/libcdata/libcdata_range_list_value.c	3
libpff/libpff/libpff_file.c	6
libpff/libpff/libpff_io_handle.c	3
libpff/libpff/libpff_file_header.c	4
libpff/libpff/libpff_checksum.c	2
libpff/libpff/libpff_descriptors_index.c	3
libpff/libpff/libpff_index.c	5
libpff/libcdata/libcdata_btree.c	3
libpff/libcdata/libcdata_array.c	10
libpff/libcdata/libcdata_tree_node.c	21
libpff/libcdata/libcdata_btree_values_list.c	1
libpff/libcdata/libcdata_list.c	11
libpff/libpff/libpff_index_values_list.c	3
libpff/libpff/libpff_index_value.c	3
libpff/libpff/libpff_offsets_index.c	3
libpff/libpff/libpff_item_tree.c	7
libpff/libpff/libpff_item_descriptor.c	3
libpff/libpff/libpff_index_node.c	6
libpff/libpff/libpff_block_tree.c	3
libpff/libpff/libpff_block_tree_node.c	6
libpff/libpff/libpff_block_descriptor.c	2
libpff/libpff/libpff_name_to_id_map.c	5
libpff/libcdata/libcdata_btree_node.c	2
libpff/libpff/libpff_item_values.c	3
libpff/libpff/libpff_table.c	35
libpff/libpff/libpff_table_header.c	8
libpff/libpff/libpff_local_descriptors_tree.c	3
libpff/libpff/libpff_local_descriptors.c	4
libpff/libfcache/libfcache_cache.c	4
libpff/libfcache/libfcache_cache_value.c	8
libpff/libpff/libpff_data_block.c	5
libpff/libpff/libpff_compression.c	1
libpff/libpff/libpff_deflate.c	8
libpff/libpff/libpff_bit_stream.c	3
libpff/libpff/libpff_huffman_tree.c	4
libpff/libpff/libpff_data_array.c	3
libpff/libfdata/libfdata_list.c	17
libpff/libpff/libpff_data_array_entry.c	2
libpff/libfdata/libfdata_list_element.c	8
libpff/libfdata/libfdata_range.c	4
libpff/libfdata/libfdata_mapped_range.c	4
libpff/libfcache/libfcache_date_time.c	1
libpff/libpff/libpff_encryption.c	1
libpff/libpff/libpff_table_block_index.c	5
libpff/libpff/libpff_table_index_value.c	2
libpff/libpff/libpff_reference_descriptor.c	2
libpff/libpff/libpff_record_set.c	7
libpff/libpff/libpff_record_entry.c	7
libpff/libpff/libpff_column_definition.c	2
libpff/libpff/libpff_local_descriptors_node.c	5
libpff/libpff/libpff_local_descriptor_value.c	3
libpff/libpff/libpff_descriptor_data_stream.c	3
libpff/libfdata/libfdata_stream.c	8
libpff/libfdata/libfdata_segments_array.c	2
libpff/libpff/libpff_value_type.c	1
libpff/libpff/libpff_item.c	4

Fuzzer: libfvde_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1902	90.1%
gold	[1:9]	22	1.04%
yellow	[10:29]	8	0.37%
greenyellow	[30:49]	7	0.33%
lawngreen	50+	170	8.06%
All colors	2109	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
523	523	1 : View List ['libfvde_volume_close']	606	938	libfvde_volume_free	call site: 02099	/src/libfvde/libfvde/libfvde_volume.c:180
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00190	/src/libqcow/libbfio/libbfio_handle.c:1139
193	193	1 : View List ['libfvde_logical_volume_free']	193	476	libfvde_internal_volume_open_read	call site: 01987	/src/libfvde/libfvde/libfvde_volume.c:2481
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00087	/src/libqcow/libcdata/libcdata_list.c:238
85	85	8 : View List ['getc', 'fread', 'ferror', '__errno_location', 'libfplist_xml_scanner_realloc', 'yy_fatal_error', 'libfplist_xml_scanner_restart', 'clearerr']	85	85	yy_get_next_buffer	call site: 00448	/src/libfplist/libfplist/libfplist_xml_scanner.c:158629
83	83	1 : View List ['libfvde_encryption_context_plist_free']	83	188	libfvde_volume_free	call site: 02102	/src/libfvde/libfvde/libfvde_volume.c:272
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01442	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	434	6 : View List ['free', 'libfplist_xml_tag_get_element', 'libfplist_xml_tag_compare_name', 'libfplist_xml_tag_get_number_of_elements', 'libcerror_error_set', 'libfplist_xml_tag_free']	0	434	libfplist_property_list_copy_from_byte_stream	call site: 00560	/src/libfplist/libfplist/libfplist_property_list.c:365
0	241	5 : View List ['free', 'libfvde_physical_volume_descriptor_free', 'libfplist_property_free', 'libcerror_error_set', 'libfplist_property_list_free']	0	241	libfvde_metadata_read_volume_group_plist	call site: 00708	/src/libfvde/libfvde/libfvde_metadata.c:1154
0	144	4 : View List ['free', 'libcdata_array_free', 'libcerror_error_set', 'libcdata_list_free']	0	144	libbfio_pool_initialize	call site: 00082	/src/libodraw/libbfio/libbfio_pool.c:139

Runtime coverage analysis

Covered functions

107

Functions that are reachable but not covered

278

Reachable functions

385

Percentage of reachable functions covered

27.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfvde/ossfuzz/volume_fuzzer.cc	1
libfvde/libbfio/libbfio_memory_range.c	2
libfvde/libcerror/libcerror_error.c	4
libfvde/libbfio/libbfio_memory_range_io_handle.c	3
libfvde/libbfio/libbfio_handle.c	11
libfvde/libcdata/libcdata_range_list.c	15
libfvde/libcdata/libcdata_list_element.c	10
libfvde/libcdata/libcdata_range_list_value.c	3
libfvde/libbfio/libbfio_pool.c	15
libfvde/libcdata/libcdata_array.c	10
libfvde/libcdata/libcdata_list.c	9
libfvde/libfvde/libfvde_volume.c	7
libfvde/libfvde/libfvde_io_handle.c	3
libfvde/libcthreads/libcthreads_read_write_lock.c	4
libfvde/libcerror/libcerror_system.c	2
libfvde/libfvde/libfvde_volume_header.c	4
libfvde/libfvde/libfvde_checksum.c	2
libfvde/libfvde/libfvde_metadata.c	7
libfvde/libfvde/libfvde_metadata_block.c	4
libfvde/libfplist/libfplist_property_list.c	6
libfvde/libfplist/libfplist_xml_parser.c	3
libfvde/libfplist/libfplist_xml_scanner.c	17
libfvde/libfplist/libfplist_xml_scanner.l	5
libfvde/libfplist/libfplist_xml_tag.c	9
libfvde/libfplist/libfplist_xml_attribute.c	2
libfvde/libfplist/libfplist_property.c	10
libfvde/libfvde/libfvde_physical_volume_descriptor.c	2
libfvde/libfguid/libfguid_identifier.c	5
libfvde/libfvde/libfvde_encrypted_metadata.c	32
libfvde/libfvde/libfvde_encryption_context_plist.c	7
libfvde/libfvde/libfvde_encryption_context.c	5
libfvde/libcaes/libcaes_tweaked_context.c	4
libfvde/libcaes/libcaes_context.c	7
libfvde/libfvalue/libfvalue_integer.c	2
libfvde/libfvde/libfvde_compression.c	1
libfvde/libfvde/libfvde_deflate.c	8
libfvde/libfvde/libfvde_bit_stream.c	3
libfvde/libfvde/libfvde_huffman_tree.c	4
libfvde/libfvde/libfvde_logical_volume_descriptor.c	6
libfvde/libfvde/libfvde_segment_descriptor.c	3
libfvde/libfvde/libfvde_logical_volume.c	10
libfvde/libfvde/libfvde_keyring.c	2
libfvde/libfvde/libfvde_password.c	2
libfvde/libuna/libuna_byte_stream.c	2
libfvde/libuna/libuna_unicode_character.c	3
libfvde/libuna/libuna_codepage_mac_symbol.c	2
libfvde/libuna/libuna_codepage_mac_thai.c	2
libfvde/libuna/libuna_codepage_windows_932.c	2
libfvde/libuna/libuna_codepage_windows_936.c	2
libfvde/libuna/libuna_codepage_windows_949.c	2
libfvde/libuna/libuna_codepage_windows_950.c	2
libfvde/libuna/libuna_codepage_koi8_r.c	1
libfvde/libuna/libuna_codepage_koi8_u.c	1
libfvde/libuna/libuna_codepage_mac_arabic.c	1
libfvde/libuna/libuna_codepage_mac_celtic.c	1
libfvde/libuna/libuna_codepage_mac_centraleurroman.c	1
libfvde/libuna/libuna_codepage_mac_croatian.c	1
libfvde/libuna/libuna_codepage_mac_cyrillic.c	1
libfvde/libuna/libuna_codepage_mac_dingbats.c	1
libfvde/libuna/libuna_codepage_mac_farsi.c	1
libfvde/libuna/libuna_codepage_mac_gaelic.c	1
libfvde/libuna/libuna_codepage_mac_greek.c	1
libfvde/libuna/libuna_codepage_mac_icelandic.c	1
libfvde/libuna/libuna_codepage_mac_inuit.c	1
libfvde/libuna/libuna_codepage_mac_roman.c	1
libfvde/libuna/libuna_codepage_mac_romanian.c	1
libfvde/libuna/libuna_codepage_mac_russian.c	1
libfvde/libuna/libuna_codepage_mac_turkish.c	1
libfvde/libuna/libuna_codepage_mac_ukrainian.c	1
libfvde/libuna/libuna_codepage_windows_874.c	1
libfvde/libuna/libuna_codepage_windows_1250.c	1
libfvde/libuna/libuna_codepage_windows_1251.c	1
libfvde/libuna/libuna_codepage_windows_1252.c	1
libfvde/libuna/libuna_codepage_windows_1253.c	1
libfvde/libuna/libuna_codepage_windows_1254.c	1
libfvde/libuna/libuna_codepage_windows_1255.c	1
libfvde/libuna/libuna_codepage_windows_1256.c	1
libfvde/libuna/libuna_codepage_windows_1257.c	1
libfvde/libuna/libuna_codepage_windows_1258.c	1
libfvde/libfvde/libfvde_volume_data_handle.c	3
libfvde/libuna/libuna_base64_stream.c	5
libfvde/libhmac/libhmac_sha256.c	2
libfvde/libhmac/libhmac_sha256_context.c	5
libfvde/libfvde/libfvde_sector_data.c	3
libfvde/libfdata/libfdata_vector.c	4
libfvde/libfcache/libfcache_date_time.c	1
libfvde/libfdata/libfdata_segments_array.c	2
libfvde/libfdata/libfdata_range.c	4
libfvde/libfcache/libfcache_cache.c	3
libfvde/libfcache/libfcache_cache_value.c	6
libfvde/libfdata/libfdata_mapped_range.c	3

Fuzzer: libfwnt_security_identifier_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	18	69.2%
gold	[1:9]	2	7.69%
yellow	[10:29]	1	3.84%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	5	19.2%
All colors	26	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_security_identifier_initialize	call site: 00011	/src/libevt/libfwnt/libfwnt_security_identifier.c:79
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_security_identifier_free	call site: 00023	/src/libevt/libfwnt/libfwnt_security_identifier.c:134
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_internal_security_identifier_free	call site: 00023	/src/libevt/libfwnt/libfwnt_security_identifier.c:162
0	0	None	0	32	libfwnt_security_identifier_initialize	call site: 00001	/src/libevt/libfwnt/libfwnt_security_identifier.c:43
0	0	None	0	32	libfwnt_security_identifier_initialize	call site: 00002	/src/libevt/libfwnt/libfwnt_security_identifier.c:54
0	0	None	0	32	libfwnt_security_identifier_initialize	call site: 00010	/src/libevt/libfwnt/libfwnt_security_identifier.c:68
0	0	None	0	32	libfwnt_security_identifier_free	call site: 00021	/src/libevt/libfwnt/libfwnt_security_identifier.c:117
0	0	None	0	32	libfwnt_security_identifier_copy_from_byte_stream	call site: 00013	/src/libevt/libfwnt/libfwnt_security_identifier.c:198
0	0	None	0	32	libfwnt_security_identifier_copy_from_byte_stream	call site: 00014	/src/libevt/libfwnt/libfwnt_security_identifier.c:211
0	0	None	0	32	libfwnt_security_identifier_copy_from_byte_stream	call site: 00016	/src/libevt/libfwnt/libfwnt_security_identifier.c:233
0	0	None	0	32	libfwnt_security_identifier_copy_from_byte_stream	call site: 00017	/src/libevt/libfwnt/libfwnt_security_identifier.c:244

Runtime coverage analysis

Covered functions

6

Functions that are reachable but not covered

5

Reachable functions

11

Percentage of reachable functions covered

54.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwnt/ossfuzz/security_identifier_fuzzer.cc	1
libfwnt/libfwnt/libfwnt_security_identifier.c	4
libfwnt/libcerror/libcerror_error.c	3

Fuzzer: libesedb_column_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	788	66.6%
gold	[1:9]	48	4.05%
yellow	[10:29]	21	1.77%
greenyellow	[30:49]	17	1.43%
lawngreen	50+	309	26.1%
All colors	1183	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00142	/src/libqcow/libbfio/libbfio_handle.c:1139
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00462	/src/libqcow/libfcache/libfcache_cache.c:801
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
36	36	1 : View List ['libesedb_root_page_header_free']	36	325	libesedb_page_tree_free	call site: 00601	/src/libesedb/libesedb/libesedb_page_tree.c:235
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	308	1 : View List ['libesedb_file_close']	0	408	libesedb_file_free	call site: 01178	/src/libesedb/libesedb/libesedb_file.c:179
0	268	4 : View List ['free', 'libesedb_block_tree_free', 'libesedb_page_tree_free', 'libcerror_error_set']	0	268	libesedb_catalog_initialize	call site: 00840	/src/libesedb/libesedb/libesedb_catalog.c:158
0	199	3 : View List ['free', 'libesedb_page_tree_free', 'libcerror_error_set']	0	199	libesedb_database_initialize	call site: 00598	/src/libesedb/libesedb/libesedb_database.c:140
0	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	0	142	libfdata_segments_array_append_segment	call site: 00547	/src/libqcow/libfdata/libfdata_segments_array.c:592
0	136	3 : View List ['libesedb_table_definition_free', 'libesedb_catalog_definition_free', 'libcerror_error_set']	0	136	libesedb_catalog_read_value_data	call site: 00904	/src/libesedb/libesedb/libesedb_catalog.c:410
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00333	/src/libqcow/libfdata/libfdata_vector.c:180
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

177

Functions that are reachable but not covered

70

Reachable functions

247

Percentage of reachable functions covered

71.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libesedb/ossfuzz/column_fuzzer.cc	1
libesedb/libbfio/libbfio_memory_range.c	2
libesedb/libcerror/libcerror_error.c	4
libesedb/libbfio/libbfio_memory_range_io_handle.c	3
libesedb/libbfio/libbfio_handle.c	9
libesedb/libcdata/libcdata_range_list.c	15
libesedb/libcdata/libcdata_list_element.c	10
libesedb/libcdata/libcdata_range_list_value.c	3
libesedb/libesedb/libesedb_file.c	7
libesedb/libesedb/libesedb_io_handle.c	5
libesedb/libesedb/libesedb_i18n.c	1
libesedb/libesedb/libesedb_file_header.c	4
libesedb/libesedb/libesedb_checksum.c	2
libesedb/libfdata/libfdata_vector.c	5
libesedb/libcdata/libcdata_array.c	10
libesedb/libfcache/libfcache_date_time.c	1
libesedb/libesedb/libesedb_page.c	13
libesedb/libesedb/libesedb_page_header.c	6
libesedb/libcnotify/libcnotify_print.c	1
libesedb/libesedb/libesedb_page_value.c	2
libesedb/libfdata/libfdata_segments_array.c	2
libesedb/libfdata/libfdata_range.c	4
libesedb/libfcache/libfcache_cache.c	4
libesedb/libcdata/libcdata_list.c	9
libesedb/libfcache/libfcache_cache_value.c	8
libesedb/libfdata/libfdata_mapped_range.c	3
libesedb/libesedb/libesedb_database.c	4
libesedb/libesedb/libesedb_page_tree.c	5
libesedb/libesedb/libesedb_block_tree.c	3
libesedb/libesedb/libesedb_block_tree_node.c	6
libesedb/libcdata/libcdata_btree.c	2
libesedb/libcdata/libcdata_tree_node.c	6
libesedb/libesedb/libesedb_block_descriptor.c	2
libesedb/libesedb/libesedb_root_page_header.c	1
libesedb/libcdata/libcdata_btree_values_list.c	1
libesedb/libesedb/libesedb_leaf_page_descriptor.c	1
libesedb/libesedb/libesedb_page_tree_value.c	3
libesedb/libesedb/libesedb_catalog.c	8
libesedb/libesedb/libesedb_catalog_definition.c	4
libesedb/libesedb/libesedb_table_definition.c	8
libesedb/libuna/libuna_utf8_string.c	1
libesedb/libuna/libuna_unicode_character.c	2
libesedb/libuna/libuna_codepage_koi8_r.c	1
libesedb/libuna/libuna_codepage_koi8_u.c	1
libesedb/libuna/libuna_codepage_mac_arabic.c	1
libesedb/libuna/libuna_codepage_mac_celtic.c	1
libesedb/libuna/libuna_codepage_mac_centraleurroman.c	1
libesedb/libuna/libuna_codepage_mac_croatian.c	1
libesedb/libuna/libuna_codepage_mac_cyrillic.c	1
libesedb/libuna/libuna_codepage_mac_dingbats.c	1
libesedb/libuna/libuna_codepage_mac_farsi.c	1
libesedb/libuna/libuna_codepage_mac_gaelic.c	1
libesedb/libuna/libuna_codepage_mac_greek.c	1
libesedb/libuna/libuna_codepage_mac_icelandic.c	1
libesedb/libuna/libuna_codepage_mac_inuit.c	1
libesedb/libuna/libuna_codepage_mac_roman.c	1
libesedb/libuna/libuna_codepage_mac_romanian.c	1
libesedb/libuna/libuna_codepage_mac_russian.c	1
libesedb/libuna/libuna_codepage_mac_symbol.c	1
libesedb/libuna/libuna_codepage_mac_thai.c	1
libesedb/libuna/libuna_codepage_mac_turkish.c	1
libesedb/libuna/libuna_codepage_mac_ukrainian.c	1
libesedb/libuna/libuna_codepage_windows_874.c	1
libesedb/libuna/libuna_codepage_windows_932.c	1
libesedb/libuna/libuna_codepage_windows_936.c	1
libesedb/libuna/libuna_codepage_windows_949.c	1
libesedb/libuna/libuna_codepage_windows_950.c	1
libesedb/libuna/libuna_codepage_windows_1250.c	1
libesedb/libuna/libuna_codepage_windows_1251.c	1
libesedb/libuna/libuna_codepage_windows_1252.c	1
libesedb/libuna/libuna_codepage_windows_1253.c	1
libesedb/libuna/libuna_codepage_windows_1254.c	1
libesedb/libuna/libuna_codepage_windows_1255.c	1
libesedb/libuna/libuna_codepage_windows_1256.c	1
libesedb/libuna/libuna_codepage_windows_1257.c	1
libesedb/libuna/libuna_codepage_windows_1258.c	1
libesedb/libesedb/libesedb_table.c	4
libesedb/libesedb/libesedb_column.c	2

Fuzzer: libluksde_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	965	91.5%
gold	[1:9]	1	0.09%
yellow	[10:29]	1	0.09%
greenyellow	[30:49]	20	1.89%
lawngreen	50+	67	6.35%
All colors	1054	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
578	642	5 : View List ['free', 'libluksde_encryption_context_set_key', 'libluksde_encryption_context_free', 'libluksde_encryption_context_initialize', 'libcerror_error_set']	578	642	libluksde_internal_volume_open_read_keys	call site: 00962	/src/libluksde/libluksde/libluksde_volume.c:1731
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00168	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00994	/src/libqcow/libcdata/libcdata_list.c:238
83	269	4 : View List ['libluksde_sector_data_vector_free', 'libluksde_volume_header_free', 'libluksde_encryption_context_free', 'libcerror_error_set']	83	269	libluksde_internal_volume_open_read	call site: 00969	/src/libluksde/libluksde/libluksde_volume.c:1200
83	83	1 : View List ['libluksde_encryption_context_free']	83	215	libluksde_volume_close	call site: 01041	/src/libluksde/libluksde/libluksde_volume.c:1004
83	83	1 : View List ['libluksde_encryption_context_free']	83	138	libluksde_internal_volume_open_read	call site: 00987	/src/libluksde/libluksde/libluksde_volume.c:1225
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01017	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
2	2	1 : View List ['realloc']	2	98	libcdata_internal_array_resize	call site: 00375	/src/libfplist/libcdata/libcdata_array.c:753
0	278	1 : View List ['libluksde_volume_close']	0	513	libluksde_volume_free	call site: 01045	/src/libluksde/libluksde/libluksde_volume.c:185
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

68

Functions that are reachable but not covered

124

Reachable functions

192

Percentage of reachable functions covered

35.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libluksde/ossfuzz/volume_fuzzer.cc	1
libluksde/libbfio/libbfio_memory_range.c	2
libluksde/libcerror/libcerror_error.c	3
libluksde/libbfio/libbfio_memory_range_io_handle.c	3
libluksde/libbfio/libbfio_handle.c	9
libluksde/libcdata/libcdata_range_list.c	15
libluksde/libcdata/libcdata_list_element.c	10
libluksde/libcdata/libcdata_range_list_value.c	3
libluksde/libluksde/libluksde_volume.c	7
libluksde/libluksde/libluksde_io_handle.c	3
libluksde/libcthreads/libcthreads_read_write_lock.c	4
libluksde/libcerror/libcerror_system.c	2
libluksde/libluksde/libluksde_volume_header.c	7
libluksde/libcdata/libcdata_array.c	7
libluksde/libfguid/libfguid_identifier.c	5
libluksde/libluksde/libluksde_key_slot.c	3
libluksde/libluksde/libluksde_password.c	1
libluksde/libhmac/libhmac_sha1.c	6
libluksde/libhmac/libhmac_sha1_context.c	5
libluksde/libhmac/libhmac_sha224.c	5
libluksde/libhmac/libhmac_sha224_context.c	5
libluksde/libhmac/libhmac_sha256.c	6
libluksde/libhmac/libhmac_sha256_context.c	5
libluksde/libhmac/libhmac_sha512.c	5
libluksde/libhmac/libhmac_sha512_context.c	5
libluksde/libluksde/libluksde_encryption_context.c	4
libluksde/libcaes/libcaes_context.c	8
libluksde/libcaes/libcaes_tweaked_context.c	4
libluksde/libfcrypto/libfcrypto_blowfish_context.c	8
libluksde/libfcrypto/libfcrypto_rc4_context.c	4
libluksde/libfcrypto/libfcrypto_serpent_context.c	7
libluksde/libluksde/libluksde_diffuser.c	2
libluksde/libluksde/libluksde_sector_data_vector.c	2
libluksde/libfcache/libfcache_date_time.c	1
libluksde/libfcache/libfcache_cache.c	2
libluksde/libcdata/libcdata_list.c	3
libluksde/libfcache/libfcache_cache_value.c	1

Fuzzer: libregf_value_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	858	69.3%
gold	[1:9]	11	0.88%
yellow	[10:29]	27	2.18%
greenyellow	[30:49]	11	0.88%
lawngreen	50+	331	26.7%
All colors	1238	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
659	774	2 : View List ['libregf_value_item_read_data_block_list', 'libregf_hive_bins_list_get_index_at_offset']	659	942	libregf_value_item_read_value_data	call site: 00975	/src/libregf/libregf/libregf_value_item.c:704
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00152	/src/libqcow/libbfio/libbfio_handle.c:1139
115	226	3 : View List ['libfdata_stream_clone', 'libregf_value_item_free', 'libcerror_error_set']	115	226	libregf_value_item_clone	call site: 01163	/src/libregf/libregf/libregf_value_item.c:295
75	75	1 : View List ['libfdata_list_calculate_mapped_ranges']	75	551	libfdata_list_get_element_index_at_offset	call site: 00659	/src/libevt/libfdata/libfdata_list.c:3171
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00430	/src/libqcow/libfcache/libfcache_cache.c:801
64	96	2 : View List ['libfdata_stream_free', 'libcerror_error_set']	64	96	libregf_value_item_free	call site: 01056	/src/libregf/libregf/libregf_value_item.c:162
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 01199	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00622	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	253	1 : View List ['libregf_file_close']	0	452	libregf_file_free	call site: 01233	/src/libregf/libregf/libregf_file.c:183
0	171	3 : View List ['free', 'libcerror_error_set', 'libregf_key_item_free']	0	171	libregf_key_initialize	call site: 01078	/src/libregf/libregf/libregf_key.c:155

Runtime coverage analysis

Covered functions

187

Functions that are reachable but not covered

87

Reachable functions

274

Percentage of reachable functions covered

68.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libregf/ossfuzz/value_fuzzer.cc	1
libregf/libbfio/libbfio_memory_range.c	2
libregf/libcerror/libcerror_error.c	3
libregf/libbfio/libbfio_memory_range_io_handle.c	3
libregf/libbfio/libbfio_handle.c	10
libregf/libcdata/libcdata_range_list.c	15
libregf/libcdata/libcdata_list_element.c	10
libregf/libcdata/libcdata_range_list_value.c	3
libregf/libregf/libregf_file.c	8
libregf/libregf/libregf_io_handle.c	3
libregf/libcthreads/libcthreads_read_write_lock.c	6
libregf/libcerror/libcerror_system.c	2
libregf/libregf/libregf_file_header.c	4
libregf/libregf/libregf_checksum.c	1
libregf/libregf/libregf_hive_bins_list.c	7
libregf/libfdata/libfdata_list.c	11
libregf/libcdata/libcdata_array.c	11
libregf/libregf/libregf_hive_bin_header.c	4
libregf/libregf/libregf_hive_bin.c	5
libregf/libregf/libregf_hive_bin_cell.c	2
libregf/libfdata/libfdata_list_element.c	9
libregf/libfdata/libfdata_range.c	4
libregf/libfcache/libfcache_cache.c	4
libregf/libcdata/libcdata_list.c	9
libregf/libfcache/libfcache_cache_value.c	8
libregf/libfdata/libfdata_mapped_range.c	4
libregf/libfcache/libfcache_date_time.c	1
libregf/libregf/libregf_dirty_vector.c	4
libregf/libregf/libregf_key.c	7
libregf/libregf/libregf_key_item.c	12
libregf/libregf/libregf_named_key.c	3
libregf/libuna/libuna_unicode_character.c	4
libregf/libuna/libuna_codepage_koi8_r.c	1
libregf/libuna/libuna_codepage_koi8_u.c	1
libregf/libuna/libuna_codepage_mac_arabic.c	1
libregf/libuna/libuna_codepage_mac_celtic.c	1
libregf/libuna/libuna_codepage_mac_centraleurroman.c	1
libregf/libuna/libuna_codepage_mac_croatian.c	1
libregf/libuna/libuna_codepage_mac_cyrillic.c	1
libregf/libuna/libuna_codepage_mac_dingbats.c	1
libregf/libuna/libuna_codepage_mac_farsi.c	1
libregf/libuna/libuna_codepage_mac_gaelic.c	1
libregf/libuna/libuna_codepage_mac_greek.c	1
libregf/libuna/libuna_codepage_mac_icelandic.c	1
libregf/libuna/libuna_codepage_mac_inuit.c	1
libregf/libuna/libuna_codepage_mac_roman.c	1
libregf/libuna/libuna_codepage_mac_romanian.c	1
libregf/libuna/libuna_codepage_mac_russian.c	1
libregf/libuna/libuna_codepage_mac_symbol.c	1
libregf/libuna/libuna_codepage_mac_thai.c	1
libregf/libuna/libuna_codepage_mac_turkish.c	1
libregf/libuna/libuna_codepage_mac_ukrainian.c	1
libregf/libuna/libuna_codepage_windows_874.c	1
libregf/libuna/libuna_codepage_windows_932.c	1
libregf/libuna/libuna_codepage_windows_936.c	1
libregf/libuna/libuna_codepage_windows_949.c	1
libregf/libuna/libuna_codepage_windows_950.c	1
libregf/libuna/libuna_codepage_windows_1250.c	1
libregf/libuna/libuna_codepage_windows_1251.c	1
libregf/libuna/libuna_codepage_windows_1252.c	1
libregf/libuna/libuna_codepage_windows_1253.c	1
libregf/libuna/libuna_codepage_windows_1254.c	1
libregf/libuna/libuna_codepage_windows_1255.c	1
libregf/libuna/libuna_codepage_windows_1256.c	1
libregf/libuna/libuna_codepage_windows_1257.c	1
libregf/libuna/libuna_codepage_windows_1258.c	1
libregf/libregf/libregf_security_key.c	3
libregf/libregf/libregf_sub_key_list.c	3
libregf/libregf/libregf_key_descriptor.c	2
libregf/libregf/libregf_value_item.c	8
libregf/libregf/libregf_value_key.c	5
libregf/libregf/libregf_data_block_key.c	3
libregf/libfdata/libfdata_stream.c	5
libregf/libregf/libregf_data_block_stream.c	1
libregf/libfdata/libfdata_segments_array.c	1
libregf/libuna/libuna_utf16_string.c	1
libregf/libregf/libregf_value.c	3

Fuzzer: libfusn_record_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	18	66.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	11.1%
greenyellow	[30:49]	1	3.70%
lawngreen	50+	5	18.5%
All colors	27	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfusn_record_initialize	call site: 00011	/src/libfusn/libfusn/libfusn_record.c:86
0	32	1 : View List ['libcerror_error_set']	0	32	libfusn_record_free	call site: 00025	/src/libfusn/libfusn/libfusn_record.c:123
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfusn_record_copy_from_byte_stream	call site: 00023	/src/libfusn/libfusn/libfusn_record.c:479
0	0	None	0	32	libfusn_record_initialize	call site: 00001	/src/libfusn/libfusn/libfusn_record.c:50
0	0	None	0	32	libfusn_record_initialize	call site: 00002	/src/libfusn/libfusn/libfusn_record.c:61
0	0	None	0	32	libfusn_record_initialize	call site: 00010	/src/libfusn/libfusn/libfusn_record.c:75
0	0	None	0	32	libfusn_record_copy_from_byte_stream	call site: 00013	/src/libfusn/libfusn/libfusn_record.c:169
0	0	None	0	32	libfusn_record_copy_from_byte_stream	call site: 00014	/src/libfusn/libfusn/libfusn_record.c:182
0	0	None	0	32	libfusn_record_copy_from_byte_stream	call site: 00015	/src/libfusn/libfusn/libfusn_record.c:193
0	0	None	0	32	libfusn_record_copy_from_byte_stream	call site: 00016	/src/libfusn/libfusn/libfusn_record.c:204
0	0	None	0	32	libfusn_record_copy_from_byte_stream	call site: 00022	/src/libfusn/libfusn/libfusn_record.c:466

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

5

Reachable functions

10

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfusn/ossfuzz/record_fuzzer.cc	1
libfusn/libfusn/libfusn_record.c	3
libfusn/libcerror/libcerror_error.c	3

Fuzzer: libhmac_sha256_context_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	84.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	8	16.0%
All colors	50	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	68	2 : View List ['libhmac_sha256_context_free', 'libcerror_error_set']	32	68	libhmac_sha256_calculate	call site: 00046	/src/libfsapfs/libhmac/libhmac_sha256.c:196
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha256_context_transform	call site: 00027	/src/libfsapfs/libhmac/libhmac_sha256_context.c:420
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha256_context_initialize	call site: 00013	/src/libfsapfs/libhmac/libhmac_sha256_context.c:592
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha256_context_free	call site: 00046	/src/libfsapfs/libhmac/libhmac_sha256_context.c:631
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha256_context_update	call site: 00032	/src/libfsapfs/libhmac/libhmac_sha256_context.c:987
32	32	1 : View List ['libcerror_error_set']	32	32	libhmac_sha256_context_finalize	call site: 00043	/src/libfsapfs/libhmac/libhmac_sha256_context.c:1333
0	0	None	192	274	libhmac_sha256_context_update	call site: 00019	/src/libfsapfs/libhmac/libhmac_sha256_context.c:888
0	0	None	32	68	libhmac_sha256_calculate	call site: 00002	/src/libfsapfs/libhmac/libhmac_sha256.c:153
0	0	None	32	68	libhmac_sha256_calculate	call site: 00016	/src/libfsapfs/libhmac/libhmac_sha256.c:166
0	0	None	32	68	libhmac_sha256_calculate	call site: 00035	/src/libfsapfs/libhmac/libhmac_sha256.c:181
0	0	None	32	32	libhmac_sha256_context_transform	call site: 00022	/src/libfsapfs/libhmac/libhmac_sha256_context.c:248
0	0	None	32	32	libhmac_sha256_context_transform	call site: 00023	/src/libfsapfs/libhmac/libhmac_sha256_context.c:259

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

6

Reachable functions

13

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libhmac/ossfuzz/sha256_context_fuzzer.cc	1
libhmac/libhmac/libhmac_sha256.c	1
libhmac/libhmac/libhmac_sha256_context.c	5
libhmac/libcerror/libcerror_error.c	3

Fuzzer: libfsapfs_file_entry_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1413	65.2%
gold	[1:9]	74	3.41%
yellow	[10:29]	25	1.15%
greenyellow	[30:49]	30	1.38%
lawngreen	50+	623	28.7%
All colors	2165	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
778	778	4 : View List ['libfsapfs_container_key_bag_get_volume_key_bag_extent_by_identifier', 'libfsapfs_encryption_context_initialize', 'libfsapfs_volume_key_bag_initialize', 'libfsapfs_volume_key_bag_read_file_io_handle']	881	2838	libfsapfs_internal_volume_open_read	call site: 00965	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:554
729	729	1 : View List ['libfsapfs_file_system_btree_get_attributes_from_branch_node']	729	805	libfsapfs_file_system_btree_get_attributes	call site: 01772	/src/libfsapfs/libfsapfs/libfsapfs_file_system_btree.c:4286
722	722	1 : View List ['libfsapfs_file_system_btree_get_directory_entries_from_branch_node']	722	798	libfsapfs_file_system_btree_get_directory_entries	call site: 01470	/src/libfsapfs/libfsapfs/libfsapfs_file_system_btree.c:3468
717	1666	2 : View List ['libfsapfs_data_stream_initialize_from_file_extents', 'libfsapfs_attributes_get_file_extents']	717	1730	libfsapfs_attributes_get_data_stream	call site: 01860	/src/libfsapfs/libfsapfs/libfsapfs_attributes.c:144
712	712	1 : View List ['libfsapfs_file_system_btree_get_file_extents_from_branch_node']	712	788	libfsapfs_file_system_btree_get_file_extents	call site: 01868	/src/libfsapfs/libfsapfs/libfsapfs_file_system_btree.c:5085
645	3443	2 : View List ['libfsapfs_attributes_get_data_stream', 'libfsapfs_data_stream_initialize_from_compressed_data_stream']	645	3635	libfsapfs_internal_file_entry_get_data_stream	call site: 02075	/src/libfsapfs/libfsapfs/libfsapfs_file_entry.c:4342
431	431	1 : View List ['libfsapfs_internal_volume_unlock']	431	1696	libfsapfs_internal_volume_get_file_system	call site: 01206	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:2832
423	423	5 : View List ['libfsapfs_encryption_context_crypt', 'libfsapfs_container_key_bag_read_data', 'malloc', 'libfsapfs_encryption_context_initialize', 'libfsapfs_encryption_context_set_keys']	517	709	libfsapfs_container_key_bag_read_file_io_handle	call site: 00472	/src/libfsapfs/libfsapfs/libfsapfs_container_key_bag.c:275
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00149	/src/libqcow/libbfio/libbfio_handle.c:1139
152	1825	6 : View List ['libfsapfs_attributes_get_data_stream', 'libfsapfs_compressed_data_header_initialize', 'libfsapfs_compressed_data_header_read_data', 'libfdata_stream_read_buffer_at_offset', 'libfdata_stream_free', 'libfsapfs_compressed_data_header_free']	152	2085	libfsapfs_internal_file_entry_get_data_size	call site: 02056	/src/libfsapfs/libfsapfs/libfsapfs_file_entry.c:4963
114	114	1 : View List ['libfsapfs_inode_get_utf8_name']	114	246	libfsapfs_file_entry_get_utf8_name	call site: 01727	/src/libfsapfs/libfsapfs/libfsapfs_file_entry.c:1597
103	653	11 : View List ['libfsapfs_object_map_free', 'libfsapfs_volume_key_bag_free', 'libfsapfs_volume_superblock_free', 'libfsapfs_object_map_btree_free', 'libfdata_vector_free', 'libcdata_array_free', 'libfsapfs_encryption_context_free', 'libfsapfs_container_data_handle_free', 'libfsapfs_snapshot_metadata_tree_free', 'libfsapfs_file_system_data_handle_free', 'libcerror_error_set']	103	653	libfsapfs_internal_volume_open_read	call site: 01140	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:794

Runtime coverage analysis

Covered functions

283

Functions that are reachable but not covered

123

Reachable functions

406

Percentage of reachable functions covered

69.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsapfs/ossfuzz/file_entry_fuzzer.cc	1
libfsapfs/libbfio/libbfio_memory_range.c	2
libfsapfs/libcerror/libcerror_error.c	3
libfsapfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsapfs/libbfio/libbfio_handle.c	8
libfsapfs/libcdata/libcdata_range_list.c	15
libfsapfs/libcdata/libcdata_list_element.c	10
libfsapfs/libcdata/libcdata_range_list_value.c	3
libfsapfs/libfsapfs/libfsapfs_container.c	7
libfsapfs/libfsapfs/libfsapfs_io_handle.c	3
libfsapfs/libcthreads/libcthreads_read_write_lock.c	6
libfsapfs/libcerror/libcerror_system.c	2
libfsapfs/libfsapfs/libfsapfs_container_superblock.c	4
libfsapfs/libfsapfs/libfsapfs_checksum.c	1
libfsapfs/libfsapfs/libfsapfs_object.c	4
libfsapfs/libfsapfs/libfsapfs_checkpoint_map.c	4
libfsapfs/libcdata/libcdata_array.c	9
libfsapfs/libfsapfs/libfsapfs_checkpoint_map_entry.c	3
libfsapfs/libfsapfs/libfsapfs_container_data_handle.c	2
libfsapfs/libfdata/libfdata_vector.c	5
libfsapfs/libfcache/libfcache_date_time.c	1
libfsapfs/libfdata/libfdata_segments_array.c	3
libfsapfs/libfdata/libfdata_mapped_range.c	4
libfsapfs/libfdata/libfdata_range.c	5
libfsapfs/libfsapfs/libfsapfs_object_map.c	4
libfsapfs/libfsapfs/libfsapfs_object_map_btree.c	7
libfsapfs/libfcache/libfcache_cache.c	4
libfsapfs/libcdata/libcdata_list.c	9
libfsapfs/libfsapfs/libfsapfs_container_key_bag.c	6
libfsapfs/libfsapfs/libfsapfs_encryption_context.c	5
libfsapfs/libcaes/libcaes_tweaked_context.c	4
libfsapfs/libcaes/libcaes_context.c	7
libfsapfs/libfsapfs/libfsapfs_key_bag_header.c	3
libfsapfs/libfsapfs/libfsapfs_key_bag_entry.c	3
libfsapfs/libfcache/libfcache_cache_value.c	8
libfsapfs/libfsapfs/libfsapfs_fusion_middle_tree.c	1
libfsapfs/libfsapfs/libfsapfs_btree_node.c	7
libfsapfs/libfsapfs/libfsapfs_btree_node_header.c	3
libfsapfs/libfsapfs/libfsapfs_btree_footer.c	3
libfsapfs/libfsapfs/libfsapfs_btree_entry.c	4
libfsapfs/libfsapfs/libfsapfs_object_map_descriptor.c	4
libfsapfs/libfsapfs/libfsapfs_volume.c	7
libfsapfs/libfsapfs/libfsapfs_volume_superblock.c	4
libfsapfs/libfsapfs/libfsapfs_volume_key_bag.c	5
libfsapfs/libfsapfs/libfsapfs_snapshot_metadata_tree.c	8
libfsapfs/libfsapfs/libfsapfs_snapshot_metadata.c	4
libfsapfs/libfsapfs/libfsapfs_file_system_data_handle.c	2
libfsapfs/libfsapfs/libfsapfs_file_system.c	3
libfsapfs/libfsapfs/libfsapfs_file_system_btree.c	17
libfsapfs/libfsapfs/libfsapfs_key_encrypted_key.c	5
libfsapfs/libfsapfs/libfsapfs_password.c	1
libfsapfs/libhmac/libhmac_sha256.c	2
libfsapfs/libhmac/libhmac_sha256_context.c	5
libfsapfs/libfsapfs/libfsapfs_inode.c	21
libfsapfs/libfsapfs/libfsapfs_file_entry.c	30
libfsapfs/libfsapfs/libfsapfs_directory_record.c	9
libfsapfs/libfsapfs/libfsapfs_attribute_values.c	5
libfsapfs/libfsapfs/libfsapfs_file_extent.c	4
libfsapfs/libfsapfs/libfsapfs_compressed_data_header.c	3
libfsapfs/libfdata/libfdata_stream.c	8
libfsapfs/libuna/libuna_utf8_string.c	4
libfsapfs/libuna/libuna_unicode_character.c	3
libfsapfs/libfsapfs/libfsapfs_attributes.c	2
libfsapfs/libfsapfs/libfsapfs_data_stream.c	3
libfsapfs/libfsapfs/libfsapfs_data_block_data_handle.c	2
libfsapfs/libfsapfs/libfsapfs_data_block_vector.c	1
libfsapfs/libfsapfs/libfsapfs_buffer_data_handle.c	2
libfsapfs/libfsapfs/libfsapfs_compressed_data_handle.c	2

Fuzzer: libfsxfs_extended_attribute_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	735	70.8%
gold	[1:9]	26	2.50%
yellow	[10:29]	21	2.02%
greenyellow	[30:49]	21	2.02%
lawngreen	50+	234	22.5%
All colors	1037	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00145	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
142	174	2 : View List ['libcerror_error_set', 'libfsxfs_file_entry_free']	142	174	libfsxfs_volume_get_file_entry_by_utf8_path	call site: 00867	/src/libfsxfs/libfsxfs/libfsxfs_volume.c:2113
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00403	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
40	40	1 : View List ['libfsxfs_directory_entry_clone']	40	309	libfsxfs_file_system_get_directory_entry_by_utf8_path	call site: 00774	/src/libfsxfs/libfsxfs/libfsxfs_file_system.c:667
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	490	1 : View List ['libfsxfs_extent_btree_get_extents_from_branch_node']	0	682	libfsxfs_extent_btree_get_extents_from_node	call site: 00584	/src/libfsxfs/libfsxfs/libfsxfs_extent_btree.c:698
0	206	1 : View List ['libfsxfs_volume_close']	0	405	libfsxfs_volume_free	call site: 01031	/src/libfsxfs/libfsxfs/libfsxfs_volume.c:180
0	182	4 : View List ['libfsxfs_directory_entry_free', 'libfsxfs_inode_free', 'libcerror_error_set', 'libfsxfs_directory_free']	0	182	libfsxfs_file_system_get_directory_entry_by_utf8_path	call site: 00781	/src/libfsxfs/libfsxfs/libfsxfs_file_system.c:707
0	166	4 : View List ['libfsxfs_block_directory_free', 'libfsxfs_directory_table_free', 'libcdata_array_empty', 'libcerror_error_set']	0	166	libfsxfs_directory_read_file_io_handle	call site: 00668	/src/libfsxfs/libfsxfs/libfsxfs_directory.c:301
0	160	3 : View List ['libcdata_array_free', 'libcerror_error_set', 'libfsxfs_extent_btree_free']	0	160	libfsxfs_inode_read_file_io_handle	call site: 00618	/src/libfsxfs/libfsxfs/libfsxfs_inode.c:1242
0	118	3 : View List ['libfsxfs_btree_block_free', 'libcerror_error_set', 'libcdata_array_empty']	0	118	libfsxfs_extent_btree_get_extents_from_node	call site: 00591	/src/libfsxfs/libfsxfs/libfsxfs_extent_btree.c:742

Runtime coverage analysis

Covered functions

118

Functions that are reachable but not covered

100

Reachable functions

218

Percentage of reachable functions covered

54.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsxfs/ossfuzz/extended_attribute_fuzzer.cc	1
libfsxfs/libbfio/libbfio_memory_range.c	2
libfsxfs/libcerror/libcerror_error.c	3
libfsxfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsxfs/libbfio/libbfio_handle.c	9
libfsxfs/libcdata/libcdata_range_list.c	15
libfsxfs/libcdata/libcdata_list_element.c	10
libfsxfs/libcdata/libcdata_range_list_value.c	3
libfsxfs/libfsxfs/libfsxfs_volume.c	7
libfsxfs/libfsxfs/libfsxfs_io_handle.c	3
libfsxfs/libcthreads/libcthreads_read_write_lock.c	4
libfsxfs/libcerror/libcerror_system.c	2
libfsxfs/libfsxfs/libfsxfs_superblock.c	4
libfsxfs/libfsxfs/libfsxfs_file_system.c	5
libfsxfs/libfsxfs/libfsxfs_inode_btree.c	7
libfsxfs/libcdata/libcdata_array.c	9
libfsxfs/libfsxfs/libfsxfs_inode_information.c	4
libfsxfs/libfsxfs/libfsxfs_btree_block.c	4
libfsxfs/libfsxfs/libfsxfs_btree_header.c	3
libfsxfs/libfsxfs/libfsxfs_inode_btree_record.c	3
libfsxfs/libfsxfs/libfsxfs_inode.c	9
libfsxfs/libfsxfs/libfsxfs_extent_list.c	1
libfsxfs/libfsxfs/libfsxfs_extents.c	2
libfsxfs/libfsxfs/libfsxfs_extent.c	3
libfsxfs/libfsxfs/libfsxfs_extent_btree.c	5
libfsxfs/libfsxfs/libfsxfs_directory.c	4
libfsxfs/libfsxfs/libfsxfs_directory_entry.c	5
libfsxfs/libfsxfs/libfsxfs_directory_table.c	3
libfsxfs/libfsxfs/libfsxfs_directory_table_header.c	3
libfsxfs/libfsxfs/libfsxfs_block_directory.c	4
libfsxfs/libfsxfs/libfsxfs_block_directory_header.c	3
libfsxfs/libfsxfs/libfsxfs_block_directory_footer.c	3
libfsxfs/libuna/libuna_unicode_character.c	1
libfsxfs/libuna/libuna_utf8_string.c	1
libfsxfs/libfsxfs/libfsxfs_file_entry.c	5
libfsxfs/libfsxfs/libfsxfs_data_stream.c	3
libfsxfs/libfsxfs/libfsxfs_buffer_data_handle.c	2
libfsxfs/libfdata/libfdata_stream.c	4
libfsxfs/libfdata/libfdata_segments_array.c	1
libfsxfs/libfdata/libfdata_mapped_range.c	3
libfsxfs/libfdata/libfdata_range.c	3
libfsxfs/libfsxfs/libfsxfs_block_data_handle.c	1
libfsxfs/libfsxfs/libfsxfs_attribute_values.c	4
libfsxfs/libfsxfs/libfsxfs_attributes.c	4
libfsxfs/libfsxfs/libfsxfs_attributes_table.c	3
libfsxfs/libfsxfs/libfsxfs_attributes_table_header.c	3
libfsxfs/libfsxfs/libfsxfs_file_system_block.c	4
libfsxfs/libfsxfs/libfsxfs_file_system_block_header.c	3
libfsxfs/libfsxfs/libfsxfs_attributes_leaf_block_header.c	3
libfsxfs/libfsxfs/libfsxfs_extended_attribute.c	2

Fuzzer: libfwps_record_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	79	70.5%
gold	[1:9]	2	1.78%
yellow	[10:29]	3	2.67%
greenyellow	[30:49]	2	1.78%
lawngreen	50+	26	23.2%
All colors	112	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00076	/src/libfplist/libcdata/libcdata_array.c:823
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00021	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00105	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_internal_array_resize	call site: 00075	/src/libfplist/libcdata/libcdata_array.c:797
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_get_number_of_entries	call site: 00086	/src/libfplist/libcdata/libcdata_array.c:1052
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_get_entry_by_index	call site: 00094	/src/libfplist/libcdata/libcdata_array.c:1146
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_append_entry	call site: 00069	/src/libfplist/libcdata/libcdata_array.c:1609
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwps_record_initialize	call site: 00039	/src/libfwps/libfwps/libfwps_record.c:98
0	32	1 : View List ['libcerror_error_set']	0	32	libfwps_record_free	call site: 00097	/src/libfwps/libfwps/libfwps_record.c:136
0	32	1 : View List ['libcerror_error_set']	0	32	libfwps_internal_record_free	call site: 00081	/src/libfwps/libfwps/libfwps_record.c:163
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwps_record_copy_from_byte_stream	call site: 00062	/src/libfwps/libfwps/libfwps_record.c:698

Runtime coverage analysis

Covered functions

19

Functions that are reachable but not covered

6

Reachable functions

25

Percentage of reachable functions covered

76.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwps/ossfuzz/record_fuzzer.cc	1
libfwps/libfwps/libfwps_set.c	6
libfwps/libcerror/libcerror_error.c	3
libfwps/libcdata/libcdata_array.c	7
libfwps/libfwps/libfwps_record.c	4

Fuzzer: libpff_item_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1541	67.9%
gold	[1:9]	75	3.30%
yellow	[10:29]	36	1.58%
greenyellow	[30:49]	24	1.05%
lawngreen	50+	591	26.0%
All colors	2267	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
267	363	4 : View List ['free', 'libpff_decompress_data', 'malloc', 'libcerror_error_set']	267	363	libpff_data_block_read_file_io_handle	call site: 00846	/src/libpff/libpff/libpff_data_block.c:831
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00130	/src/libqcow/libbfio/libbfio_handle.c:1139
167	206	3 : View List ['libcdata_btree_get_value_by_value', 'libpff_index_values_list_get_value_by_index', 'libpff_index_value_initialize']	167	370	libpff_descriptors_index_get_index_value_by_identifier	call site: 00713	/src/libpff/libpff/libpff_descriptors_index.c:258
167	206	3 : View List ['libcdata_btree_get_value_by_value', 'libpff_index_values_list_get_value_by_index', 'libpff_index_value_initialize']	167	370	libpff_offsets_index_get_index_value_by_identifier	call site: 00816	/src/libpff/libpff/libpff_offsets_index.c:250
133	341	4 : View List ['free', 'libpff_item_values_free', 'libcerror_error_set', 'libcdata_tree_node_clone']	133	341	libpff_item_initialize	call site: 02185	/src/libpff/libpff/libpff_item.c:188
98	230	3 : View List ['libcdata_array_get_number_of_entries', 'libfdata_stream_get_segment_index_at_offset', 'libcerror_error_set']	98	230	libfdata_stream_seek_offset	call site: 01772	/src/libfsfat/libfdata/libfdata_stream.c:2419
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 01156	/src/libqcow/libfcache/libfcache_cache.c:801
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_stream_get_size	call site: 01756	/src/libfsfat/libfdata/libfdata_stream.c:2554
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
36	84	2 : View List ['libpff_record_entry_get_data_size', 'libpff_table_get_record_entry_by_index']	36	4274	libpff_table_read_entry_value	call site: 01679	/src/libpff/libpff/libpff_table.c:9109
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	1163	1 : View List ['libpff_local_descriptors_get_leaf_node_from_node_by_identifier']	0	1405	libpff_local_descriptors_get_leaf_node_from_node_by_identifier	call site: 01610	/src/libpff/libpff/libpff_local_descriptors.c:516

Runtime coverage analysis

Covered functions

288

Functions that are reachable but not covered

71

Reachable functions

359

Percentage of reachable functions covered

80.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpff/ossfuzz/item_fuzzer.cc	1
libpff/libbfio/libbfio_memory_range.c	2
libpff/libcerror/libcerror_error.c	4
libpff/libbfio/libbfio_memory_range_io_handle.c	3
libpff/libbfio/libbfio_handle.c	8
libpff/libcdata/libcdata_range_list.c	15
libpff/libcdata/libcdata_list_element.c	10
libpff/libcdata/libcdata_range_list_value.c	3
libpff/libpff/libpff_file.c	6
libpff/libpff/libpff_io_handle.c	3
libpff/libpff/libpff_file_header.c	4
libpff/libpff/libpff_checksum.c	2
libpff/libpff/libpff_descriptors_index.c	3
libpff/libpff/libpff_index.c	5
libpff/libcdata/libcdata_btree.c	3
libpff/libcdata/libcdata_array.c	10
libpff/libcdata/libcdata_tree_node.c	21
libpff/libcdata/libcdata_btree_values_list.c	1
libpff/libcdata/libcdata_list.c	11
libpff/libpff/libpff_index_values_list.c	3
libpff/libpff/libpff_index_value.c	3
libpff/libpff/libpff_offsets_index.c	3
libpff/libpff/libpff_item_tree.c	7
libpff/libpff/libpff_item_descriptor.c	3
libpff/libpff/libpff_index_node.c	6
libpff/libpff/libpff_block_tree.c	3
libpff/libpff/libpff_block_tree_node.c	6
libpff/libpff/libpff_block_descriptor.c	2
libpff/libpff/libpff_name_to_id_map.c	5
libpff/libcdata/libcdata_btree_node.c	2
libpff/libpff/libpff_item_values.c	3
libpff/libpff/libpff_table.c	33
libpff/libpff/libpff_table_header.c	8
libpff/libpff/libpff_local_descriptors_tree.c	3
libpff/libpff/libpff_local_descriptors.c	4
libpff/libfcache/libfcache_cache.c	4
libpff/libfcache/libfcache_cache_value.c	8
libpff/libpff/libpff_data_block.c	5
libpff/libpff/libpff_compression.c	1
libpff/libpff/libpff_deflate.c	8
libpff/libpff/libpff_bit_stream.c	3
libpff/libpff/libpff_huffman_tree.c	4
libpff/libpff/libpff_data_array.c	3
libpff/libfdata/libfdata_list.c	17
libpff/libpff/libpff_data_array_entry.c	2
libpff/libfdata/libfdata_list_element.c	8
libpff/libfdata/libfdata_range.c	4
libpff/libfdata/libfdata_mapped_range.c	4
libpff/libfcache/libfcache_date_time.c	1
libpff/libpff/libpff_encryption.c	1
libpff/libpff/libpff_table_block_index.c	5
libpff/libpff/libpff_table_index_value.c	2
libpff/libpff/libpff_reference_descriptor.c	2
libpff/libpff/libpff_record_set.c	6
libpff/libpff/libpff_record_entry.c	7
libpff/libpff/libpff_column_definition.c	2
libpff/libpff/libpff_local_descriptors_node.c	5
libpff/libpff/libpff_local_descriptor_value.c	3
libpff/libpff/libpff_descriptor_data_stream.c	3
libpff/libfdata/libfdata_stream.c	8
libpff/libfdata/libfdata_segments_array.c	2
libpff/libpff/libpff_value_type.c	1
libpff/libpff/libpff_item.c	4

Fuzzer: libfcrypto_crypt_serpent_ecb_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	36	81.8%
gold	[1:9]	1	2.27%
yellow	[10:29]	1	2.27%
greenyellow	[30:49]	1	2.27%
lawngreen	50+	5	11.3%
All colors	44	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfcrypto_serpent_context_initialize	call site: 00011	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:609
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_serpent_context_free	call site: 00042	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:663
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_serpent_context_set_key	call site: 00018	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:775
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_internal_serpent_context_encrypt_block	call site: 00031	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:1541
0	0	None	41	146	libfcrypto_serpent_crypt_ecb	call site: 00026	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:2684
0	0	None	0	32	libfcrypto_serpent_context_initialize	call site: 00001	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:573
0	0	None	0	32	libfcrypto_serpent_context_initialize	call site: 00002	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:584
0	0	None	0	32	libfcrypto_serpent_context_initialize	call site: 00010	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:598
0	0	None	0	32	libfcrypto_serpent_context_free	call site: 00041	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:647
0	0	None	0	32	libfcrypto_serpent_context_set_key	call site: 00013	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:706
0	0	None	0	32	libfcrypto_serpent_context_set_key	call site: 00014	/src/libfcrypto/libfcrypto/libfcrypto_serpent_context.c:719

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

6

Reachable functions

13

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfcrypto/ossfuzz/crypt_serpent_ecb_fuzzer.cc	1
libfcrypto/libfcrypto/libfcrypto_serpent_context.c	6
libfcrypto/libcerror/libcerror_error.c	3

Fuzzer: libfwevt_xml_document_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	410	55.5%
gold	[1:9]	37	5.01%
yellow	[10:29]	39	5.28%
greenyellow	[30:49]	14	1.89%
lawngreen	50+	238	32.2%
All colors	738	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
115	5946	7 : View List ['free', 'libfwevt_xml_tag_free', 'libfwevt_xml_tag_set_value_type', 'libfvalue_utf16_string_with_index_copy_from_integer', 'libfvalue_string_size_from_integer', 'libfwevt_xml_tag_append_value_data', 'malloc']	115	6394	libfwevt_xml_document_read_character_reference	call site: 00447	/src/libfwevt/libfwevt/libfwevt_xml_document.c:1264
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	58993	13 : View List ['libfwevt_xml_document_read_element', 'libfwevt_xml_document_read_attribute', 'libfwevt_xml_document_read_optional_substitution', 'libfwevt_xml_document_read_pi_target', 'libfwevt_xml_document_read_value', 'libfwevt_xml_tag_append_element', 'libfwevt_xml_document_read_cdata_section', 'libfwevt_xml_token_read_data', 'libfwevt_xml_document_read_entity_reference', 'libfwevt_xml_document_read_name', 'libfwevt_xml_document_read_character_reference', 'libfwevt_xml_tag_initialize', 'libfwevt_xml_document_read_normal_substitution']	0	60367	libfwevt_xml_document_read_element	call site: 00214	/src/libfwevt/libfwevt/libfwevt_xml_document.c:2274
0	175	3 : View List ['libfwevt_xml_token_free', 'libfwevt_xml_tag_free', 'libcerror_error_set']	0	175	libfwevt_xml_document_read_attribute	call site: 00724	/src/libfwevt/libfwevt/libfwevt_xml_document.c:940
0	175	3 : View List ['libfwevt_xml_token_free', 'libfwevt_xml_tag_free', 'libcerror_error_set']	0	175	libfwevt_xml_document_read_element	call site: 00214	/src/libfwevt/libfwevt/libfwevt_xml_document.c:2514
0	175	3 : View List ['libfwevt_xml_tag_free', 'libfwevt_xml_token_free', 'libcerror_error_set']	0	175	libfwevt_xml_document_read_pi_target	call site: 00426	/src/libfwevt/libfwevt/libfwevt_xml_document.c:4580
0	139	3 : View List ['free', 'libfwevt_xml_tag_free', 'libcerror_error_set']	0	139	libfwevt_xml_document_read_entity_reference	call site: 00565	/src/libfwevt/libfwevt/libfwevt_xml_document.c:3013
0	119	2 : View List ['libfvalue_value_free', 'libcerror_error_set']	0	119	libfwevt_xml_tag_set_name_data	call site: 00172	/src/libfwevt/libfwevt/libfwevt_xml_tag.c:359
0	114	3 : View List ['libfwevt_xml_token_free', 'libcdata_array_free', 'libcerror_error_set']	0	114	libfwevt_xml_document_read_template_instance	call site: 00660	/src/libfwevt/libfwevt/libfwevt_xml_document.c:5138
0	103	2 : View List ['libcdata_array_get_entry_by_index', 'libcerror_error_set']	0	103	libfvalue_data_handle_get_value_entry	call site: 00532	/src/libscca/libfvalue/libfvalue_data_handle.c:748
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfvalue_value_initialize	call site: 00112	/src/libscca/libfvalue/libfvalue_value.c:236
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfwevt_xml_tag_initialize	call site: 00078	/src/libfwevt/libfwevt/libfwevt_xml_tag.c:120

Runtime coverage analysis

Covered functions

95

Functions that are reachable but not covered

327

Reachable functions

422

Percentage of reachable functions covered

22.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwevt/ossfuzz/xml_document_fuzzer.cc	1
libfwevt/libfwevt/libfwevt_xml_document.c	20
libfwevt/libcerror/libcerror_error.c	3
libfwevt/libfwevt/libfwevt_xml_token.c	3
libfwevt/libfwevt/libfwevt_xml_tag.c	14
libfwevt/libcdata/libcdata_array.c	10
libfwevt/libfvalue/libfvalue_value_type.c	5
libfwevt/libfvalue/libfvalue_value.c	12
libfwevt/libfvalue/libfvalue_data_handle.c	9
libfwevt/libfvalue/libfvalue_binary_data.c	1
libfwevt/libfvalue/libfvalue_floating_point.c	1
libfwevt/libfvalue/libfvalue_integer.c	3
libfwevt/libfvalue/libfvalue_string.c	1
libfwevt/libfdatetime/libfdatetime_fat_date_time.c	1
libfwevt/libfdatetime/libfdatetime_filetime.c	2
libfwevt/libfvalue/libfvalue_filetime.c	1
libfwevt/libfdatetime/libfdatetime_floatingtime.c	1
libfwevt/libfdatetime/libfdatetime_nsf_timedate.c	1
libfwevt/libfdatetime/libfdatetime_posix_time.c	2
libfwevt/libfdatetime/libfdatetime_systemtime.c	1
libfwevt/libfguid/libfguid_identifier.c	1
libfwevt/libfvalue/libfvalue_value_entry.c	2
libfwevt/libfwevt/libfwevt_xml_template_value.c	9

Fuzzer: libcaes_crypt_ccm_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	83.0%
gold	[1:9]	2	3.07%
yellow	[10:29]	1	1.53%
greenyellow	[30:49]	2	3.07%
lawngreen	50+	6	9.23%
All colors	65	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
85	85	1 : View List ['libcaes_internal_context_set_decryption_key']	85	117	libcaes_context_set_key	call site: 00019	/src/libcaes/libcaes/libcaes_context.c:585
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcaes_context_initialize	call site: 00013	/src/libcaes/libcaes/libcaes_context.c:360
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_context_free	call site: 00033	/src/libcaes/libcaes/libcaes_context.c:406
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_context_set_key	call site: 00020	/src/libcaes/libcaes/libcaes_context.c:587
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_initialize_tables	call site: 00013	/src/libcaes/libcaes/libcaes_context.c:644
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_internal_context_set_encryption_key	call site: 00022	/src/libcaes/libcaes/libcaes_context.c:1064
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_crypt_ccm	call site: 00062	/src/libcaes/libcaes/libcaes_context.c:2249
0	0	None	0	64	libcaes_crypt_ecb	call site: 00056	/src/libcaes/libcaes/libcaes_context.c:3019
0	0	None	0	64	libcaes_crypt_ecb	call site: 00056	/src/libcaes/libcaes/libcaes_context.c:3107
0	0	None	0	64	libcaes_crypt_ecb	call site: 00057	/src/libcaes/libcaes/libcaes_context.c:3121
0	0	None	0	32	libcaes_context_initialize	call site: 00001	/src/libcaes/libcaes/libcaes_context.c:275

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

6

Reachable functions

15

Percentage of reachable functions covered

60.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libcaes/ossfuzz/crypt_ccm_fuzzer.cc	1
libcaes/libcaes/libcaes_context.c	8
libcaes/libcerror/libcerror_error.c	3

Fuzzer: libcreg_key_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	582	62.7%
gold	[1:9]	10	1.07%
yellow	[10:29]	4	0.43%
greenyellow	[30:49]	8	0.86%
lawngreen	50+	323	34.8%
All colors	927	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00614	/src/libqcow/libfcache/libfcache_cache.c:801
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00725	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	264	1 : View List ['libcdata_range_list_insert_range']	0	360	libbfio_internal_handle_read_buffer	call site: 00147	/src/libqcow/libbfio/libbfio_handle.c:1139
0	255	1 : View List ['libcreg_file_close']	0	454	libcreg_file_free	call site: 00920	/src/libcreg/libcreg/libcreg_file.c:176
0	215	6 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcdata_list_element_set_elements', 'libcdata_range_list_value_free', 'libcerror_error_set']	0	215	libcdata_internal_range_list_insert_range_before_element	call site: 00207	/src/libqcow/libcdata/libcdata_range_list.c:1813
0	190	3 : View List ['libfdata_area_free', 'libfcache_cache_free', 'libcerror_error_set']	0	190	libcreg_key_navigation_read_file_io_handle	call site: 00472	/src/libcreg/libcreg/libcreg_key_navigation.c:446
0	165	3 : View List ['libfdata_list_free', 'libcreg_data_block_free', 'libcerror_error_set']	0	165	libcreg_key_navigation_read_data_blocks	call site: 00688	/src/libcreg/libcreg/libcreg_key_navigation.c:680
0	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	0	147	libfdata_list_append_element	call site: 00678	/src/libevt/libfdata/libfdata_list.c:1489
0	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	0	142	libfdata_segments_array_append_segment	call site: 00463	/src/libqcow/libfdata/libfdata_segments_array.c:592
0	140	3 : View List ['free', 'libcreg_key_item_free', 'libcerror_error_set']	0	140	libcreg_key_initialize	call site: 00867	/src/libcreg/libcreg/libcreg_key.c:143
0	137	4 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element', 'libcdata_list_element_set_elements']	0	137	libcdata_list_remove_element	call site: 00819	/src/libqcow/libcdata/libcdata_list.c:2812

Runtime coverage analysis

Covered functions

162

Functions that are reachable but not covered

19

Reachable functions

181

Percentage of reachable functions covered

89.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libcreg/ossfuzz/key_fuzzer.cc	1
libcreg/libbfio/libbfio_memory_range.c	2
libcreg/libcerror/libcerror_error.c	3
libcreg/libbfio/libbfio_memory_range_io_handle.c	3
libcreg/libbfio/libbfio_handle.c	10
libcreg/libcdata/libcdata_range_list.c	16
libcreg/libcdata/libcdata_list_element.c	10
libcreg/libcdata/libcdata_range_list_value.c	3
libcreg/libcreg/libcreg_file.c	6
libcreg/libcreg/libcreg_io_handle.c	5
libcreg/libcthreads/libcthreads_read_write_lock.c	4
libcreg/libcerror/libcerror_system.c	2
libcreg/libcreg/libcreg_key_navigation.c	8
libcreg/libfdata/libfdata_area.c	5
libcreg/libcdata/libcdata_array.c	9
libcreg/libfcache/libfcache_date_time.c	1
libcreg/libcreg/libcreg_key_hierarchy_entry.c	3
libcreg/libfdata/libfdata_segments_array.c	2
libcreg/libfdata/libfdata_range.c	5
libcreg/libfcache/libfcache_cache.c	7
libcreg/libfcache/libfcache_cache_value.c	8
libcreg/libcdata/libcdata_list.c	9
libcreg/libfdata/libfdata_mapped_range.c	3
libcreg/libfdata/libfdata_list.c	7
libcreg/libcreg/libcreg_data_block.c	5
libcreg/libcreg/libcreg_key_name_entry.c	4
libcreg/libcreg/libcreg_value_entry.c	3
libcreg/libfdata/libfdata_list_element.c	7
libcreg/libcreg/libcreg_key.c	4
libcreg/libcreg/libcreg_key_item.c	5
libcreg/libcreg/libcreg_key_descriptor.c	2

Fuzzer: libfshfs_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	764	65.7%
gold	[1:9]	40	3.44%
yellow	[10:29]	17	1.46%
greenyellow	[30:49]	25	2.15%
lawngreen	50+	316	27.1%
All colors	1162	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
601	601	1 : View List ['libuna_utf8_string_copy_from_byte_stream']	601	633	libfshfs_master_directory_block_get_utf8_volume_label	call site: 01123	/src/libfshfs/libfshfs/libfshfs_master_directory_block.c:784
589	589	1 : View List ['libuna_utf8_string_size_from_byte_stream']	589	621	libfshfs_master_directory_block_get_utf8_volume_label_size	call site: 01087	/src/libfshfs/libfshfs/libfshfs_master_directory_block.c:742
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00143	/src/libqcow/libbfio/libbfio_handle.c:1139
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00589	/src/libqcow/libfcache/libfcache_cache.c:801
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 01095	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01057	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	309	1 : View List ['libfshfs_volume_close']	0	508	libfshfs_volume_free	call site: 01157	/src/libfshfs/libfshfs/libfshfs_volume.c:171
0	198	3 : View List ['libcerror_error_set', 'libfshfs_btree_file_free', 'libfshfs_btree_node_cache_free']	0	198	libfshfs_file_system_read_catalog_file	call site: 00712	/src/libfshfs/libfshfs/libfshfs_file_system.c:591
0	176	3 : View List ['free', 'libfshfs_fork_descriptor_free', 'libcerror_error_set']	0	176	libfshfs_volume_header_initialize	call site: 00332	/src/libfshfs/libfshfs/libfshfs_volume_header.c:154
0	172	4 : View List ['libfshfs_directory_record_free', 'libfshfs_directory_entry_free', 'libcerror_error_set', 'libfshfs_file_record_free']	0	172	libfshfs_catalog_btree_file_get_directory_entry_from_key	call site: 00996	/src/libfshfs/libfshfs/libfshfs_catalog_btree_file.c:1088

Runtime coverage analysis

Covered functions

171

Functions that are reachable but not covered

75

Reachable functions

246

Percentage of reachable functions covered

69.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfshfs/ossfuzz/volume_fuzzer.cc	1
libfshfs/libbfio/libbfio_memory_range.c	2
libfshfs/libcerror/libcerror_error.c	3
libfshfs/libbfio/libbfio_memory_range_io_handle.c	3
libfshfs/libbfio/libbfio_handle.c	8
libfshfs/libcdata/libcdata_range_list.c	15
libfshfs/libcdata/libcdata_list_element.c	10
libfshfs/libcdata/libcdata_range_list_value.c	3
libfshfs/libfshfs/libfshfs_volume.c	7
libfshfs/libfshfs/libfshfs_io_handle.c	3
libfshfs/libcthreads/libcthreads_read_write_lock.c	6
libfshfs/libcerror/libcerror_system.c	2
libfshfs/libfshfs/libfshfs_master_directory_block.c	6
libfshfs/libfshfs/libfshfs_fork_descriptor.c	5
libfshfs/libfshfs/libfshfs_extents_record.c	1
libfshfs/libfshfs/libfshfs_volume_header.c	4
libfshfs/libfshfs/libfshfs_file_system.c	6
libfshfs/libfshfs/libfshfs_btree_file.c	5
libfshfs/libcdata/libcdata_array.c	9
libfshfs/libfshfs/libfshfs_btree_header.c	3
libfshfs/libfshfs/libfshfs_extent.c	2
libfshfs/libfshfs/libfshfs_btree_node_descriptor.c	3
libfshfs/libfshfs/libfshfs_btree_node_vector.c	3
libfshfs/libfcache/libfcache_date_time.c	1
libfshfs/libfshfs/libfshfs_btree_node_cache.c	2
libfshfs/libfcache/libfcache_cache.c	4
libfshfs/libcdata/libcdata_list.c	9
libfshfs/libfshfs/libfshfs_extents_btree_file.c	6
libfshfs/libfcache/libfcache_cache_value.c	8
libfshfs/libfshfs/libfshfs_btree_node.c	8
libfshfs/libfshfs/libfshfs_btree_node_record.c	2
libfshfs/libfshfs/libfshfs_extents_btree_key.c	3
libfshfs/libfshfs/libfshfs_catalog_btree_file.c	10
libfshfs/libfshfs/libfshfs_catalog_btree_key.c	4
libfshfs/libfshfs/libfshfs_thread_record.c	3
libfshfs/libfshfs/libfshfs_name.c	3
libfshfs/libuna/libuna_unicode_character.c	4
libfshfs/libuna/libuna_codepage_koi8_r.c	1
libfshfs/libuna/libuna_codepage_koi8_u.c	1
libfshfs/libuna/libuna_codepage_mac_arabic.c	1
libfshfs/libuna/libuna_codepage_mac_celtic.c	1
libfshfs/libuna/libuna_codepage_mac_centraleurroman.c	1
libfshfs/libuna/libuna_codepage_mac_croatian.c	1
libfshfs/libuna/libuna_codepage_mac_cyrillic.c	1
libfshfs/libuna/libuna_codepage_mac_dingbats.c	1
libfshfs/libuna/libuna_codepage_mac_farsi.c	1
libfshfs/libuna/libuna_codepage_mac_gaelic.c	1
libfshfs/libuna/libuna_codepage_mac_greek.c	1
libfshfs/libuna/libuna_codepage_mac_icelandic.c	1
libfshfs/libuna/libuna_codepage_mac_inuit.c	1
libfshfs/libuna/libuna_codepage_mac_roman.c	1
libfshfs/libuna/libuna_codepage_mac_romanian.c	1
libfshfs/libuna/libuna_codepage_mac_russian.c	1
libfshfs/libuna/libuna_codepage_mac_symbol.c	1
libfshfs/libuna/libuna_codepage_mac_thai.c	1
libfshfs/libuna/libuna_codepage_mac_turkish.c	1
libfshfs/libuna/libuna_codepage_mac_ukrainian.c	1
libfshfs/libuna/libuna_codepage_windows_874.c	1
libfshfs/libuna/libuna_codepage_windows_932.c	1
libfshfs/libuna/libuna_codepage_windows_936.c	1
libfshfs/libuna/libuna_codepage_windows_949.c	1
libfshfs/libuna/libuna_codepage_windows_950.c	1
libfshfs/libuna/libuna_codepage_windows_1250.c	1
libfshfs/libuna/libuna_codepage_windows_1251.c	1
libfshfs/libuna/libuna_codepage_windows_1252.c	1
libfshfs/libuna/libuna_codepage_windows_1253.c	1
libfshfs/libuna/libuna_codepage_windows_1254.c	1
libfshfs/libuna/libuna_codepage_windows_1255.c	1
libfshfs/libuna/libuna_codepage_windows_1256.c	1
libfshfs/libuna/libuna_codepage_windows_1257.c	1
libfshfs/libuna/libuna_codepage_windows_1258.c	1
libfshfs/libfshfs/libfshfs_directory_record.c	3
libfshfs/libfshfs/libfshfs_file_record.c	3
libfshfs/libfshfs/libfshfs_directory_entry.c	6
libfshfs/libuna/libuna_utf8_string.c	3

Fuzzer: libfmapi_one_off_entry_identifier_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	26	66.6%
gold	[1:9]	1	2.56%
yellow	[10:29]	3	7.69%
greenyellow	[30:49]	1	2.56%
lawngreen	50+	8	20.5%
All colors	39	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfmapi_one_off_entry_identifier_initialize	call site: 00011	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:80
0	32	1 : View List ['libcerror_error_set']	0	32	libfmapi_one_off_entry_identifier_free	call site: 00037	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:117
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfmapi_one_off_entry_identifier_copy_from_byte_stream	call site: 00035	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:621
0	0	None	0	32	libfmapi_one_off_entry_identifier_initialize	call site: 00001	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:44
0	0	None	0	32	libfmapi_one_off_entry_identifier_initialize	call site: 00002	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:55
0	0	None	0	32	libfmapi_one_off_entry_identifier_initialize	call site: 00010	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:69
0	0	None	0	32	libfmapi_one_off_entry_identifier_copy_from_byte_stream	call site: 00013	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:172
0	0	None	0	32	libfmapi_one_off_entry_identifier_copy_from_byte_stream	call site: 00014	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:185
0	0	None	0	32	libfmapi_one_off_entry_identifier_copy_from_byte_stream	call site: 00015	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:196
0	0	None	0	32	libfmapi_one_off_entry_identifier_copy_from_byte_stream	call site: 00016	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:207
0	0	None	0	32	libfmapi_one_off_entry_identifier_copy_from_byte_stream	call site: 00017	/src/libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c:218

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

5

Reachable functions

10

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfmapi/ossfuzz/one_off_entry_identifier_fuzzer.cc	1
libfmapi/libfmapi/libfmapi_one_off_entry_identifier.c	3
libfmapi/libcerror/libcerror_error.c	3

Fuzzer: libsmraw_handle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	672	87.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	86	11.2%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	5	0.65%
All colors	764	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
445	445	3 : View List ['libsmraw_information_file_open', 'libsmraw_information_file_close', 'libsmraw_information_file_write_section']	899	1135	libsmraw_handle_close	call site: 00601	/src/libsmraw/libsmraw/libsmraw_handle.c:1914
304	560	6 : View List ['libcdata_array_get_entry_by_index', 'libbfio_internal_pool_open_handle', 'libbfio_handle_get_access_flags', 'libbfio_handle_is_open', 'libcerror_error_set', 'libbfio_internal_pool_move_handle_to_front_of_last_used_list']	304	560	libbfio_internal_pool_get_open_handle	call site: 00517	/src/libodraw/libbfio/libbfio_pool.c:2744
292	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	292	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
274	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	274	274	libcdata_list_empty	call site: 00087	/src/libqcow/libcdata/libcdata_list.c:238
170	170	2 : View List ['libbfio_internal_pool_append_handle_to_last_used_list', 'libcerror_error_set']	170	208	libbfio_pool_append_handle	call site: 00147	/src/libodraw/libbfio/libbfio_pool.c:1393
138	138	1 : View List ['libbfio_internal_pool_append_handle_to_last_used_list']	234	322	libbfio_internal_pool_open_handle	call site: 00465	/src/libodraw/libbfio/libbfio_pool.c:610
129	264	2 : View List ['libbfio_pool_close_all', 'libbfio_pool_free']	326	562	libsmraw_handle_close	call site: 00712	/src/libsmraw/libsmraw/libsmraw_handle.c:1977
69	69	2 : View List ['libcerror_error_set', 'libsmraw_information_file_free']	69	69	libsmraw_handle_close	call site: 00744	/src/libsmraw/libsmraw/libsmraw_handle.c:2037
64	64	1 : View List ['libcerror_error_set']	64	64	libcdata_internal_array_resize	call site: 00139	/src/libfplist/libcdata/libcdata_array.c:823
64	64	1 : View List ['libcerror_error_set']	64	64	libfdata_stream_free	call site: 00596	/src/libfsfat/libfdata/libfdata_stream.c:278
32	345	4 : View List ['free', 'libsmraw_io_handle_free', 'libfvalue_table_free', 'libcerror_error_set']	32	345	libsmraw_handle_initialize	call site: 00231	/src/libsmraw/libsmraw/libsmraw_handle.c:162
32	144	4 : View List ['free', 'libcdata_array_free', 'libcerror_error_set', 'libcdata_list_free']	32	144	libbfio_pool_initialize	call site: 00082	/src/libodraw/libbfio/libbfio_pool.c:139

Runtime coverage analysis

Covered functions

69

Functions that are reachable but not covered

138

Reachable functions

207

Percentage of reachable functions covered

33.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsmraw/ossfuzz/handle_fuzzer.cc	1
libsmraw/libbfio/libbfio_memory_range.c	2
libsmraw/libcerror/libcerror_error.c	3
libsmraw/libbfio/libbfio_memory_range_io_handle.c	3
libsmraw/libbfio/libbfio_handle.c	10
libsmraw/libcdata/libcdata_range_list.c	4
libsmraw/libcdata/libcdata_list_element.c	9
libsmraw/libcdata/libcdata_range_list_value.c	1
libsmraw/libbfio/libbfio_pool.c	14
libsmraw/libcdata/libcdata_array.c	10
libsmraw/libcdata/libcdata_list.c	7
libsmraw/libsmraw/libsmraw_handle.c	4
libsmraw/libsmraw/libsmraw_io_handle.c	4
libsmraw/libfvalue/libfvalue_table.c	4
libsmraw/libcthreads/libcthreads_read_write_lock.c	2
libsmraw/libcerror/libcerror_system.c	2
libsmraw/libfvalue/libfvalue_value.c	7
libsmraw/libfvalue/libfvalue_data_handle.c	6
libsmraw/libfvalue/libfvalue_value_entry.c	1
libsmraw/libfdata/libfdata_stream.c	5
libsmraw/libsmraw/libsmraw_filename.c	1
libsmraw/libbfio/libbfio_file.c	2
libsmraw/libbfio/libbfio_file_io_handle.c	3
libsmraw/libcfile/libcfile_file.c	4
libsmraw/libcpath/libcpath_path.c	2
libsmraw/libcsplit/libcsplit_narrow_string.c	1
libsmraw/libcsplit/libcsplit_narrow_split_string.c	6
libsmraw/libbfio/libbfio_system_string.c	2
libsmraw/libfdata/libfdata_range.c	4
libsmraw/libfdata/libfdata_mapped_range.c	3
libsmraw/libfdata/libfdata_segments_array.c	2
libsmraw/libsmraw/libsmraw_information_file.c	4

Fuzzer: libvsmbr_partition_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	518	80.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.46%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	19.0%
All colors	644	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00160	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00593	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00415	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00392	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00559	/src/libqcow/libfdata/libfdata_segments_array.c:592
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	181	1 : View List ['libvsmbr_volume_close']	0	458	libvsmbr_volume_free	call site: 00633	/src/libvsmbr/libvsmbr/libvsmbr_volume.c:193
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00443	/src/libqcow/libfdata/libfdata_vector.c:180
0	123	3 : View List ['libvsmbr_boot_record_free', 'libvsmbr_partition_values_free', 'libcerror_error_set']	0	123	libvsmbr_internal_volume_read_partition_entries	call site: 00366	/src/libvsmbr/libvsmbr/libvsmbr_volume.c:1325
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	375	libvsmbr_volume_close	call site: 00617	/src/libvsmbr/libvsmbr/libvsmbr_volume.c:895

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

61

Reachable functions

142

Percentage of reachable functions covered

57.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvsmbr/ossfuzz/partition_fuzzer.cc	1
libvsmbr/libbfio/libbfio_memory_range.c	2
libvsmbr/libcerror/libcerror_error.c	4
libvsmbr/libbfio/libbfio_memory_range_io_handle.c	3
libvsmbr/libbfio/libbfio_handle.c	9
libvsmbr/libcdata/libcdata_range_list.c	15
libvsmbr/libcdata/libcdata_list_element.c	10
libvsmbr/libcdata/libcdata_range_list_value.c	3
libvsmbr/libvsmbr/libvsmbr_volume.c	8
libvsmbr/libvsmbr/libvsmbr_io_handle.c	3
libvsmbr/libcdata/libcdata_array.c	9
libvsmbr/libcthreads/libcthreads_read_write_lock.c	6
libvsmbr/libcerror/libcerror_system.c	2
libvsmbr/libvsmbr/libvsmbr_boot_record.c	5
libvsmbr/libvsmbr/libvsmbr_partition_entry.c	3
libvsmbr/libvsmbr/libvsmbr_partition_values.c	4
libvsmbr/libvsmbr/libvsmbr_partition.c	2
libvsmbr/libfdata/libfdata_vector.c	4
libvsmbr/libfcache/libfcache_date_time.c	1
libvsmbr/libvsmbr/libvsmbr_sector_data.c	4
libvsmbr/libfdata/libfdata_segments_array.c	2
libvsmbr/libfdata/libfdata_range.c	4
libvsmbr/libfcache/libfcache_cache.c	3
libvsmbr/libcdata/libcdata_list.c	7
libvsmbr/libfcache/libfcache_cache_value.c	6
libvsmbr/libfdata/libfdata_mapped_range.c	3

Fuzzer: libfwnt_lzx_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	57.7%
gold	[1:9]	13	7.22%
yellow	[10:29]	4	2.22%
greenyellow	[30:49]	3	1.66%
lawngreen	50+	56	31.1%
All colors	180	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	70	2 : View List ['libcerror_error_set', 'libfwnt_huffman_tree_free']	0	70	libfwnt_lzx_read_huffman_code_sizes	call site: 00111	/src/libfsntfs/libfwnt/libfwnt_lzx.c:333
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_bit_stream_initialize	call site: 00019	/src/libfsntfs/libfwnt/libfwnt_bit_stream.c:99
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_bit_stream_free	call site: 00169	/src/libfsntfs/libfwnt/libfwnt_bit_stream.c:138
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_bit_stream_read	call site: 00027	/src/libfsntfs/libfwnt/libfwnt_bit_stream.c:180
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_bit_stream_get_value	call site: 00026	/src/libfsntfs/libfwnt/libfwnt_bit_stream.c:270
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_huffman_tree_initialize	call site: 00054	/src/libfsntfs/libfwnt/libfwnt_huffman_tree.c:168
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_huffman_tree_free	call site: 00111	/src/libfsntfs/libfwnt/libfwnt_huffman_tree.c:216
0	0	None	0	1902	libfwnt_lzx_decompress	call site: 00034	/src/libfsntfs/libfwnt/libfwnt_lzx.c:1022
0	0	None	0	1902	libfwnt_lzx_decompress	call site: 00161	/src/libfsntfs/libfwnt/libfwnt_lzx.c:1337
0	0	None	0	852	libfwnt_lzx_read_huffman_code_sizes	call site: 00080	/src/libfsntfs/libfwnt/libfwnt_lzx.c:106
0	0	None	0	770	libfwnt_lzx_read_huffman_code_sizes	call site: 00081	/src/libfsntfs/libfwnt/libfwnt_lzx.c:116

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

7

Reachable functions

24

Percentage of reachable functions covered

70.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwnt/ossfuzz/lzx_fuzzer.cc	1
libfwnt/libfwnt/libfwnt_lzx.c	7
libfwnt/libcerror/libcerror_error.c	3
libfwnt/libfwnt/libfwnt_bit_stream.c	4
libfwnt/libcnotify/libcnotify_print.c	1
libfwnt/libfwnt/libfwnt_huffman_tree.c	4

Fuzzer: libnk2_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	331	78.4%
gold	[1:9]	8	1.89%
yellow	[10:29]	6	1.42%
greenyellow	[30:49]	5	1.18%
lawngreen	50+	72	17.0%
All colors	422	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00144	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	152	1 : View List ['libnk2_file_close']	0	330	libnk2_file_free	call site: 00414	/src/libnk2/libnk2/libnk2_file.c:178
0	148	4 : View List ['libnk2_file_header_free', 'libnk2_file_footer_free', 'libcdata_array_empty', 'libcerror_error_set']	0	148	libnk2_file_open_read	call site: 00383	/src/libnk2/libnk2/libnk2_file.c:957
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	275	libnk2_file_close	call site: 00399	/src/libnk2/libnk2/libnk2_file.c:765
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libnk2_file_initialize	call site: 00083	/src/libnk2/libnk2/libnk2_file.c:119
0	68	2 : View List ['libcerror_error_set', 'libbfio_memory_range_io_handle_free']	0	68	libbfio_memory_range_initialize	call site: 00059	/src/libqcow/libbfio/libbfio_memory_range.c:83
0	64	1 : View List ['libcerror_error_set']	0	64	libbfio_internal_handle_read_buffer	call site: 00287	/src/libqcow/libbfio/libbfio_handle.c:1164
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00357	/src/libfplist/libcdata/libcdata_array.c:823
0	32	1 : View List ['libcerror_error_set']	0	32	libbfio_handle_free	call site: 00405	/src/libqcow/libbfio/libbfio_handle.c:307

Runtime coverage analysis

Covered functions

55

Functions that are reachable but not covered

35

Reachable functions

90

Percentage of reachable functions covered

61.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libnk2/ossfuzz/file_fuzzer.cc	1
libnk2/libbfio/libbfio_memory_range.c	2
libnk2/libcerror/libcerror_error.c	3
libnk2/libbfio/libbfio_memory_range_io_handle.c	3
libnk2/libbfio/libbfio_handle.c	9
libnk2/libcdata/libcdata_range_list.c	15
libnk2/libcdata/libcdata_list_element.c	10
libnk2/libcdata/libcdata_range_list_value.c	3
libnk2/libnk2/libnk2_file.c	6
libnk2/libcdata/libcdata_array.c	6
libnk2/libnk2/libnk2_io_handle.c	3
libnk2/libnk2/libnk2_file_header.c	4
libnk2/libnk2/libnk2_item.c	3
libnk2/libnk2/libnk2_record_entry.c	4
libnk2/libnk2/libnk2_mapi_value.c	1
libnk2/libnk2/libnk2_file_footer.c	4

Fuzzer: libcaes_crypt_cbc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	84.6%
gold	[1:9]	2	3.07%
yellow	[10:29]	1	1.53%
greenyellow	[30:49]	1	1.53%
lawngreen	50+	6	9.23%
All colors	65	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
85	85	1 : View List ['libcaes_internal_context_set_decryption_key']	85	117	libcaes_context_set_key	call site: 00019	/src/libcaes/libcaes/libcaes_context.c:585
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcaes_context_initialize	call site: 00013	/src/libcaes/libcaes/libcaes_context.c:360
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_context_free	call site: 00033	/src/libcaes/libcaes/libcaes_context.c:406
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_context_set_key	call site: 00020	/src/libcaes/libcaes/libcaes_context.c:587
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_initialize_tables	call site: 00013	/src/libcaes/libcaes/libcaes_context.c:644
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_internal_context_set_encryption_key	call site: 00022	/src/libcaes/libcaes/libcaes_context.c:1064
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_crypt_cbc	call site: 00062	/src/libcaes/libcaes/libcaes_context.c:1969
0	0	None	0	260	libcaes_crypt_cbc	call site: 00048	/src/libcaes/libcaes/libcaes_context.c:1843
0	0	None	0	64	libcaes_crypt_ecb	call site: 00055	/src/libcaes/libcaes/libcaes_context.c:3019
0	0	None	0	64	libcaes_crypt_ecb	call site: 00055	/src/libcaes/libcaes/libcaes_context.c:3107
0	0	None	0	64	libcaes_crypt_ecb	call site: 00056	/src/libcaes/libcaes/libcaes_context.c:3121

Runtime coverage analysis

Covered functions

9

Functions that are reachable but not covered

6

Reachable functions

15

Percentage of reachable functions covered

60.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libcaes/ossfuzz/crypt_cbc_fuzzer.cc	1
libcaes/libcaes/libcaes_context.c	8
libcaes/libcerror/libcerror_error.c	3

Fuzzer: libwrc_manifest_resource_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	18	81.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	13.6%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	4.54%
All colors	22	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
32	32	2 : View List ['free', 'libcerror_error_set']	32	32	libwrc_manifest_resource_initialize	call site: 00011	/src/libwrc/libwrc/libwrc_manifest_resource.c:79
32	32	1 : View List ['libcerror_error_set']	32	32	libwrc_manifest_resource_free	call site: 00020	/src/libwrc/libwrc/libwrc_manifest_resource.c:116
32	32	2 : View List ['free', 'libcerror_error_set']	32	32	libwrc_manifest_resource_read	call site: 00018	/src/libwrc/libwrc/libwrc_manifest_resource.c:230
0	0	None	32	32	libwrc_manifest_resource_initialize	call site: 00001	/src/libwrc/libwrc/libwrc_manifest_resource.c:43
0	0	None	32	32	libwrc_manifest_resource_initialize	call site: 00002	/src/libwrc/libwrc/libwrc_manifest_resource.c:54
0	0	None	32	32	libwrc_manifest_resource_initialize	call site: 00010	/src/libwrc/libwrc/libwrc_manifest_resource.c:68
0	0	None	32	32	libwrc_manifest_resource_read	call site: 00013	/src/libwrc/libwrc/libwrc_manifest_resource.c:155
0	0	None	32	32	libwrc_manifest_resource_read	call site: 00014	/src/libwrc/libwrc/libwrc_manifest_resource.c:168
0	0	None	32	32	libwrc_manifest_resource_read	call site: 00015	/src/libwrc/libwrc/libwrc_manifest_resource.c:179
0	0	None	32	32	libwrc_manifest_resource_read	call site: 00016	/src/libwrc/libwrc/libwrc_manifest_resource.c:190
0	0	None	32	32	libwrc_manifest_resource_read	call site: 00017	/src/libwrc/libwrc/libwrc_manifest_resource.c:217

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

6

Reachable functions

10

Percentage of reachable functions covered

40.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libwrc/ossfuzz/manifest_resource_fuzzer.cc	1
libwrc/libwrc/libwrc_manifest_resource.c	3
libwrc/libcerror/libcerror_error.c	3

Fuzzer: libvsgpt_partition_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	541	76.0%
gold	[1:9]	3	0.42%
yellow	[10:29]	3	0.42%
greenyellow	[30:49]	38	5.34%
lawngreen	50+	126	17.7%
All colors	711	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00166	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00662	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00491	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00469	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00632	/src/libqcow/libfdata/libfdata_segments_array.c:592
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	186	1 : View List ['libvsgpt_volume_close']	0	463	libvsgpt_volume_free	call site: 00701	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:196
0	154	1 : View List ['libvsgpt_partition_free']	0	154	libvsgpt_volume_get_partition_by_index	call site: 00647	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:2439
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00514	/src/libqcow/libfdata/libfdata_vector.c:180
0	123	3 : View List ['libvsgpt_partition_table_header_free', 'libcerror_error_set', 'libvsgpt_boot_record_free']	0	123	libvsgpt_internal_volume_open_read	call site: 00456	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:1117
0	123	3 : View List ['libcerror_error_set', 'libvsgpt_boot_record_free', 'libvsgpt_partition_values_free']	0	123	libvsgpt_internal_volume_read_mbr_partition_entries	call site: 00444	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:2054

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

62

Reachable functions

153

Percentage of reachable functions covered

59.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvsgpt/ossfuzz/partition_fuzzer.cc	1
libvsgpt/libbfio/libbfio_memory_range.c	2
libvsgpt/libcerror/libcerror_error.c	4
libvsgpt/libbfio/libbfio_memory_range_io_handle.c	3
libvsgpt/libbfio/libbfio_handle.c	9
libvsgpt/libcdata/libcdata_range_list.c	15
libvsgpt/libcdata/libcdata_list_element.c	10
libvsgpt/libcdata/libcdata_range_list_value.c	3
libvsgpt/libvsgpt/libvsgpt_volume.c	10
libvsgpt/libvsgpt/libvsgpt_io_handle.c	3
libvsgpt/libcdata/libcdata_array.c	9
libvsgpt/libcthreads/libcthreads_read_write_lock.c	6
libvsgpt/libcerror/libcerror_system.c	2
libvsgpt/libvsgpt/libvsgpt_partition_table_header.c	4
libvsgpt/libvsgpt/libvsgpt_checksum.c	2
libvsgpt/libvsgpt/libvsgpt_partition_entry.c	3
libvsgpt/libvsgpt/libvsgpt_partition_values.c	3
libvsgpt/libvsgpt/libvsgpt_boot_record.c	5
libvsgpt/libvsgpt/libvsgpt_mbr_partition_entry.c	3
libvsgpt/libvsgpt/libvsgpt_partition.c	2
libvsgpt/libfdata/libfdata_vector.c	4
libvsgpt/libfcache/libfcache_date_time.c	1
libvsgpt/libvsgpt/libvsgpt_sector_data.c	4
libvsgpt/libfdata/libfdata_segments_array.c	2
libvsgpt/libfdata/libfdata_range.c	4
libvsgpt/libfcache/libfcache_cache.c	3
libvsgpt/libcdata/libcdata_list.c	7
libvsgpt/libfcache/libfcache_cache_value.c	6
libvsgpt/libfdata/libfdata_mapped_range.c	3

Fuzzer: libewf_handle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3700	83.6%
gold	[1:9]	46	1.03%
yellow	[10:29]	44	0.99%
greenyellow	[30:49]	27	0.61%
lawngreen	50+	608	13.7%
All colors	4425	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6564	7099	5 : View List ['libfdata_list_get_element_value_by_index', 'libfcache_cache_initialize', 'libewf_segment_file_seek_offset', 'libewf_segment_table_get_segment_by_index', 'libewf_device_information_section_read_file_io_pool']	6564	7479	libewf_internal_handle_open_read_device_information	call site: 01234	/src/libewf/libewf/libewf_handle.c:3226
4687	4687	1 : View List ['libewf_internal_handle_write_finalize_file_io_pool']	5152	6746	libewf_handle_close	call site: 03109	/src/libewf/libewf/libewf_handle.c:4020
1773	1773	2 : View List ['libewf_single_files_read_data_stream', 'libewf_single_files_initialize']	2058	2484	libewf_internal_handle_open_read_segment_file_section_data	call site: 02216	/src/libewf/libewf/libewf_handle.c:2669
1115	1211	3 : View List ['libewf_chunk_data_unpack', 'libcerror_error_set', 'libewf_chunk_table_get_chunk_data_by_offset']	1115	1211	libewf_internal_handle_get_media_values	call site: 02900	/src/libewf/libewf/libewf_handle.c:8221
996	1486	10 : View List ['libewf_write_io_handle_free', 'libewf_read_io_handle_free', 'libewf_chunk_table_free', 'libfvalue_table_free', 'libewf_segment_file_free', 'libewf_write_io_handle_initialize_values', 'libewf_single_files_free', 'libewf_write_io_handle_initialize_resume', 'libewf_hash_sections_free', 'libcerror_error_set']	996	1486	libewf_internal_handle_open_file_io_pool	call site: 02982	/src/libewf/libewf/libewf_handle.c:3774
699	1662	5 : View List ['libewf_internal_handle_get_media_values', 'libcerror_error_free', 'libewf_write_io_handle_initialize_values', 'libewf_write_io_handle_initialize_resume', 'libcerror_error_set']	996	2385	libewf_internal_handle_open_file_io_pool	call site: 02894	/src/libewf/libewf/libewf_handle.c:3726
605	605	1 : View List ['libewf_data_stream_initialize_from_section']	669	701	libewf_ltree_section_read_file_io_pool	call site: 01766	/src/libewf/libewf/libewf_ltree_section.c:317
550	550	1 : View List ['libewf_volume_section_s01_read_file_io_pool']	550	582	libewf_segment_file_read_volume_section	call site: 01834	/src/libewf/libewf/libewf_segment_file.c:1872
444	444	1 : View List ['libewf_header_values_parse_xheader_date_value']	444	476	libewf_header_values_parse_xheader	call site: 02093	/src/libewf/libewf/libewf_header_values.c:5736
264	314	2 : View List ['libewf_deflate_calculate_adler32', 'libcdata_range_list_insert_range']	264	632	libewf_error2_section_read_data	call site: 01697	/src/libewf/libewf/libewf_error2_section.c:263
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00344	/src/libqcow/libbfio/libbfio_handle.c:1139
221	386	6 : View List ['free', 'libewf_header_sections_free', 'libewf_single_files_free', 'libfcache_cache_free', 'libfdata_stream_free', 'libcerror_error_set']	221	386	libewf_internal_handle_open_read_segment_file_section_data	call site: 02868	/src/libewf/libewf/libewf_handle.c:2742

Runtime coverage analysis

Covered functions

266

Functions that are reachable but not covered

681

Reachable functions

947

Percentage of reachable functions covered

28.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libewf/ossfuzz/handle_fuzzer.cc	1
libewf/libbfio/libbfio_memory_range.c	2
libewf/libcerror/libcerror_error.c	4
libewf/libbfio/libbfio_memory_range_io_handle.c	3
libewf/libbfio/libbfio_handle.c	17
libewf/libcdata/libcdata_range_list.c	19
libewf/libcdata/libcdata_list_element.c	10
libewf/libcdata/libcdata_range_list_value.c	3
libewf/libbfio/libbfio_pool.c	21
libewf/libcdata/libcdata_array.c	13
libewf/libcdata/libcdata_list.c	9
libewf/libewf/libewf_handle.c	10
libewf/libewf/libewf_io_handle.c	3
libewf/libewf/libewf_media_values.c	4
libewf/libewf/libewf_segment_table.c	11
libewf/libfdata/libfdata_list.c	21
libewf/libewf/libewf_segment_file.c	30
libewf/libewf/libewf_section_descriptor.c	8
libewf/libewf/libewf_deflate.c	8
libewf/libfdata/libfdata_list_element.c	9
libewf/libfdata/libfdata_range.c	4
libewf/libfcache/libfcache_cache.c	5
libewf/libfcache/libfcache_cache_value.c	8
libewf/libewf/libewf_table_section.c	7
libewf/libewf/libewf_chunk_group.c	4
libewf/libewf/libewf_chunk_data.c	14
libewf/libcnotify/libcnotify_print.c	1
libewf/libfdata/libfdata_mapped_range.c	4
libewf/libfcache/libfcache_date_time.c	1
libewf/libcthreads/libcthreads_read_write_lock.c	4
libewf/libcerror/libcerror_system.c	2
libewf/libewf/libewf_read_io_handle.c	2
libewf/libewf/libewf_write_io_handle.c	18
libewf/libewf/libewf_chunk_table.c	5
libewf/libewf/libewf_header_values.c	24
libewf/libfvalue/libfvalue_table.c	8
libewf/libewf/libewf_value_table.c	4
libewf/libfvalue/libfvalue_value_type.c	3
libewf/libfvalue/libfvalue_value.c	13
libewf/libfvalue/libfvalue_data_handle.c	7
libewf/libfvalue/libfvalue_binary_data.c	1
libewf/libfvalue/libfvalue_floating_point.c	1
libewf/libfvalue/libfvalue_integer.c	5
libewf/libfvalue/libfvalue_string.c	1
libewf/libfdatetime/libfdatetime_fat_date_time.c	1
libewf/libfdatetime/libfdatetime_filetime.c	2
libewf/libfvalue/libfvalue_filetime.c	1
libewf/libfdatetime/libfdatetime_floatingtime.c	1
libewf/libfdatetime/libfdatetime_nsf_timedate.c	1
libewf/libfdatetime/libfdatetime_posix_time.c	2
libewf/libfdatetime/libfdatetime_systemtime.c	1
libewf/libfguid/libfguid_identifier.c	1
libewf/libfvalue/libfvalue_value_entry.c	1
libewf/libewf/libewf_hash_sections.c	2
libewf/libewf/libewf_sector_range.c	4
libewf/libewf/libewf_device_information_section.c	1
libewf/libewf/libewf_section.c	8
libewf/libhmac/libhmac_md5.c	4
libewf/libhmac/libhmac_md5_context.c	5
libewf/libewf/libewf_compression.c	2
libewf/libewf/libewf_bit_stream.c	3
libewf/libewf/libewf_huffman_tree.c	4
libewf/libewf/libewf_device_information.c	5
libewf/libuna/libuna_utf8_string.c	6
libewf/libuna/libuna_unicode_character.c	11
libewf/libfvalue/libfvalue_utf8_string.c	1
libewf/libfvalue/libfvalue_split_utf8_string.c	6
libewf/libewf/libewf_header_sections.c	4
libewf/libewf/libewf_case_data_section.c	1
libewf/libewf/libewf_case_data.c	5
libewf/libewf/libewf_date_time_values.c	11
libewf/libewf/libewf_date_time.c	1
libewf/libewf/libewf_error2_section.c	4
libewf/libewf/libewf_session_section.c	4
libewf/libewf/libewf_sector_range_list.c	2
libewf/libewf/libewf_md5_hash_section.c	4
libewf/libewf/libewf_sha1_hash_section.c	4
libewf/libewf/libewf_restart_data.c	1
libewf/libewf/libewf_analytical_data.c	1
libewf/libewf/libewf_ltree_section.c	2
libewf/libewf/libewf_data_stream.c	1
libewf/libewf/libewf_section_data_handle.c	2
libewf/libfdata/libfdata_stream.c	8
libewf/libfdata/libfdata_segments_array.c	2
libewf/libewf/libewf_volume_section.c	8
libewf/libewf/libewf_digest_section.c	4
libewf/libuna/libuna_codepage_koi8_r.c	2
libewf/libuna/libuna_codepage_koi8_u.c	2
libewf/libuna/libuna_codepage_mac_arabic.c	2
libewf/libuna/libuna_codepage_mac_celtic.c	2
libewf/libuna/libuna_codepage_mac_centraleurroman.c	2
libewf/libuna/libuna_codepage_mac_croatian.c	2
libewf/libuna/libuna_codepage_mac_cyrillic.c	2
libewf/libuna/libuna_codepage_mac_dingbats.c	2
libewf/libuna/libuna_codepage_mac_farsi.c	2
libewf/libuna/libuna_codepage_mac_gaelic.c	2
libewf/libuna/libuna_codepage_mac_greek.c	2
libewf/libuna/libuna_codepage_mac_icelandic.c	2
libewf/libuna/libuna_codepage_mac_inuit.c	2
libewf/libuna/libuna_codepage_mac_roman.c	2
libewf/libuna/libuna_codepage_mac_romanian.c	2
libewf/libuna/libuna_codepage_mac_russian.c	2
libewf/libuna/libuna_codepage_mac_symbol.c	3
libewf/libuna/libuna_codepage_mac_thai.c	3
libewf/libuna/libuna_codepage_mac_turkish.c	2
libewf/libuna/libuna_codepage_mac_ukrainian.c	2
libewf/libuna/libuna_codepage_windows_874.c	2
libewf/libuna/libuna_codepage_windows_932.c	3
libewf/libuna/libuna_codepage_windows_936.c	3
libewf/libuna/libuna_codepage_windows_949.c	3
libewf/libuna/libuna_codepage_windows_950.c	3
libewf/libuna/libuna_codepage_windows_1250.c	2
libewf/libuna/libuna_codepage_windows_1251.c	2
libewf/libuna/libuna_codepage_windows_1252.c	2
libewf/libuna/libuna_codepage_windows_1253.c	2
libewf/libuna/libuna_codepage_windows_1254.c	2
libewf/libuna/libuna_codepage_windows_1255.c	2
libewf/libuna/libuna_codepage_windows_1256.c	2
libewf/libuna/libuna_codepage_windows_1257.c	2
libewf/libuna/libuna_codepage_windows_1258.c	2
libewf/libewf/libewf_single_files.c	16
libewf/libewf/libewf_permission_group.c	3
libewf/libewf/libewf_lef_permission.c	3
libewf/libewf/libewf_serialized_string.c	4
libewf/libewf/libewf_line_reader.c	4
libewf/libewf/libewf_lef_source.c	4
libewf/libewf/libewf_lef_subject.c	3
libewf/libcdata/libcdata_tree_node.c	10
libewf/libewf/libewf_lef_file_entry.c	6
libewf/libewf/libewf_value_reader.c	9
libewf/libuna/libuna_base16_stream.c	3
libewf/libewf/libewf_lef_extended_attribute.c	3
libewf/libewf/libewf_chunk_descriptor.c	3
libewf/libewf/libewf_filename.c	2
libewf/libbfio/libbfio_file.c	2
libewf/libbfio/libbfio_file_io_handle.c	3
libewf/libcfile/libcfile_file.c	4
libewf/libcpath/libcpath_path.c	2
libewf/libcsplit/libcsplit_narrow_string.c	1
libewf/libcsplit/libcsplit_narrow_split_string.c	6
libewf/libbfio/libbfio_system_string.c	2
libewf/libuna/libuna_byte_stream.c	2
libewf/libuna/libuna_utf16_stream.c	3
libewf/libewf/libewf_hash_values.c	1

Fuzzer: libfcrypto_crypt_blowfish_cbc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	45	81.8%
gold	[1:9]	1	1.81%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	3.63%
lawngreen	50+	7	12.7%
All colors	55	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfcrypto_blowfish_context_initialize	call site: 00011	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:347
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_blowfish_context_free	call site: 00053	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:401
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_internal_blowfish_context_encrypt_values	call site: 00019	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:462
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_internal_blowfish_context_encrypt_block	call site: 00038	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:736
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_blowfish_crypt_cbc	call site: 00050	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:1180
0	0	None	42	276	libfcrypto_blowfish_crypt_cbc	call site: 00033	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:1058
0	0	None	0	32	libfcrypto_blowfish_context_initialize	call site: 00001	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:311
0	0	None	0	32	libfcrypto_blowfish_context_initialize	call site: 00002	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:322
0	0	None	0	32	libfcrypto_blowfish_context_initialize	call site: 00010	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:336
0	0	None	0	32	libfcrypto_blowfish_context_free	call site: 00052	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:385
0	0	None	0	32	libfcrypto_internal_blowfish_context_encrypt_values	call site: 00017	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:440

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

6

Reachable functions

14

Percentage of reachable functions covered

57.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfcrypto/ossfuzz/crypt_blowfish_cbc_fuzzer.cc	1
libfcrypto/libfcrypto/libfcrypto_blowfish_context.c	7
libfcrypto/libcerror/libcerror_error.c	3

Fuzzer: libmsiecf_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	369	73.0%
gold	[1:9]	2	0.39%
yellow	[10:29]	20	3.96%
greenyellow	[30:49]	5	0.99%
lawngreen	50+	109	21.5%
All colors	505	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	172	1 : View List ['libcdata_internal_range_list_insert_range_merge']	172	288	libcdata_range_list_insert_range	call site: 00185	/src/libqcow/libcdata/libcdata_range_list.c:2898
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00455	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
41	141	3 : View List ['libcdata_list_element_get_value', 'libcerror_error_set', 'libcdata_range_list_value_check_range_overlap']	41	141	libcdata_internal_range_list_check_range_overlap	call site: 00179	/src/libqcow/libcdata/libcdata_range_list.c:1651
35	215	6 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcdata_list_element_set_elements', 'libcdata_range_list_value_free', 'libcerror_error_set']	35	215	libcdata_internal_range_list_insert_range_before_element	call site: 00207	/src/libqcow/libcdata/libcdata_range_list.c:1813
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	436	4 : View List ['libcdata_list_element_get_value', 'libcdata_list_element_get_next_element', 'libcdata_list_element_get_previous_element', 'libcerror_error_set']	0	436	libcdata_internal_range_list_insert_range_find_element	call site: 00161	/src/libqcow/libcdata/libcdata_range_list.c:1453
0	264	1 : View List ['libcdata_range_list_insert_range']	0	360	libbfio_internal_handle_read_buffer	call site: 00147	/src/libqcow/libbfio/libbfio_handle.c:1139
0	205	1 : View List ['libmsiecf_file_close']	0	404	libmsiecf_file_free	call site: 00496	/src/libmsiecf/libmsiecf/libmsiecf_file.c:183
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	102	3 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element']	0	102	libcdata_internal_range_list_set_last_element	call site: 00213	/src/libqcow/libcdata/libcdata_range_list.c:1002
0	99	1 : View List ['libbfio_handle_free']	0	726	libmsiecf_file_close	call site: 00470	/src/libmsiecf/libmsiecf/libmsiecf_file.c:876
0	74	2 : View List ['libcerror_error_set', 'libbfio_handle_close']	0	74	libmsiecf_file_open_file_io_handle	call site: 00454	/src/libmsiecf/libmsiecf/libmsiecf_file.c:761

Runtime coverage analysis

Covered functions

77

Functions that are reachable but not covered

26

Reachable functions

103

Percentage of reachable functions covered

74.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libmsiecf/ossfuzz/file_fuzzer.cc	1
libmsiecf/libbfio/libbfio_memory_range.c	2
libmsiecf/libcerror/libcerror_error.c	3
libmsiecf/libbfio/libbfio_memory_range_io_handle.c	3
libmsiecf/libbfio/libbfio_handle.c	9
libmsiecf/libcdata/libcdata_range_list.c	18
libmsiecf/libcdata/libcdata_list_element.c	10
libmsiecf/libcdata/libcdata_range_list_value.c	3
libmsiecf/libmsiecf/libmsiecf_file.c	5
libmsiecf/libmsiecf/libmsiecf_io_handle.c	5
libmsiecf/libcthreads/libcthreads_read_write_lock.c	4
libmsiecf/libcerror/libcerror_system.c	2
libmsiecf/libmsiecf/libmsiecf_file_header.c	4
libmsiecf/libmsiecf/libmsiecf_cache_directory_table.c	4
libmsiecf/libcdata/libcdata_array.c	5
libmsiecf/libmsiecf/libmsiecf_directory_descriptor.c	3
libmsiecf/libmsiecf/libmsiecf_allocation_table.c	1
libmsiecf/libmsiecf/libmsiecf_hash_table.c	1
libmsiecf/libmsiecf/libmsiecf_item_descriptor.c	2

Fuzzer: libfcrypto_crypt_rc4_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	21	77.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	18.5%
lawngreen	50+	1	3.70%
All colors	27	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfcrypto_rc4_context_initialize	call site: 00011	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:77
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_rc4_context_free	call site: 00025	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:131
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_rc4_context_set_key	call site: 00015	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:192
0	0	None	0	32	libfcrypto_rc4_context_initialize	call site: 00001	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:41
0	0	None	0	32	libfcrypto_rc4_context_initialize	call site: 00002	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:52
0	0	None	0	32	libfcrypto_rc4_context_initialize	call site: 00010	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:66
0	0	None	0	32	libfcrypto_rc4_context_free	call site: 00024	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:115
0	0	None	0	32	libfcrypto_rc4_context_set_key	call site: 00013	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:168
0	0	None	0	32	libfcrypto_rc4_context_set_key	call site: 00014	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:181
0	0	None	0	32	libfcrypto_rc4_crypt	call site: 00017	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:253
0	0	None	0	32	libfcrypto_rc4_crypt	call site: 00018	/src/libluksde/libfcrypto/libfcrypto_rc4_context.c:266

Runtime coverage analysis

Covered functions

6

Functions that are reachable but not covered

5

Reachable functions

11

Percentage of reachable functions covered

54.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfcrypto/ossfuzz/crypt_rc4_fuzzer.cc	1
libfcrypto/libfcrypto/libfcrypto_rc4_context.c	4
libfcrypto/libcerror/libcerror_error.c	3

Fuzzer: libfwnt_lzxpress_huffman_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	59	68.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	7	8.13%
greenyellow	[30:49]	2	2.32%
lawngreen	50+	18	20.9%
All colors	86	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	72	2 : View List ['libfwnt_bit_stream_read', 'libcerror_error_set']	0	72	libfwnt_bit_stream_get_value	call site: 00060	/src/libfsntfs/libfwnt/libfwnt_bit_stream.c:268
0	70	2 : View List ['libcerror_error_set', 'libfwnt_huffman_tree_free']	0	70	libfwnt_lzxpress_huffman_decompress_chunk	call site: 00077	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:922
0	68	2 : View List ['libfwnt_bit_stream_free', 'libcerror_error_set']	0	68	libfwnt_lzxpress_huffman_decompress	call site: 00082	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:1015
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_bit_stream_initialize	call site: 00015	/src/libfsntfs/libfwnt/libfwnt_bit_stream.c:99
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_bit_stream_free	call site: 00082	/src/libfsntfs/libfwnt/libfwnt_bit_stream.c:138
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_bit_stream_read	call site: 00048	/src/libfsntfs/libfwnt/libfwnt_bit_stream.c:180
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_huffman_tree_initialize	call site: 00034	/src/libfsntfs/libfwnt/libfwnt_huffman_tree.c:168
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_huffman_tree_free	call site: 00077	/src/libfsntfs/libfwnt/libfwnt_huffman_tree.c:216
0	0	None	0	589	libfwnt_lzxpress_huffman_decompress_chunk	call site: 00050	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:590
0	0	None	0	114	libfwnt_huffman_tree_get_symbol_from_bit_stream	call site: 00056	/src/libfsntfs/libfwnt/libfwnt_huffman_tree.c:528
0	0	None	0	70	libfwnt_lzxpress_huffman_decompress_chunk	call site: 00025	/src/libfsntfs/libfwnt/libfwnt_lzxpress.c:544

Runtime coverage analysis

Covered functions

12

Functions that are reachable but not covered

5

Reachable functions

17

Percentage of reachable functions covered

70.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwnt/ossfuzz/lzxpress_huffman_fuzzer.cc	1
libfwnt/libfwnt/libfwnt_lzxpress.c	2
libfwnt/libcerror/libcerror_error.c	3
libfwnt/libfwnt/libfwnt_bit_stream.c	4
libfwnt/libfwnt/libfwnt_huffman_tree.c	4

Fuzzer: libfmos_lzfse_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	71	45.8%
gold	[1:9]	9	5.80%
yellow	[10:29]	21	13.5%
greenyellow	[30:49]	7	4.51%
lawngreen	50+	47	30.3%
All colors	155	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	68	2 : View List ['libcerror_error_set', 'libfmos_lzfse_bit_stream_free']	0	68	libfmos_lzfse_read_block	call site: 00127	/src/libmodi/libfmos/libfmos_lzfse.c:1154
0	32	1 : View List ['libcerror_error_set']	0	32	libfmos_lzfse_read_block_v1_header	call site: 00028	/src/libmodi/libfmos/libfmos_lzfse.c:410
0	32	1 : View List ['libcerror_error_set']	0	32	libfmos_lzfse_read_compressed_frequency_table	call site: 00044	/src/libmodi/libfmos/libfmos_lzfse.c:943
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfmos_lzfse_bit_stream_initialize	call site: 00081	/src/libmodi/libfmos/libfmos_lzfse_bit_stream.c:101
0	32	1 : View List ['libcerror_error_set']	0	32	libfmos_lzfse_bit_stream_free	call site: 00098	/src/libmodi/libfmos/libfmos_lzfse_bit_stream.c:141
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfmos_lzfse_decoder_initialize	call site: 00021	/src/libmodi/libfmos/libfmos_lzfse_decoder.c:78
0	32	1 : View List ['libcerror_error_set']	0	32	libfmos_lzfse_decoder_free	call site: 00131	/src/libmodi/libfmos/libfmos_lzfse_decoder.c:114
0	0	None	0	68	libfmos_lzfse_read_block	call site: 00076	/src/libmodi/libfmos/libfmos_lzfse.c:1064
0	0	None	0	68	libfmos_lzfse_read_block	call site: 00098	/src/libmodi/libfmos/libfmos_lzfse.c:1094
0	0	None	0	68	libfmos_lzfse_read_block	call site: 00102	/src/libmodi/libfmos/libfmos_lzfse.c:1121
0	0	None	0	68	libfmos_lzfse_decompress	call site: 00013	/src/libmodi/libfmos/libfmos_lzfse.c:1783

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

5

Reachable functions

22

Percentage of reachable functions covered

77.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfmos/ossfuzz/lzfse_fuzzer.cc	1
libfmos/libfmos/libfmos_lzfse.c	9
libfmos/libcerror/libcerror_error.c	3
libfmos/libfmos/libfmos_lzfse_decoder.c	2
libfmos/libfmos/libfmos_lzfse_bit_stream.c	3
libfmos/libfmos/libfmos_lzvn.c	1

Fuzzer: libfcrypto_crypt_des3_cbc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	39	79.5%
gold	[1:9]	1	2.04%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	8.16%
lawngreen	50+	5	10.2%
All colors	49	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfcrypto_des3_context_initialize	call site: 00011	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:147
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_des3_context_free	call site: 00047	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:201
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_internal_des3_context_crypt_block	call site: 00029	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:395
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_des3_crypt_cbc	call site: 00044	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:897
0	0	None	0	614	libfcrypto_des3_crypt_cbc	call site: 00026	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:691
0	0	None	0	32	libfcrypto_des3_context_initialize	call site: 00001	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:111
0	0	None	0	32	libfcrypto_des3_context_initialize	call site: 00002	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:122
0	0	None	0	32	libfcrypto_des3_context_initialize	call site: 00010	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:136
0	0	None	0	32	libfcrypto_des3_context_free	call site: 00046	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:185
0	0	None	0	32	libfcrypto_des3_context_set_key	call site: 00013	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:234
0	0	None	0	32	libfcrypto_des3_context_set_key	call site: 00014	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:247

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

5

Reachable functions

12

Percentage of reachable functions covered

58.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfcrypto/ossfuzz/crypt_des3_cbc_fuzzer.cc	1
libfcrypto/libfcrypto/libfcrypto_des3_context.c	5
libfcrypto/libcerror/libcerror_error.c	3

Fuzzer: libbde_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	743	69.8%
gold	[1:9]	31	2.91%
yellow	[10:29]	25	2.34%
greenyellow	[30:49]	20	1.87%
lawngreen	50+	245	23.0%
All colors	1064	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00175	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00988	/src/libqcow/libcdata/libcdata_list.c:238
102	843	8 : View List ['free', 'malloc', 'libcaes_context_free', 'libcerror_error_set', 'libcaes_crypt_ccm', 'libbde_password_calculate_key', 'libcaes_context_set_key', 'libcaes_context_initialize']	102	843	libbde_metadata_read_volume_master_key	call site: 00742	/src/libbde/libbde/libbde_metadata.c:1990
63	63	1 : View List ['libbde_diffuser_encrypt']	63	317	libbde_encryption_context_crypt	call site: 00888	/src/libbde/libbde/libbde_encryption_context.c:812
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01016	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	510	5 : View List ['libbde_encryption_context_free', 'libbde_metadata_free', 'libbde_sector_data_vector_free', 'libcerror_error_set', 'libbde_volume_header_free']	0	510	libbde_internal_volume_open_read	call site: 00973	/src/libbde/libbde/libbde_volume.c:1435
0	306	1 : View List ['libbde_volume_close']	0	578	libbde_volume_free	call site: 01055	/src/libbde/libbde/libbde_volume.c:206
0	260	4 : View List ['free', 'libcaes_tweaked_context_free', 'libcaes_context_free', 'libcerror_error_set']	0	260	libbde_encryption_context_initialize	call site: 00816	/src/libbde/libbde/libbde_encryption_context.c:195
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	109	4 : View List ['free', 'libbde_io_handle_free', 'libbde_password_keep_free', 'libcerror_error_set']	0	109	libbde_volume_initialize	call site: 00084	/src/libbde/libbde/libbde_volume.c:139

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

53

Reachable functions

174

Percentage of reachable functions covered

69.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libbde/ossfuzz/volume_fuzzer.cc	1
libbde/libbfio/libbfio_memory_range.c	2
libbde/libcerror/libcerror_error.c	3
libbde/libbfio/libbfio_memory_range_io_handle.c	3
libbde/libbfio/libbfio_handle.c	10
libbde/libcdata/libcdata_range_list.c	15
libbde/libcdata/libcdata_list_element.c	10
libbde/libcdata/libcdata_range_list_value.c	3
libbde/libbde/libbde_volume.c	8
libbde/libbde/libbde_io_handle.c	4
libbde/libbde/libbde_password_keep.c	2
libbde/libcthreads/libcthreads_read_write_lock.c	4
libbde/libcerror/libcerror_system.c	2
libbde/libbde/libbde_volume_header.c	4
libbde/libbde/libbde_metadata.c	7
libbde/libcdata/libcdata_array.c	6
libbde/libbde/libbde_metadata_entry.c	3
libbde/libbde/libbde_metadata_block_header.c	4
libbde/libbde/libbde_metadata_header.c	4
libbde/libbde/libbde_volume_master_key.c	3
libbde/libbde/libbde_key.c	3
libbde/libbde/libbde_stretch_key.c	3
libbde/libbde/libbde_aes_ccm_encrypted_key.c	3
libbde/libbde/libbde_external_key.c	3
libbde/libcaes/libcaes_context.c	9
libbde/libbde/libbde_password.c	1
libbde/libhmac/libhmac_sha256.c	1
libbde/libhmac/libhmac_sha256_context.c	5
libbde/libbde/libbde_encryption_context.c	4
libbde/libcaes/libcaes_tweaked_context.c	4
libbde/libbde/libbde_sector_data.c	3
libbde/libbde/libbde_diffuser.c	6
libbde/libbde/libbde_ntfs_volume_header.c	3
libbde/libbde/libbde_sector_data_vector.c	2
libbde/libfcache/libfcache_date_time.c	1
libbde/libfcache/libfcache_cache.c	2
libbde/libcdata/libcdata_list.c	3
libbde/libfcache/libfcache_cache_value.c	1

Fuzzer: libvsapm_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	333	83.6%
gold	[1:9]	12	3.01%
yellow	[10:29]	5	1.25%
greenyellow	[30:49]	1	0.25%
lawngreen	50+	47	11.8%
All colors	398	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00158	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00344	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	181	1 : View List ['libvsapm_volume_close']	0	458	libvsapm_volume_free	call site: 00381	/src/libvsapm/libvsapm/libvsapm_volume.c:190
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	375	libvsapm_volume_close	call site: 00359	/src/libvsapm/libvsapm/libvsapm_volume.c:892
0	68	2 : View List ['libcerror_error_set', 'libbfio_memory_range_io_handle_free']	0	68	libbfio_memory_range_initialize	call site: 00059	/src/libqcow/libbfio/libbfio_memory_range.c:83
0	68	3 : View List ['free', 'libvsapm_io_handle_free', 'libcerror_error_set']	0	68	libvsapm_volume_initialize	call site: 00088	/src/libvsapm/libvsapm/libvsapm_volume.c:131
0	64	1 : View List ['libcerror_error_set']	0	64	libbfio_internal_handle_read_buffer	call site: 00296	/src/libqcow/libbfio/libbfio_handle.c:1164
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00329	/src/libfplist/libcdata/libcdata_array.c:823
0	32	1 : View List ['libcerror_error_set']	0	32	libbfio_handle_free	call site: 00365	/src/libqcow/libbfio/libbfio_handle.c:307

Runtime coverage analysis

Covered functions

47

Functions that are reachable but not covered

41

Reachable functions

88

Percentage of reachable functions covered

53.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvsapm/ossfuzz/volume_fuzzer.cc	1
libvsapm/libbfio/libbfio_memory_range.c	2
libvsapm/libcerror/libcerror_error.c	3
libvsapm/libbfio/libbfio_memory_range_io_handle.c	3
libvsapm/libbfio/libbfio_handle.c	9
libvsapm/libcdata/libcdata_range_list.c	15
libvsapm/libcdata/libcdata_list_element.c	10
libvsapm/libcdata/libcdata_range_list_value.c	3
libvsapm/libvsapm/libvsapm_volume.c	5
libvsapm/libvsapm/libvsapm_io_handle.c	3
libvsapm/libcdata/libcdata_array.c	6
libvsapm/libcthreads/libcthreads_read_write_lock.c	4
libvsapm/libcerror/libcerror_system.c	2
libvsapm/libvsapm/libvsapm_partition_map_entry.c	4

Fuzzer: libfmos_adc_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	65.2%
gold	[1:9]	1	4.34%
yellow	[10:29]	3	13.0%
greenyellow	[30:49]	1	4.34%
lawngreen	50+	3	13.0%
All colors	23	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	0	None	0	32	libfmos_adc_decompress	call site: 00001	/src/libmodi/libfmos/libfmos_adc.c:54
0	0	None	0	32	libfmos_adc_decompress	call site: 00002	/src/libmodi/libfmos/libfmos_adc.c:65
0	0	None	0	32	libfmos_adc_decompress	call site: 00010	/src/libmodi/libfmos/libfmos_adc.c:76
0	0	None	0	32	libfmos_adc_decompress	call site: 00011	/src/libmodi/libfmos/libfmos_adc.c:87
0	0	None	0	32	libfmos_adc_decompress	call site: 00012	/src/libmodi/libfmos/libfmos_adc.c:100
0	0	None	0	32	libfmos_adc_decompress	call site: 00013	/src/libmodi/libfmos/libfmos_adc.c:117
0	0	None	0	32	libfmos_adc_decompress	call site: 00016	/src/libmodi/libfmos/libfmos_adc.c:170
0	0	None	0	32	libfmos_adc_decompress	call site: 00020	/src/libmodi/libfmos/libfmos_adc.c:237

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

5

Reachable functions

8

Percentage of reachable functions covered

37.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfmos/ossfuzz/adc_fuzzer.cc	1
libfmos/libfmos/libfmos_adc.c	1
libfmos/libcerror/libcerror_error.c	3

Fuzzer: libfcrypto_crypt_des3_ecb_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	32	76.1%
gold	[1:9]	1	2.38%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	9.52%
lawngreen	50+	5	11.9%
All colors	42	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfcrypto_des3_context_initialize	call site: 00011	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:147
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_des3_context_free	call site: 00040	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:201
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_internal_des3_context_crypt_block	call site: 00026	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:395
0	0	None	0	486	libfcrypto_des3_crypt_ecb	call site: 00023	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:1025
0	0	None	0	32	libfcrypto_des3_context_initialize	call site: 00001	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:111
0	0	None	0	32	libfcrypto_des3_context_initialize	call site: 00002	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:122
0	0	None	0	32	libfcrypto_des3_context_initialize	call site: 00010	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:136
0	0	None	0	32	libfcrypto_des3_context_free	call site: 00039	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:185
0	0	None	0	32	libfcrypto_des3_context_set_key	call site: 00013	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:234
0	0	None	0	32	libfcrypto_des3_context_set_key	call site: 00014	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:247
0	0	None	0	32	libfcrypto_internal_des3_context_crypt_block	call site: 00024	/src/libfcrypto/libfcrypto/libfcrypto_des3_context.c:372

Runtime coverage analysis

Covered functions

7

Functions that are reachable but not covered

5

Reachable functions

12

Percentage of reachable functions covered

58.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfcrypto/ossfuzz/crypt_des3_ecb_fuzzer.cc	1
libfcrypto/libfcrypto/libfcrypto_des3_context.c	5
libfcrypto/libcerror/libcerror_error.c	3

Fuzzer: libfmos_lzvn_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	53.8%
gold	[1:9]	4	15.3%
yellow	[10:29]	4	15.3%
greenyellow	[30:49]	1	3.84%
lawngreen	50+	3	11.5%
All colors	26	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	0	None	0	32	libfmos_lzvn_decompress	call site: 00001	/src/libfsapfs/libfmos/libfmos_lzvn.c:350
0	0	None	0	32	libfmos_lzvn_decompress	call site: 00002	/src/libfsapfs/libfmos/libfmos_lzvn.c:361
0	0	None	0	32	libfmos_lzvn_decompress	call site: 00010	/src/libfsapfs/libfmos/libfmos_lzvn.c:372
0	0	None	0	32	libfmos_lzvn_decompress	call site: 00011	/src/libfsapfs/libfmos/libfmos_lzvn.c:383
0	0	None	0	32	libfmos_lzvn_decompress	call site: 00012	/src/libfsapfs/libfmos/libfmos_lzvn.c:396
0	0	None	0	32	libfmos_lzvn_decompress	call site: 00013	/src/libfsapfs/libfmos/libfmos_lzvn.c:413
0	0	None	0	32	libfmos_lzvn_decompress	call site: 00022	/src/libfsapfs/libfmos/libfmos_lzvn.c:652

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

5

Reachable functions

8

Percentage of reachable functions covered

37.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfmos/ossfuzz/lzvn_fuzzer.cc	1
libfmos/libfmos/libfmos_lzvn.c	1
libfmos/libcerror/libcerror_error.c	3

Fuzzer: libfwnt_security_descriptor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	79	60.3%
gold	[1:9]	3	2.29%
yellow	[10:29]	5	3.81%
greenyellow	[30:49]	2	1.52%
lawngreen	50+	42	32.0%
All colors	131	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00065	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00103	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_set_entry_by_index	call site: 00094	/src/libfplist/libcdata/libcdata_array.c:1367
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_access_control_entry_initialize	call site: 00071	/src/libfwnt/libfwnt/libfwnt_access_control_entry.c:85
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_internal_access_control_entry_free	call site: 00099	/src/libfwnt/libfwnt/libfwnt_access_control_entry.c:164
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_access_control_list_initialize	call site: 00049	/src/libfwnt/libfwnt/libfwnt_access_control_list.c:81
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_internal_access_control_list_free	call site: 00117	/src/libfwnt/libfwnt/libfwnt_access_control_list.c:160
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_security_descriptor_initialize	call site: 00011	/src/libfwnt/libfwnt/libfwnt_security_descriptor.c:86
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_security_descriptor_free	call site: 00129	/src/libfwnt/libfwnt/libfwnt_security_descriptor.c:190
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwnt_security_identifier_initialize	call site: 00027	/src/libevt/libfwnt/libfwnt_security_identifier.c:79
0	32	1 : View List ['libcerror_error_set']	0	32	libfwnt_internal_security_identifier_free	call site: 00088	/src/libevt/libfwnt/libfwnt_security_identifier.c:162

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

5

Reachable functions

23

Percentage of reachable functions covered

78.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwnt/ossfuzz/security_descriptor_fuzzer.cc	1
libfwnt/libfwnt/libfwnt_security_descriptor.c	3
libfwnt/libcerror/libcerror_error.c	3
libfwnt/libfwnt/libfwnt_security_identifier.c	3
libfwnt/libfwnt/libfwnt_access_control_list.c	3
libfwnt/libcdata/libcdata_array.c	4
libfwnt/libfwnt/libfwnt_access_control_entry.c	3

Fuzzer: libvsmbr_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	354	81.0%
gold	[1:9]	1	0.22%
yellow	[10:29]	2	0.45%
greenyellow	[30:49]	10	2.28%
lawngreen	50+	70	16.0%
All colors	437	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00160	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00392	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	181	1 : View List ['libvsmbr_volume_close']	0	458	libvsmbr_volume_free	call site: 00423	/src/libvsmbr/libvsmbr/libvsmbr_volume.c:193
0	123	3 : View List ['libvsmbr_boot_record_free', 'libvsmbr_partition_values_free', 'libcerror_error_set']	0	123	libvsmbr_internal_volume_read_partition_entries	call site: 00366	/src/libvsmbr/libvsmbr/libvsmbr_volume.c:1325
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	375	libvsmbr_volume_close	call site: 00406	/src/libvsmbr/libvsmbr/libvsmbr_volume.c:895
0	87	2 : View List ['libvsmbr_boot_record_free', 'libcerror_error_set']	0	87	libvsmbr_internal_volume_open_read	call site: 00380	/src/libvsmbr/libvsmbr/libvsmbr_volume.c:1052
0	68	2 : View List ['libcerror_error_set', 'libbfio_memory_range_io_handle_free']	0	68	libbfio_memory_range_initialize	call site: 00059	/src/libqcow/libbfio/libbfio_memory_range.c:83
0	68	3 : View List ['free', 'libcerror_error_set', 'libvsmbr_io_handle_free']	0	68	libvsmbr_volume_initialize	call site: 00087	/src/libvsmbr/libvsmbr/libvsmbr_volume.c:134
0	64	1 : View List ['libcerror_error_set']	0	64	libbfio_internal_handle_read_buffer	call site: 00298	/src/libqcow/libbfio/libbfio_handle.c:1164

Runtime coverage analysis

Covered functions

56

Functions that are reachable but not covered

40

Reachable functions

96

Percentage of reachable functions covered

58.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvsmbr/ossfuzz/volume_fuzzer.cc	1
libvsmbr/libbfio/libbfio_memory_range.c	2
libvsmbr/libcerror/libcerror_error.c	4
libvsmbr/libbfio/libbfio_memory_range_io_handle.c	3
libvsmbr/libbfio/libbfio_handle.c	9
libvsmbr/libcdata/libcdata_range_list.c	15
libvsmbr/libcdata/libcdata_list_element.c	10
libvsmbr/libcdata/libcdata_range_list_value.c	3
libvsmbr/libvsmbr/libvsmbr_volume.c	6
libvsmbr/libvsmbr/libvsmbr_io_handle.c	3
libvsmbr/libcdata/libcdata_array.c	7
libvsmbr/libcthreads/libcthreads_read_write_lock.c	4
libvsmbr/libcerror/libcerror_system.c	2
libvsmbr/libvsmbr/libvsmbr_boot_record.c	5
libvsmbr/libvsmbr/libvsmbr_partition_entry.c	3
libvsmbr/libvsmbr/libvsmbr_partition_values.c	2

Fuzzer: libwrc_version_information_resource_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	35	50.0%
gold	[1:9]	8	11.4%
yellow	[10:29]	4	5.71%
greenyellow	[30:49]	2	2.85%
lawngreen	50+	21	30.0%
All colors	70	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libwrc_version_information_resource_initialize	call site: 00011	/src/libwrc/libwrc/libwrc_version_information_resource.c:87
0	32	1 : View List ['libcerror_error_set']	0	32	libwrc_version_information_resource_free	call site: 00068	/src/libwrc/libwrc/libwrc_version_information_resource.c:124
0	32	1 : View List ['libcerror_error_set']	0	32	libwrc_internal_version_information_resource_read_string	call site: 00044	/src/libwrc/libwrc/libwrc_version_information_resource.c:856
0	0	None	0	32	libwrc_version_information_resource_initialize	call site: 00001	/src/libwrc/libwrc/libwrc_version_information_resource.c:51
0	0	None	0	32	libwrc_version_information_resource_initialize	call site: 00002	/src/libwrc/libwrc/libwrc_version_information_resource.c:62
0	0	None	0	32	libwrc_version_information_resource_initialize	call site: 00010	/src/libwrc/libwrc/libwrc_version_information_resource.c:76
0	0	None	0	32	libwrc_internal_version_information_resource_read_string_file_information	call site: 00022	/src/libwrc/libwrc/libwrc_version_information_resource.c:168
0	0	None	0	32	libwrc_internal_version_information_resource_read_string_file_information	call site: 00023	/src/libwrc/libwrc/libwrc_version_information_resource.c:179
0	0	None	0	32	libwrc_internal_version_information_resource_read_string_file_information	call site: 00024	/src/libwrc/libwrc/libwrc_version_information_resource.c:190
0	0	None	0	32	libwrc_internal_version_information_resource_read_string_table	call site: 00030	/src/libwrc/libwrc/libwrc_version_information_resource.c:408
0	0	None	0	32	libwrc_internal_version_information_resource_read_string_table	call site: 00031	/src/libwrc/libwrc/libwrc_version_information_resource.c:419

Runtime coverage analysis

Covered functions

10

Functions that are reachable but not covered

6

Reachable functions

16

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libwrc/ossfuzz/version_information_resource_fuzzer.cc	1
libwrc/libwrc/libwrc_version_information_resource.c	8
libwrc/libcerror/libcerror_error.c	3

Fuzzer: libfwps_set_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	70.8%
gold	[1:9]	2	2.08%
yellow	[10:29]	3	3.12%
greenyellow	[30:49]	2	2.08%
lawngreen	50+	21	21.8%
All colors	96	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00076	/src/libfplist/libcdata/libcdata_array.c:823
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00021	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00089	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_internal_array_resize	call site: 00075	/src/libfplist/libcdata/libcdata_array.c:797
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_append_entry	call site: 00069	/src/libfplist/libcdata/libcdata_array.c:1609
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwps_record_initialize	call site: 00039	/src/libfwps/libfwps/libfwps_record.c:98
0	32	1 : View List ['libcerror_error_set']	0	32	libfwps_internal_record_free	call site: 00081	/src/libfwps/libfwps/libfwps_record.c:163
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwps_record_copy_from_byte_stream	call site: 00062	/src/libfwps/libfwps/libfwps_record.c:698
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwps_set_initialize	call site: 00013	/src/libfwps/libfwps/libfwps_set.c:108
0	32	1 : View List ['libcerror_error_set']	0	32	libfwps_set_free	call site: 00085	/src/libfwps/libfwps/libfwps_set.c:163
0	32	1 : View List ['libcerror_error_set']	0	32	libfwps_internal_set_free	call site: 00094	/src/libfwps/libfwps/libfwps_set.c:205

Runtime coverage analysis

Covered functions

14

Functions that are reachable but not covered

6

Reachable functions

20

Percentage of reachable functions covered

70.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwps/ossfuzz/set_fuzzer.cc	1
libfwps/libfwps/libfwps_set.c	4
libfwps/libcerror/libcerror_error.c	3
libfwps/libcdata/libcdata_array.c	5
libfwps/libfwps/libfwps_record.c	3

Fuzzer: libmdmp_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	355	81.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.46%
greenyellow	[30:49]	5	1.15%
lawngreen	50+	72	16.5%
All colors	434	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00140	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
39	39	1 : View List ['libfdata_range_get']	39	386	libfdata_segments_array_set_segment_by_index	call site: 00365	/src/libqcow/libfdata/libfdata_segments_array.c:156
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	186	1 : View List ['libmdmp_file_close']	0	364	libmdmp_file_free	call site: 00426	/src/libmdmp/libmdmp/libmdmp_file.c:178
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	101	2 : View List ['libmdmp_stream_descriptor_free', 'libcerror_error_set']	0	101	libmdmp_io_handle_read_streams_directory	call site: 00394	/src/libmdmp/libmdmp/libmdmp_io_handle.c:388
0	99	1 : View List ['libbfio_handle_free']	0	352	libmdmp_file_close	call site: 00411	/src/libmdmp/libmdmp/libmdmp_file.c:765
0	96	3 : View List ['free', 'libfdata_stream_free', 'libcerror_error_set']	0	96	libmdmp_stream_descriptor_initialize	call site: 00321	/src/libmdmp/libmdmp/libmdmp_stream_descriptor.c:117
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfdata_stream_initialize	call site: 00310	/src/libfsfat/libfdata/libfdata_stream.c:179
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libmdmp_file_initialize	call site: 00083	/src/libmdmp/libmdmp/libmdmp_file.c:119
0	69	1 : View List ['libmdmp_stream_descriptor_free']	0	69	libmdmp_io_handle_read_streams_directory	call site: 00396	/src/libmdmp/libmdmp/libmdmp_io_handle.c:408

Runtime coverage analysis

Covered functions

57

Functions that are reachable but not covered

40

Reachable functions

97

Percentage of reachable functions covered

58.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libmdmp/ossfuzz/file_fuzzer.cc	1
libmdmp/libbfio/libbfio_memory_range.c	2
libmdmp/libcerror/libcerror_error.c	3
libmdmp/libbfio/libbfio_memory_range_io_handle.c	3
libmdmp/libbfio/libbfio_handle.c	9
libmdmp/libcdata/libcdata_range_list.c	15
libmdmp/libcdata/libcdata_list_element.c	10
libmdmp/libcdata/libcdata_range_list_value.c	3
libmdmp/libmdmp/libmdmp_file.c	5
libmdmp/libcdata/libcdata_array.c	8
libmdmp/libmdmp/libmdmp_io_handle.c	5
libmdmp/libmdmp/libmdmp_file_header.c	4
libmdmp/libmdmp/libmdmp_stream_descriptor.c	3
libmdmp/libfdata/libfdata_stream.c	4
libmdmp/libfdata/libfdata_range.c	4
libmdmp/libfdata/libfdata_mapped_range.c	2
libmdmp/libfdata/libfdata_segments_array.c	1

Fuzzer: libfcrypto_crypt_blowfish_ecb_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	38	79.1%
gold	[1:9]	1	2.08%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	4.16%
lawngreen	50+	7	14.5%
All colors	48	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfcrypto_blowfish_context_initialize	call site: 00011	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:347
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_blowfish_context_free	call site: 00046	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:401
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_internal_blowfish_context_encrypt_values	call site: 00019	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:462
0	32	1 : View List ['libcerror_error_set']	0	32	libfcrypto_internal_blowfish_context_encrypt_block	call site: 00035	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:736
0	0	None	42	148	libfcrypto_blowfish_crypt_ecb	call site: 00030	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:1300
0	0	None	0	32	libfcrypto_blowfish_context_initialize	call site: 00001	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:311
0	0	None	0	32	libfcrypto_blowfish_context_initialize	call site: 00002	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:322
0	0	None	0	32	libfcrypto_blowfish_context_initialize	call site: 00010	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:336
0	0	None	0	32	libfcrypto_blowfish_context_free	call site: 00045	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:385
0	0	None	0	32	libfcrypto_internal_blowfish_context_encrypt_values	call site: 00017	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:440
0	0	None	0	32	libfcrypto_internal_blowfish_context_encrypt_values	call site: 00018	/src/libluksde/libfcrypto/libfcrypto_blowfish_context.c:451

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

6

Reachable functions

14

Percentage of reachable functions covered

57.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfcrypto/ossfuzz/crypt_blowfish_ecb_fuzzer.cc	1
libfcrypto/libfcrypto/libfcrypto_blowfish_context.c	7
libfcrypto/libcerror/libcerror_error.c	3

Fuzzer: libfsapfs_extended_attribute_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1129	65.0%
gold	[1:9]	52	2.99%
yellow	[10:29]	34	1.95%
greenyellow	[30:49]	43	2.47%
lawngreen	50+	477	27.4%
All colors	1735	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
729	729	1 : View List ['libfsapfs_file_system_btree_get_attributes_from_branch_node']	729	805	libfsapfs_file_system_btree_get_attributes	call site: 01578	/src/libfsapfs/libfsapfs/libfsapfs_file_system_btree.c:4286
696	778	4 : View List ['libfsapfs_container_key_bag_get_volume_key_bag_extent_by_identifier', 'libfsapfs_encryption_context_initialize', 'libfsapfs_volume_key_bag_initialize', 'libfsapfs_volume_key_bag_read_file_io_handle']	752	2838	libfsapfs_internal_volume_open_read	call site: 00965	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:554
431	431	1 : View List ['libfsapfs_internal_volume_unlock']	431	1696	libfsapfs_internal_volume_get_file_system	call site: 01208	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:2832
271	718	9 : View List ['libfsapfs_checksum_calculate_fletcher64', 'libfsapfs_key_bag_header_read_data', 'libfsapfs_key_bag_entry_initialize', 'libfsapfs_key_bag_entry_free', 'libfsapfs_key_bag_header_free', 'libfsapfs_key_bag_entry_read_data', 'libfsapfs_key_bag_header_initialize', 'libcdata_array_append_entry', 'libcerror_error_set']	271	718	libfsapfs_container_key_bag_read_data	call site: 00578	/src/libfsapfs/libfsapfs/libfsapfs_container_key_bag.c:504
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00149	/src/libqcow/libbfio/libbfio_handle.c:1139
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00825	/src/libqcow/libfcache/libfcache_cache.c:801
64	96	2 : View List ['libfdata_stream_free', 'libcerror_error_set']	64	96	libfsapfs_extended_attribute_free	call site: 01688	/src/libfsapfs/libfsapfs/libfsapfs_extended_attribute.c:201
64	96	2 : View List ['libfdata_stream_free', 'libcerror_error_set']	64	96	libfsapfs_file_entry_free	call site: 01706	/src/libfsapfs/libfsapfs/libfsapfs_file_entry.c:306
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
56	653	11 : View List ['libfsapfs_object_map_free', 'libfsapfs_volume_key_bag_free', 'libfsapfs_volume_superblock_free', 'libfsapfs_object_map_btree_free', 'libfdata_vector_free', 'libcdata_array_free', 'libfsapfs_encryption_context_free', 'libfsapfs_container_data_handle_free', 'libfsapfs_snapshot_metadata_tree_free', 'libfsapfs_file_system_data_handle_free', 'libcerror_error_set']	56	653	libfsapfs_internal_volume_open_read	call site: 01140	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:794
56	56	1 : View List ['libfsapfs_volume_key_bag_free']	56	474	libfsapfs_internal_volume_open_read	call site: 01144	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:833
56	56	1 : View List ['libfsapfs_volume_key_bag_free']	56	437	libfsapfs_internal_volume_close	call site: 01181	/src/libfsapfs/libfsapfs/libfsapfs_volume.c:1050

Runtime coverage analysis

Covered functions

232

Functions that are reachable but not covered

71

Reachable functions

303

Percentage of reachable functions covered

76.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsapfs/ossfuzz/extended_attribute_fuzzer.cc	1
libfsapfs/libbfio/libbfio_memory_range.c	2
libfsapfs/libcerror/libcerror_error.c	3
libfsapfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsapfs/libbfio/libbfio_handle.c	8
libfsapfs/libcdata/libcdata_range_list.c	15
libfsapfs/libcdata/libcdata_list_element.c	10
libfsapfs/libcdata/libcdata_range_list_value.c	3
libfsapfs/libfsapfs/libfsapfs_container.c	7
libfsapfs/libfsapfs/libfsapfs_io_handle.c	3
libfsapfs/libcthreads/libcthreads_read_write_lock.c	6
libfsapfs/libcerror/libcerror_system.c	2
libfsapfs/libfsapfs/libfsapfs_container_superblock.c	4
libfsapfs/libfsapfs/libfsapfs_checksum.c	2
libfsapfs/libfsapfs/libfsapfs_object.c	4
libfsapfs/libfsapfs/libfsapfs_checkpoint_map.c	4
libfsapfs/libcdata/libcdata_array.c	9
libfsapfs/libfsapfs/libfsapfs_checkpoint_map_entry.c	3
libfsapfs/libfsapfs/libfsapfs_container_data_handle.c	2
libfsapfs/libfdata/libfdata_vector.c	4
libfsapfs/libfcache/libfcache_date_time.c	1
libfsapfs/libfdata/libfdata_segments_array.c	2
libfsapfs/libfdata/libfdata_mapped_range.c	3
libfsapfs/libfdata/libfdata_range.c	4
libfsapfs/libfsapfs/libfsapfs_object_map.c	4
libfsapfs/libfsapfs/libfsapfs_object_map_btree.c	7
libfsapfs/libfcache/libfcache_cache.c	4
libfsapfs/libcdata/libcdata_list.c	9
libfsapfs/libfsapfs/libfsapfs_container_key_bag.c	6
libfsapfs/libfsapfs/libfsapfs_encryption_context.c	5
libfsapfs/libcaes/libcaes_tweaked_context.c	4
libfsapfs/libcaes/libcaes_context.c	7
libfsapfs/libfsapfs/libfsapfs_key_bag_header.c	3
libfsapfs/libfsapfs/libfsapfs_key_bag_entry.c	3
libfsapfs/libfcache/libfcache_cache_value.c	8
libfsapfs/libfsapfs/libfsapfs_fusion_middle_tree.c	1
libfsapfs/libfsapfs/libfsapfs_btree_node.c	7
libfsapfs/libfsapfs/libfsapfs_btree_node_header.c	3
libfsapfs/libfsapfs/libfsapfs_btree_footer.c	3
libfsapfs/libfsapfs/libfsapfs_btree_entry.c	4
libfsapfs/libfsapfs/libfsapfs_object_map_descriptor.c	4
libfsapfs/libfsapfs/libfsapfs_volume.c	7
libfsapfs/libfsapfs/libfsapfs_volume_superblock.c	4
libfsapfs/libfsapfs/libfsapfs_volume_key_bag.c	5
libfsapfs/libfsapfs/libfsapfs_snapshot_metadata_tree.c	8
libfsapfs/libfsapfs/libfsapfs_snapshot_metadata.c	4
libfsapfs/libfsapfs/libfsapfs_file_system_data_handle.c	2
libfsapfs/libfsapfs/libfsapfs_file_system.c	3
libfsapfs/libfsapfs/libfsapfs_file_system_btree.c	13
libfsapfs/libfsapfs/libfsapfs_key_encrypted_key.c	5
libfsapfs/libfsapfs/libfsapfs_password.c	1
libfsapfs/libhmac/libhmac_sha256.c	2
libfsapfs/libhmac/libhmac_sha256_context.c	5
libfsapfs/libuna/libuna_unicode_character.c	1
libfsapfs/libfsapfs/libfsapfs_name_hash.c	1
libfsapfs/libfsapfs/libfsapfs_directory_record.c	6
libfsapfs/libfsapfs/libfsapfs_name.c	1
libfsapfs/libfsapfs/libfsapfs_inode.c	5
libfsapfs/libfsapfs/libfsapfs_file_entry.c	5
libfsapfs/libfsapfs/libfsapfs_attribute_values.c	5
libfsapfs/libfsapfs/libfsapfs_file_extent.c	1
libfsapfs/libuna/libuna_utf8_string.c	1
libfsapfs/libfsapfs/libfsapfs_extended_attribute.c	2
libfsapfs/libfdata/libfdata_stream.c	1
libfsapfs/libfsapfs/libfsapfs_compressed_data_header.c	1

Fuzzer: libfwps_store_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	80	66.6%
gold	[1:9]	2	1.66%
yellow	[10:29]	3	2.5%
greenyellow	[30:49]	4	3.33%
lawngreen	50+	31	25.8%
All colors	120	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00089	/src/libfplist/libcdata/libcdata_array.c:823
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00021	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00103	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_empty	call site: 00112	/src/libfplist/libcdata/libcdata_array.c:328
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_internal_array_resize	call site: 00088	/src/libfplist/libcdata/libcdata_array.c:797
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_append_entry	call site: 00082	/src/libfplist/libcdata/libcdata_array.c:1609
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwps_record_initialize	call site: 00053	/src/libfwps/libfwps/libfwps_record.c:98
0	32	1 : View List ['libcerror_error_set']	0	32	libfwps_internal_record_free	call site: 00094	/src/libfwps/libfwps/libfwps_record.c:163
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwps_record_copy_from_byte_stream	call site: 00075	/src/libfwps/libfwps/libfwps_record.c:698
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwps_set_initialize	call site: 00035	/src/libfwps/libfwps/libfwps_set.c:108
0	32	1 : View List ['libcerror_error_set']	0	32	libfwps_internal_set_free	call site: 00108	/src/libfwps/libfwps/libfwps_set.c:205

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

6

Reachable functions

23

Percentage of reachable functions covered

73.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwps/ossfuzz/store_fuzzer.cc	1
libfwps/libfwps/libfwps_store.c	3
libfwps/libcerror/libcerror_error.c	3
libfwps/libcdata/libcdata_array.c	6
libfwps/libfwps/libfwps_set.c	3
libfwps/libfwps/libfwps_record.c	3

Fuzzer: libfwnt_lznt1_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	58.8%
gold	[1:9]	3	8.82%
yellow	[10:29]	2	5.88%
greenyellow	[30:49]	2	5.88%
lawngreen	50+	7	20.5%
All colors	34	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	0	None	0	32	libfwnt_lznt1_decompress_chunk	call site: 00014	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:57
0	0	None	0	32	libfwnt_lznt1_decompress_chunk	call site: 00015	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:68
0	0	None	0	32	libfwnt_lznt1_decompress_chunk	call site: 00016	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:79
0	0	None	0	32	libfwnt_lznt1_decompress_chunk	call site: 00018	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:103
0	0	None	0	32	libfwnt_lznt1_decompress_chunk	call site: 00020	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:125
0	0	None	0	32	libfwnt_lznt1_decompress_chunk	call site: 00021	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:136
0	0	None	0	32	libfwnt_lznt1_decompress_chunk	call site: 00024	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:267
0	0	None	0	32	libfwnt_lznt1_decompress_chunk	call site: 00028	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:333
0	0	None	0	32	libfwnt_lznt1_decompress	call site: 00001	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:374
0	0	None	0	32	libfwnt_lznt1_decompress	call site: 00002	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:385
0	0	None	0	32	libfwnt_lznt1_decompress	call site: 00010	/src/libfsntfs/libfwnt/libfwnt_lznt1.c:396

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

5

Reachable functions

9

Percentage of reachable functions covered

44.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwnt/ossfuzz/lznt1_fuzzer.cc	1
libfwnt/libfwnt/libfwnt_lznt1.c	2
libfwnt/libcerror/libcerror_error.c	3

Fuzzer: libvslvm_logical_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	895	70.4%
gold	[1:9]	23	1.81%
yellow	[10:29]	14	1.10%
greenyellow	[30:49]	20	1.57%
lawngreen	50+	318	25.0%
All colors	1270	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00313	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00087	/src/libqcow/libcdata/libcdata_list.c:238
138	170	2 : View List ['libbfio_internal_pool_append_handle_to_last_used_list', 'libcerror_error_set']	138	208	libbfio_pool_append_handle	call site: 00938	/src/libodraw/libbfio/libbfio_pool.c:1395
138	170	2 : View List ['libbfio_internal_pool_append_handle_to_last_used_list', 'libcerror_error_set']	138	208	libbfio_pool_set_handle	call site: 00168	/src/libodraw/libbfio/libbfio_pool.c:1591
138	170	2 : View List ['libbfio_internal_pool_append_handle_to_last_used_list', 'libcerror_error_set']	138	170	libbfio_pool_remove_handle	call site: 00513	/src/libodraw/libbfio/libbfio_pool.c:1753
129	264	2 : View List ['libbfio_pool_close_all', 'libbfio_pool_free']	129	516	libvslvm_handle_close	call site: 01233	/src/libvslvm/libvslvm/libvslvm_handle.c:1769
108	140	2 : View List ['libcerror_error_set', 'libbfio_internal_pool_move_handle_to_front_of_last_used_list']	108	140	libbfio_internal_pool_get_open_handle	call site: 00281	/src/libodraw/libbfio/libbfio_pool.c:2813
107	171	3 : View List ['libcerror_error_set', 'libcdata_list_remove_element', 'libcdata_list_element_free']	107	171	libbfio_internal_pool_remove_handle_from_last_used_list	call site: 00507	/src/libodraw/libbfio/libbfio_pool.c:1051
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_vector_get_size	call site: 01174	/src/libqcow/libfdata/libfdata_vector.c:1910
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	552	6 : View List ['libvslvm_metadata_free', 'libvslvm_internal_physical_volume_free', 'libvslvm_metadata_area_free', 'libbfio_pool_remove_handle', 'libcerror_error_set', 'libbfio_pool_free']	0	552	libvslvm_internal_handle_open_read	call site: 00915	/src/libvslvm/libvslvm/libvslvm_handle.c:2171

Runtime coverage analysis

Covered functions

155

Functions that are reachable but not covered

73

Reachable functions

228

Percentage of reachable functions covered

67.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvslvm/ossfuzz/logical_volume_fuzzer.cc	1
libvslvm/libbfio/libbfio_memory_range.c	2
libvslvm/libcerror/libcerror_error.c	3
libvslvm/libbfio/libbfio_memory_range_io_handle.c	3
libvslvm/libbfio/libbfio_handle.c	12
libvslvm/libcdata/libcdata_range_list.c	15
libvslvm/libcdata/libcdata_list_element.c	10
libvslvm/libcdata/libcdata_range_list_value.c	3
libvslvm/libbfio/libbfio_pool.c	16
libvslvm/libcdata/libcdata_array.c	9
libvslvm/libcdata/libcdata_list.c	9
libvslvm/libvslvm/libvslvm_handle.c	8
libvslvm/libvslvm/libvslvm_io_handle.c	3
libvslvm/libvslvm/libvslvm_physical_volume.c	12
libvslvm/libvslvm/libvslvm_checksum.c	2
libvslvm/libvslvm/libvslvm_data_area_descriptor.c	4
libvslvm/libvslvm/libvslvm_metadata_area.c	4
libvslvm/libvslvm/libvslvm_raw_location_descriptor.c	4
libvslvm/libvslvm/libvslvm_metadata.c	12
libvslvm/libcsplit/libcsplit_narrow_string.c	1
libvslvm/libcsplit/libcsplit_narrow_split_string.c	6
libvslvm/libvslvm/libvslvm_volume_group.c	13
libvslvm/libvslvm/libvslvm_logical_volume_values.c	7
libvslvm/libvslvm/libvslvm_segment.c	7
libvslvm/libfvalue/libfvalue_integer.c	2
libvslvm/libvslvm/libvslvm_stripe.c	7
libvslvm/libvslvm/libvslvm_logical_volume.c	3
libvslvm/libfdata/libfdata_vector.c	5
libvslvm/libfcache/libfcache_date_time.c	1
libvslvm/libvslvm/libvslvm_chunk_data.c	3
libvslvm/libfdata/libfdata_segments_array.c	3
libvslvm/libfdata/libfdata_range.c	5
libvslvm/libfcache/libfcache_cache.c	3
libvslvm/libfcache/libfcache_cache_value.c	6
libvslvm/libfdata/libfdata_mapped_range.c	3
libvslvm/libcthreads/libcthreads_read_write_lock.c	2
libvslvm/libcerror/libcerror_system.c	2

Fuzzer: libevt_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	550	74.4%
gold	[1:9]	5	0.67%
yellow	[10:29]	12	1.62%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	172	23.2%
All colors	739	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00128	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00699	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00658	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	38	147	libfdata_list_append_element	call site: 00591	/src/libevt/libfdata/libfdata_list.c:1489
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	230	1 : View List ['libevt_file_close']	0	757	libevt_file_free	call site: 00717	/src/libevt/libevt/libevt_file.c:246
0	206	4 : View List ['free', 'libfdata_list_free', 'libevt_io_handle_free', 'libcerror_error_set']	0	206	libevt_file_initialize	call site: 00468	/src/libevt/libevt/libevt_file.c:175
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	113	4 : View List ['free', 'libfwnt_security_identifier_free', 'libcerror_error_set', 'libevt_strings_array_free']	0	113	libevt_event_record_read_data	call site: 00334	/src/libevt/libevt/libevt_event_record.c:887
0	99	1 : View List ['libbfio_handle_free']	0	673	libevt_file_close	call site: 00673	/src/libevt/libevt/libevt_file.c:980
0	98	2 : View List ['libevt_record_values_free', 'libcerror_error_set']	0	98	libevt_io_handle_event_record_scan	call site: 00635	/src/libevt/libevt/libevt_io_handle.c:852

Runtime coverage analysis

Covered functions

92

Functions that are reachable but not covered

62

Reachable functions

154

Percentage of reachable functions covered

59.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libevt/ossfuzz/file_fuzzer.cc	1
libevt/libbfio/libbfio_memory_range.c	2
libevt/libcerror/libcerror_error.c	4
libevt/libbfio/libbfio_memory_range_io_handle.c	3
libevt/libbfio/libbfio_handle.c	10
libevt/libcdata/libcdata_range_list.c	15
libevt/libcdata/libcdata_list_element.c	10
libevt/libcdata/libcdata_range_list_value.c	3
libevt/libevt/libevt_file.c	5
libevt/libevt/libevt_io_handle.c	7
libevt/libfdata/libfdata_list.c	5
libevt/libcdata/libcdata_array.c	10
libevt/libevt/libevt_record_values.c	5
libevt/libevt/libevt_event_record.c	3
libevt/libfwnt/libfwnt_security_identifier.c	4
libevt/libevt/libevt_strings_array.c	3
libevt/libevt/libevt_end_of_file_record.c	3
libevt/libfdata/libfdata_list_element.c	7
libevt/libfdata/libfdata_range.c	4
libevt/libfcache/libfcache_cache.c	4
libevt/libcdata/libcdata_list.c	7
libevt/libfcache/libfcache_cache_value.c	6
libevt/libcthreads/libcthreads_read_write_lock.c	4
libevt/libcerror/libcerror_system.c	2
libevt/libfdata/libfdata_mapped_range.c	3
libevt/libevt/libevt_file_header.c	4
libevt/libfcache/libfcache_date_time.c	1

Fuzzer: libexe_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	401	71.3%
gold	[1:9]	24	4.27%
yellow	[10:29]	4	0.71%
greenyellow	[30:49]	9	1.60%
lawngreen	50+	124	22.0%
All colors	562	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00143	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	192	1 : View List ['libexe_file_close']	0	390	libexe_file_free	call site: 00548	/src/libexe/libexe/libexe_file.c:181
0	140	4 : View List ['libexe_export_table_free', 'libexe_debug_data_free', 'libexe_import_table_free', 'libcerror_error_set']	0	140	libexe_file_open_read	call site: 00518	/src/libexe/libexe/libexe_file.c:1083
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	295	libexe_file_close	call site: 00533	/src/libexe/libexe/libexe_file.c:766
0	96	3 : View List ['free', 'libfdata_stream_free', 'libcerror_error_set']	0	96	libexe_section_descriptor_initialize	call site: 00403	/src/libexe/libexe/libexe_section_descriptor.c:118
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libexe_file_initialize	call site: 00082	/src/libexe/libexe/libexe_file.c:122
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfdata_stream_initialize	call site: 00397	/src/libfsfat/libfdata/libfdata_stream.c:179
0	69	1 : View List ['libexe_section_descriptor_free']	0	69	libexe_io_handle_read_section_table	call site: 00471	/src/libexe/libexe/libexe_io_handle.c:1170
0	68	2 : View List ['libcerror_error_set', 'libbfio_memory_range_io_handle_free']	0	68	libbfio_memory_range_initialize	call site: 00059	/src/libqcow/libbfio/libbfio_memory_range.c:83

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

38

Reachable functions

132

Percentage of reachable functions covered

71.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libexe/ossfuzz/file_fuzzer.cc	1
libexe/libbfio/libbfio_memory_range.c	2
libexe/libcerror/libcerror_error.c	3
libexe/libbfio/libbfio_memory_range_io_handle.c	3
libexe/libbfio/libbfio_handle.c	9
libexe/libcdata/libcdata_range_list.c	15
libexe/libcdata/libcdata_list_element.c	10
libexe/libcdata/libcdata_range_list_value.c	3
libexe/libexe/libexe_file.c	6
libexe/libcdata/libcdata_array.c	9
libexe/libexe/libexe_io_handle.c	10
libexe/libexe/libexe_mz_header.c	4
libexe/libexe/libexe_le_header.c	4
libexe/libexe/libexe_ne_header.c	4
libexe/libexe/libexe_coff_header.c	4
libexe/libexe/libexe_coff_optional_header.c	4
libexe/libexe/libexe_section_descriptor.c	4
libexe/libfdata/libfdata_stream.c	5
libexe/libfdata/libfdata_range.c	4
libexe/libfdata/libfdata_mapped_range.c	2
libexe/libfdata/libfdata_segments_array.c	2
libexe/libexe/libexe_export_table.c	3
libexe/libexe/libexe_import_table.c	3
libexe/libexe/libexe_debug_data.c	3

Fuzzer: libvslvm_handle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	724	70.4%
gold	[1:9]	26	2.53%
yellow	[10:29]	8	0.77%
greenyellow	[30:49]	5	0.48%
lawngreen	50+	264	25.7%
All colors	1027	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00313	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00087	/src/libqcow/libcdata/libcdata_list.c:238
138	170	2 : View List ['libbfio_internal_pool_append_handle_to_last_used_list', 'libcerror_error_set']	138	208	libbfio_pool_append_handle	call site: 00938	/src/libodraw/libbfio/libbfio_pool.c:1395
138	170	2 : View List ['libbfio_internal_pool_append_handle_to_last_used_list', 'libcerror_error_set']	138	208	libbfio_pool_set_handle	call site: 00168	/src/libodraw/libbfio/libbfio_pool.c:1591
138	170	2 : View List ['libbfio_internal_pool_append_handle_to_last_used_list', 'libcerror_error_set']	138	170	libbfio_pool_remove_handle	call site: 00513	/src/libodraw/libbfio/libbfio_pool.c:1753
129	264	2 : View List ['libbfio_pool_close_all', 'libbfio_pool_free']	129	516	libvslvm_handle_close	call site: 00988	/src/libvslvm/libvslvm/libvslvm_handle.c:1769
108	140	2 : View List ['libcerror_error_set', 'libbfio_internal_pool_move_handle_to_front_of_last_used_list']	108	140	libbfio_internal_pool_get_open_handle	call site: 00281	/src/libodraw/libbfio/libbfio_pool.c:2813
107	171	3 : View List ['libcerror_error_set', 'libcdata_list_remove_element', 'libcdata_list_element_free']	107	171	libbfio_internal_pool_remove_handle_from_last_used_list	call site: 00507	/src/libodraw/libbfio/libbfio_pool.c:1051
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	552	6 : View List ['libvslvm_metadata_free', 'libvslvm_internal_physical_volume_free', 'libvslvm_metadata_area_free', 'libbfio_pool_remove_handle', 'libcerror_error_set', 'libbfio_pool_free']	0	552	libvslvm_internal_handle_open_read	call site: 00915	/src/libvslvm/libvslvm/libvslvm_handle.c:2171
0	144	4 : View List ['free', 'libcdata_array_free', 'libcerror_error_set', 'libcdata_list_free']	0	144	libbfio_pool_initialize	call site: 00082	/src/libodraw/libbfio/libbfio_pool.c:139

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

46

Reachable functions

167

Percentage of reachable functions covered

72.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvslvm/ossfuzz/handle_fuzzer.cc	1
libvslvm/libbfio/libbfio_memory_range.c	2
libvslvm/libcerror/libcerror_error.c	3
libvslvm/libbfio/libbfio_memory_range_io_handle.c	3
libvslvm/libbfio/libbfio_handle.c	11
libvslvm/libcdata/libcdata_range_list.c	15
libvslvm/libcdata/libcdata_list_element.c	10
libvslvm/libcdata/libcdata_range_list_value.c	3
libvslvm/libbfio/libbfio_pool.c	14
libvslvm/libcdata/libcdata_array.c	9
libvslvm/libcdata/libcdata_list.c	7
libvslvm/libvslvm/libvslvm_handle.c	7
libvslvm/libvslvm/libvslvm_io_handle.c	3
libvslvm/libvslvm/libvslvm_physical_volume.c	10
libvslvm/libvslvm/libvslvm_checksum.c	2
libvslvm/libvslvm/libvslvm_data_area_descriptor.c	4
libvslvm/libvslvm/libvslvm_metadata_area.c	4
libvslvm/libvslvm/libvslvm_raw_location_descriptor.c	4
libvslvm/libvslvm/libvslvm_metadata.c	12
libvslvm/libcsplit/libcsplit_narrow_string.c	1
libvslvm/libcsplit/libcsplit_narrow_split_string.c	6
libvslvm/libvslvm/libvslvm_volume_group.c	8
libvslvm/libvslvm/libvslvm_logical_volume_values.c	5
libvslvm/libvslvm/libvslvm_segment.c	4
libvslvm/libfvalue/libfvalue_integer.c	2
libvslvm/libvslvm/libvslvm_stripe.c	4

Fuzzer: libcreg_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	630	83.2%
gold	[1:9]	3	0.39%
yellow	[10:29]	3	0.39%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	120	15.8%
All colors	757	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00147	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00483	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00725	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	38	147	libfdata_list_append_element	call site: 00678	/src/libevt/libfdata/libfdata_list.c:1489
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00463	/src/libqcow/libfdata/libfdata_segments_array.c:592
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	255	1 : View List ['libcreg_file_close']	0	454	libcreg_file_free	call site: 00747	/src/libcreg/libcreg/libcreg_file.c:176
0	190	3 : View List ['libfdata_area_free', 'libfcache_cache_free', 'libcerror_error_set']	0	190	libcreg_key_navigation_read_file_io_handle	call site: 00472	/src/libcreg/libcreg/libcreg_key_navigation.c:446
0	165	3 : View List ['libfdata_list_free', 'libcreg_data_block_free', 'libcerror_error_set']	0	165	libcreg_key_navigation_read_data_blocks	call site: 00688	/src/libcreg/libcreg/libcreg_key_navigation.c:680
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	470	libcreg_file_close	call site: 00737	/src/libcreg/libcreg/libcreg_file.c:855

Runtime coverage analysis

Covered functions

77

Functions that are reachable but not covered

79

Reachable functions

156

Percentage of reachable functions covered

49.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libcreg/ossfuzz/file_fuzzer.cc	1
libcreg/libbfio/libbfio_memory_range.c	2
libcreg/libcerror/libcerror_error.c	3
libcreg/libbfio/libbfio_memory_range_io_handle.c	3
libcreg/libbfio/libbfio_handle.c	10
libcreg/libcdata/libcdata_range_list.c	15
libcreg/libcdata/libcdata_list_element.c	10
libcreg/libcdata/libcdata_range_list_value.c	3
libcreg/libcreg/libcreg_file.c	5
libcreg/libcreg/libcreg_io_handle.c	5
libcreg/libcthreads/libcthreads_read_write_lock.c	4
libcreg/libcerror/libcerror_system.c	2
libcreg/libcreg/libcreg_key_navigation.c	6
libcreg/libfdata/libfdata_area.c	4
libcreg/libcdata/libcdata_array.c	9
libcreg/libfcache/libfcache_date_time.c	1
libcreg/libcreg/libcreg_key_hierarchy_entry.c	3
libcreg/libfdata/libfdata_segments_array.c	2
libcreg/libfdata/libfdata_range.c	5
libcreg/libfcache/libfcache_cache.c	5
libcreg/libfcache/libfcache_cache_value.c	6
libcreg/libcdata/libcdata_list.c	7
libcreg/libfdata/libfdata_mapped_range.c	3
libcreg/libfdata/libfdata_list.c	5
libcreg/libcreg/libcreg_data_block.c	4
libcreg/libcreg/libcreg_key_name_entry.c	4
libcreg/libcreg/libcreg_value_entry.c	3
libcreg/libfdata/libfdata_list_element.c	7

Fuzzer: libolecf_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	444	63.9%
gold	[1:9]	10	1.44%
yellow	[10:29]	20	2.88%
greenyellow	[30:49]	3	0.43%
lawngreen	50+	217	31.2%
All colors	694	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	406	6 : View List ['libcdata_range_list_free', 'libcdata_tree_node_free', 'libcdata_list_free', 'libolecf_allocation_table_free', 'libolecf_file_header_free', 'libcerror_error_set']	0	406	libolecf_file_open_read	call site: 00647	/src/libolecf/libolecf/libolecf_file.c:1126
0	264	1 : View List ['libcdata_range_list_insert_range']	0	360	libbfio_internal_handle_read_buffer	call site: 00139	/src/libqcow/libbfio/libbfio_handle.c:1139
0	215	6 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcdata_list_element_set_elements', 'libcdata_range_list_value_free', 'libcerror_error_set']	0	215	libcdata_internal_range_list_insert_range_before_element	call site: 00197	/src/libqcow/libcdata/libcdata_range_list.c:1813
0	214	4 : View List ['libcdata_range_list_free', 'libcdata_list_empty', 'libcerror_error_set', 'libolecf_directory_entry_free']	0	214	libolecf_io_handle_read_directory_entries	call site: 00415	/src/libolecf/libolecf/libolecf_io_handle.c:1361
0	176	1 : View List ['libolecf_file_close']	0	276	libolecf_file_free	call site: 00689	/src/libolecf/libolecf/libolecf_file.c:157
0	137	4 : View List ['libcdata_tree_node_set_previous_node', 'libcerror_error_set', 'libcdata_tree_node_set_next_node', 'libcdata_tree_node_set_nodes']	0	137	libcdata_internal_tree_node_insert_node_before_sub_node	call site: 00582	/src/libfsntfs/libcdata/libcdata_tree_node.c:2697
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	102	3 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element']	0	102	libcdata_internal_range_list_set_last_element	call site: 00203	/src/libqcow/libcdata/libcdata_range_list.c:1002
0	102	3 : View List ['libcdata_tree_node_set_previous_node', 'libcerror_error_set', 'libcdata_tree_node_set_next_node']	0	102	libcdata_internal_tree_node_set_last_sub_node	call site: 00569	/src/libfsntfs/libcdata/libcdata_tree_node.c:1692
0	99	1 : View List ['libbfio_handle_free']	0	631	libolecf_file_close	call site: 00667	/src/libolecf/libolecf/libolecf_file.c:685
0	84	1 : View List ['libcdata_range_list_free']	0	374	libolecf_file_open_read	call site: 00647	/src/libolecf/libolecf/libolecf_file.c:1143

Runtime coverage analysis

Covered functions

104

Functions that are reachable but not covered

11

Reachable functions

115

Percentage of reachable functions covered

90.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libolecf/ossfuzz/file_fuzzer.cc	1
libolecf/libbfio/libbfio_memory_range.c	2
libolecf/libcerror/libcerror_error.c	3
libolecf/libbfio/libbfio_memory_range_io_handle.c	3
libolecf/libbfio/libbfio_handle.c	8
libolecf/libcdata/libcdata_range_list.c	16
libolecf/libcdata/libcdata_list_element.c	10
libolecf/libcdata/libcdata_range_list_value.c	3
libolecf/libolecf/libolecf_file.c	5
libolecf/libolecf/libolecf_io_handle.c	7
libolecf/libolecf/libolecf_file_header.c	4
libolecf/libolecf/libolecf_allocation_table.c	4
libolecf/libcdata/libcdata_list.c	7
libolecf/libolecf/libolecf_directory_entry.c	5
libolecf/libolecf/libolecf_directory_tree.c	2
libolecf/libcdata/libcdata_tree_node.c	17
libolecf/libuna/libuna_utf8_string.c	1
libolecf/libuna/libuna_unicode_character.c	3
libolecf/libolecf/libolecf_directory_list.c	1

Fuzzer: libvhdi_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	723	72.3%
gold	[1:9]	22	2.19%
yellow	[10:29]	47	4.7%
greenyellow	[30:49]	17	1.70%
lawngreen	50+	191	19.1%
All colors	1000	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00153	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 00980	/src/libqcow/libcdata/libcdata_list.c:238
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00940	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00904	/src/libqcow/libfdata/libfdata_segments_array.c:592
38	38	1 : View List ['libcdata_array_set_entry_by_index']	38	74	libfdata_segments_array_append_segment	call site: 00905	/src/libqcow/libfdata/libfdata_segments_array.c:642
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	353	5 : View List ['libfdata_vector_initialize', 'libfcache_cache_initialize', 'libvhdi_block_allocation_table_read_file_io_handle', 'libfdata_vector_append_segment', 'libvhdi_block_allocation_table_initialize']	0	645	libvhdi_internal_file_open_read_block_allocation_table	call site: 00735	/src/libvhdi/libvhdi/libvhdi_file.c:1968
0	285	1 : View List ['libvhdi_file_close']	0	484	libvhdi_file_free	call site: 00990	/src/libvhdi/libvhdi/libvhdi_file.c:198
0	154	2 : View List ['libvhdi_region_table_free', 'libcerror_error_set']	0	154	libvhdi_internal_file_open_read_region_table	call site: 00441	/src/libvhdi/libvhdi/libvhdi_file.c:1712
0	132	3 : View List ['libfdata_vector_free', 'libvhdi_block_allocation_table_free', 'libcerror_error_set']	0	132	libvhdi_internal_file_open_read_block_allocation_table	call site: 00912	/src/libvhdi/libvhdi/libvhdi_file.c:2074
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00750	/src/libqcow/libfdata/libfdata_vector.c:180

Runtime coverage analysis

Covered functions

130

Functions that are reachable but not covered

78

Reachable functions

208

Percentage of reachable functions covered

62.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvhdi/ossfuzz/file_fuzzer.cc	1
libvhdi/libbfio/libbfio_memory_range.c	2
libvhdi/libcerror/libcerror_error.c	3
libvhdi/libbfio/libbfio_memory_range_io_handle.c	3
libvhdi/libbfio/libbfio_handle.c	9
libvhdi/libcdata/libcdata_range_list.c	15
libvhdi/libcdata/libcdata_list_element.c	10
libvhdi/libcdata/libcdata_range_list_value.c	3
libvhdi/libvhdi/libvhdi_file.c	10
libvhdi/libvhdi/libvhdi_io_handle.c	3
libvhdi/libvhdi/libvhdi_i18n.c	1
libvhdi/libcthreads/libcthreads_read_write_lock.c	4
libvhdi/libcerror/libcerror_system.c	2
libvhdi/libvhdi/libvhdi_file_information.c	4
libvhdi/libvhdi/libvhdi_file_footer.c	4
libvhdi/libvhdi/libvhdi_dynamic_disk_header.c	4
libvhdi/libvhdi/libvhdi_image_header.c	4
libvhdi/libvhdi/libvhdi_region_table.c	4
libvhdi/libcdata/libcdata_array.c	9
libvhdi/libvhdi/libvhdi_region_table_header.c	3
libvhdi/libvhdi/libvhdi_checksum.c	2
libvhdi/libvhdi/libvhdi_region_table_entry.c	3
libvhdi/libvhdi/libvhdi_metadata_values.c	6
libvhdi/libvhdi/libvhdi_metadata_table.c	5
libvhdi/libvhdi/libvhdi_metadata_table_header.c	3
libvhdi/libvhdi/libvhdi_metadata_table_entry.c	3
libvhdi/libvhdi/libvhdi_parent_locator.c	4
libvhdi/libvhdi/libvhdi_parent_locator_header.c	3
libvhdi/libvhdi/libvhdi_parent_locator_entry.c	6
libvhdi/libuna/libuna_utf8_string.c	3
libvhdi/libuna/libuna_unicode_character.c	5
libvhdi/libfguid/libfguid_identifier.c	5
libvhdi/libvhdi/libvhdi_block_allocation_table.c	4
libvhdi/libfdata/libfdata_vector.c	4
libvhdi/libfcache/libfcache_date_time.c	1
libvhdi/libvhdi/libvhdi_block_descriptor.c	6
libvhdi/libvhdi/libvhdi_sector_range_descriptor.c	2
libvhdi/libfdata/libfdata_segments_array.c	2
libvhdi/libfdata/libfdata_range.c	4
libvhdi/libfcache/libfcache_cache.c	3
libvhdi/libcdata/libcdata_list.c	7
libvhdi/libfcache/libfcache_cache_value.c	6
libvhdi/libfdata/libfdata_mapped_range.c	3

Fuzzer: libfmapi_entry_identifier_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	76.1%
gold	[1:9]	1	4.76%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	14.2%
lawngreen	50+	1	4.76%
All colors	21	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfmapi_entry_identifier_initialize	call site: 00011	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:81
0	32	1 : View List ['libcerror_error_set']	0	32	libfmapi_entry_identifier_free	call site: 00019	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:118
0	32	1 : View List ['libcerror_error_set']	0	32	libfmapi_entry_identifier_copy_from_byte_stream	call site: 00017	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:221
0	0	None	0	32	libfmapi_entry_identifier_initialize	call site: 00001	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:45
0	0	None	0	32	libfmapi_entry_identifier_initialize	call site: 00002	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:56
0	0	None	0	32	libfmapi_entry_identifier_initialize	call site: 00010	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:70
0	0	None	0	32	libfmapi_entry_identifier_copy_from_byte_stream	call site: 00013	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:159
0	0	None	0	32	libfmapi_entry_identifier_copy_from_byte_stream	call site: 00014	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:172
0	0	None	0	32	libfmapi_entry_identifier_copy_from_byte_stream	call site: 00016	/src/libfmapi/libfmapi/libfmapi_entry_identifier.c:207

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

5

Reachable functions

10

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfmapi/ossfuzz/entry_identifier_fuzzer.cc	1
libfmapi/libfmapi/libfmapi_entry_identifier.c	3
libfmapi/libcerror/libcerror_error.c	3

Fuzzer: libcaes_crypt_ecb_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	39	81.2%
gold	[1:9]	2	4.16%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	2.08%
lawngreen	50+	6	12.5%
All colors	48	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
85	85	1 : View List ['libcaes_internal_context_set_decryption_key']	85	117	libcaes_context_set_key	call site: 00019	/src/libcaes/libcaes/libcaes_context.c:585
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcaes_context_initialize	call site: 00013	/src/libcaes/libcaes/libcaes_context.c:360
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_context_free	call site: 00033	/src/libcaes/libcaes/libcaes_context.c:406
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_context_set_key	call site: 00020	/src/libcaes/libcaes/libcaes_context.c:587
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_initialize_tables	call site: 00013	/src/libcaes/libcaes/libcaes_context.c:644
0	32	1 : View List ['libcerror_error_set']	0	32	libcaes_internal_context_set_encryption_key	call site: 00022	/src/libcaes/libcaes/libcaes_context.c:1064
0	0	None	0	64	libcaes_crypt_ecb	call site: 00044	/src/libcaes/libcaes/libcaes_context.c:3019
0	0	None	0	64	libcaes_crypt_ecb	call site: 00044	/src/libcaes/libcaes/libcaes_context.c:3107
0	0	None	0	64	libcaes_crypt_ecb	call site: 00045	/src/libcaes/libcaes/libcaes_context.c:3121
0	0	None	0	32	libcaes_context_initialize	call site: 00001	/src/libcaes/libcaes/libcaes_context.c:275
0	0	None	0	32	libcaes_context_initialize	call site: 00002	/src/libcaes/libcaes/libcaes_context.c:286

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

6

Reachable functions

14

Percentage of reachable functions covered

57.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libcaes/ossfuzz/crypt_ecb_fuzzer.cc	1
libcaes/libcaes/libcaes_context.c	7
libcaes/libcerror/libcerror_error.c	3

Fuzzer: libagdb_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	632	70.9%
gold	[1:9]	10	1.12%
yellow	[10:29]	9	1.01%
greenyellow	[30:49]	10	1.12%
lawngreen	50+	230	25.8%
All colors	891	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00153	/src/libqcow/libbfio/libbfio_handle.c:1139
98	230	3 : View List ['libcdata_array_get_number_of_entries', 'libfdata_stream_get_segment_index_at_offset', 'libcerror_error_set']	98	230	libfdata_stream_seek_offset	call site: 00692	/src/libfsfat/libfdata/libfdata_stream.c:2419
75	75	1 : View List ['libfdata_list_calculate_mapped_ranges']	75	551	libfdata_list_get_element_index_at_offset	call site: 00000	/src/libevt/libfdata/libfdata_list.c:3171
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_stream_get_size	call site: 00675	/src/libfsfat/libfdata/libfdata_stream.c:2554
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	243	1 : View List ['libagdb_file_close']	0	499	libagdb_file_free	call site: 00880	/src/libagdb/libagdb/libagdb_file.c:202
0	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	0	147	libfdata_list_append_element_with_mapped_size	call site: 00579	/src/libevt/libfdata/libfdata_list.c:2841
0	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	0	142	libfdata_segments_array_append_segment	call site: 00639	/src/libqcow/libfdata/libfdata_segments_array.c:592
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libagdb_file_initialize	call site: 00084	/src/libagdb/libagdb/libagdb_file.c:136
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	102	3 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_elements']	0	102	libcdata_list_remove_element	call site: 00000	/src/libqcow/libcdata/libcdata_list.c:2819

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

29

Reachable functions

182

Percentage of reachable functions covered

84.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libagdb/ossfuzz/file_fuzzer.cc	1
libagdb/libbfio/libbfio_memory_range.c	2
libagdb/libcerror/libcerror_error.c	3
libagdb/libbfio/libbfio_memory_range_io_handle.c	3
libagdb/libbfio/libbfio_handle.c	10
libagdb/libcdata/libcdata_range_list.c	15
libagdb/libcdata/libcdata_list_element.c	10
libagdb/libcdata/libcdata_range_list_value.c	3
libagdb/libagdb/libagdb_file.c	5
libagdb/libcdata/libcdata_array.c	9
libagdb/libagdb/libagdb_io_handle.c	6
libagdb/libagdb/libagdb_compressed_file_header.c	4
libagdb/libfdata/libfdata_list.c	7
libagdb/libagdb/libagdb_compressed_block.c	4
libagdb/libfdata/libfdata_list_element.c	9
libagdb/libfwnt/libfwnt_lznt1.c	2
libagdb/libfwnt/libfwnt_lzxpress.c	2
libagdb/libfwnt/libfwnt_bit_stream.c	4
libagdb/libfwnt/libfwnt_huffman_tree.c	4
libagdb/libfdata/libfdata_range.c	4
libagdb/libfcache/libfcache_cache.c	3
libagdb/libcdata/libcdata_list.c	7
libagdb/libfcache/libfcache_cache_value.c	6
libagdb/libfdata/libfdata_mapped_range.c	4
libagdb/libfcache/libfcache_date_time.c	1
libagdb/libagdb/libagdb_compressed_blocks_stream.c	1
libagdb/libagdb/libagdb_compressed_blocks_stream_data_handle.c	2
libagdb/libfdata/libfdata_stream.c	8
libagdb/libfdata/libfdata_segments_array.c	2
libagdb/libagdb/libagdb_volume_information.c	4
libagdb/libagdb/libagdb_hash.c	1
libagdb/libagdb/libagdb_file_information.c	4
libagdb/libagdb/libagdb_source_information.c	4

Fuzzer: libftxf_record_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	32	58.1%
gold	[1:9]	2	3.63%
yellow	[10:29]	3	5.45%
greenyellow	[30:49]	3	5.45%
lawngreen	50+	15	27.2%
All colors	55	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libftxf_record_initialize	call site: 00011	/src/libftxf/libftxf/libftxf_record.c:89
0	32	1 : View List ['libcerror_error_set']	0	32	libftxf_record_free	call site: 00053	/src/libftxf/libftxf/libftxf_record.c:126
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfusn_record_initialize	call site: 00029	/src/libfusn/libfusn/libfusn_record.c:86
0	32	1 : View List ['libcerror_error_set']	0	32	libfusn_record_free	call site: 00048	/src/libfusn/libfusn/libfusn_record.c:123
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfusn_record_copy_from_byte_stream	call site: 00041	/src/libfusn/libfusn/libfusn_record.c:479
0	32	1 : View List ['libcerror_error_set']	0	32	libfusn_record_get_size	call site: 00045	/src/libfusn/libfusn/libfusn_record.c:576
0	0	None	0	69	libftxf_internal_record_read_update_journal_entry_list_data	call site: 00026	/src/libftxf/libftxf/libftxf_record.c:336
0	0	None	0	69	libftxf_internal_record_read_update_journal_entry_list_data	call site: 00044	/src/libftxf/libftxf/libftxf_record.c:364
0	0	None	0	32	libftxf_record_initialize	call site: 00001	/src/libftxf/libftxf/libftxf_record.c:53
0	0	None	0	32	libftxf_record_initialize	call site: 00002	/src/libftxf/libftxf/libftxf_record.c:64
0	0	None	0	32	libftxf_record_initialize	call site: 00010	/src/libftxf/libftxf/libftxf_record.c:78

Runtime coverage analysis

Covered functions

10

Functions that are reachable but not covered

5

Reachable functions

15

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libftxf/ossfuzz/record_fuzzer.cc	1
libftxf/libftxf/libftxf_record.c	4
libftxf/libcerror/libcerror_error.c	3
libftxf/libfusn/libfusn_record.c	4

Fuzzer: libvsgpt_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	388	75.1%
gold	[1:9]	3	0.58%
yellow	[10:29]	4	0.77%
greenyellow	[30:49]	2	0.38%
lawngreen	50+	119	23.0%
All colors	516	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00166	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00469	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	186	1 : View List ['libvsgpt_volume_close']	0	463	libvsgpt_volume_free	call site: 00502	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:196
0	123	3 : View List ['libvsgpt_partition_table_header_free', 'libcerror_error_set', 'libvsgpt_boot_record_free']	0	123	libvsgpt_internal_volume_open_read	call site: 00456	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:1117
0	123	3 : View List ['libcerror_error_set', 'libvsgpt_boot_record_free', 'libvsgpt_partition_values_free']	0	123	libvsgpt_internal_volume_read_mbr_partition_entries	call site: 00444	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:2054
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	104	2 : View List ['libvsgpt_partition_table_header_free', 'libcerror_error_set']	0	104	libvsgpt_internal_volume_read_partition_table_headers	call site: 00335	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:1444
0	104	2 : View List ['libvsgpt_partition_table_header_free', 'libcerror_error_set']	0	104	libvsgpt_internal_volume_read_partition_table_headers	call site: 00338	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:1461
0	104	3 : View List ['libvsgpt_partition_entry_free', 'libcerror_error_set', 'libvsgpt_partition_values_free']	0	104	libvsgpt_internal_volume_read_partition_entries	call site: 00386	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:1765
0	99	1 : View List ['libbfio_handle_free']	0	443	libvsgpt_volume_close	call site: 00483	/src/libvsgpt/libvsgpt/libvsgpt_volume.c:898

Runtime coverage analysis

Covered functions

67

Functions that are reachable but not covered

41

Reachable functions

108

Percentage of reachable functions covered

62.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libvsgpt/ossfuzz/volume_fuzzer.cc	1
libvsgpt/libbfio/libbfio_memory_range.c	2
libvsgpt/libcerror/libcerror_error.c	4
libvsgpt/libbfio/libbfio_memory_range_io_handle.c	3
libvsgpt/libbfio/libbfio_handle.c	9
libvsgpt/libcdata/libcdata_range_list.c	15
libvsgpt/libcdata/libcdata_list_element.c	10
libvsgpt/libcdata/libcdata_range_list_value.c	3
libvsgpt/libvsgpt/libvsgpt_volume.c	8
libvsgpt/libvsgpt/libvsgpt_io_handle.c	3
libvsgpt/libcdata/libcdata_array.c	7
libvsgpt/libcthreads/libcthreads_read_write_lock.c	4
libvsgpt/libcerror/libcerror_system.c	2
libvsgpt/libvsgpt/libvsgpt_partition_table_header.c	4
libvsgpt/libvsgpt/libvsgpt_checksum.c	2
libvsgpt/libvsgpt/libvsgpt_partition_entry.c	3
libvsgpt/libvsgpt/libvsgpt_partition_values.c	2
libvsgpt/libvsgpt/libvsgpt_boot_record.c	5
libvsgpt/libvsgpt/libvsgpt_mbr_partition_entry.c	3

Fuzzer: libpff_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1486	67.2%
gold	[1:9]	51	2.30%
yellow	[10:29]	38	1.72%
greenyellow	[30:49]	14	0.63%
lawngreen	50+	620	28.0%
All colors	2209	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
267	363	4 : View List ['free', 'libpff_decompress_data', 'malloc', 'libcerror_error_set']	267	363	libpff_data_block_read_file_io_handle	call site: 00846	/src/libpff/libpff/libpff_data_block.c:831
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00130	/src/libqcow/libbfio/libbfio_handle.c:1139
167	206	3 : View List ['libcdata_btree_get_value_by_value', 'libpff_index_values_list_get_value_by_index', 'libpff_index_value_initialize']	167	370	libpff_descriptors_index_get_index_value_by_identifier	call site: 00713	/src/libpff/libpff/libpff_descriptors_index.c:258
167	206	3 : View List ['libcdata_btree_get_value_by_value', 'libpff_index_values_list_get_value_by_index', 'libpff_index_value_initialize']	167	370	libpff_offsets_index_get_index_value_by_identifier	call site: 00816	/src/libpff/libpff/libpff_offsets_index.c:250
98	230	3 : View List ['libcdata_array_get_number_of_entries', 'libfdata_stream_get_segment_index_at_offset', 'libcerror_error_set']	98	230	libfdata_stream_seek_offset	call site: 01772	/src/libfsfat/libfdata/libfdata_stream.c:2419
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 01156	/src/libqcow/libfcache/libfcache_cache.c:801
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_stream_get_size	call site: 01756	/src/libfsfat/libfdata/libfdata_stream.c:2554
58	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	58	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
36	84	2 : View List ['libpff_record_entry_get_data_size', 'libpff_table_get_record_entry_by_index']	36	4274	libpff_table_read_entry_value	call site: 01679	/src/libpff/libpff/libpff_table.c:9109
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	1163	1 : View List ['libpff_local_descriptors_get_leaf_node_from_node_by_identifier']	0	1405	libpff_local_descriptors_get_leaf_node_from_node_by_identifier	call site: 01610	/src/libpff/libpff/libpff_local_descriptors.c:516
0	343	5 : View List ['libpff_item_values_free', 'libpff_name_to_id_map_entry_free', 'libpff_index_value_free', 'libcdata_list_empty', 'libcerror_error_set']	0	343	libpff_name_to_id_map_read	call site: 02143	/src/libpff/libpff/libpff_name_to_id_map.c:553

Runtime coverage analysis

Covered functions

283

Functions that are reachable but not covered

68

Reachable functions

351

Percentage of reachable functions covered

80.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libpff/ossfuzz/file_fuzzer.cc	1
libpff/libbfio/libbfio_memory_range.c	2
libpff/libcerror/libcerror_error.c	4
libpff/libbfio/libbfio_memory_range_io_handle.c	3
libpff/libbfio/libbfio_handle.c	8
libpff/libcdata/libcdata_range_list.c	15
libpff/libcdata/libcdata_list_element.c	10
libpff/libcdata/libcdata_range_list_value.c	3
libpff/libpff/libpff_file.c	5
libpff/libpff/libpff_io_handle.c	3
libpff/libpff/libpff_file_header.c	4
libpff/libpff/libpff_checksum.c	2
libpff/libpff/libpff_descriptors_index.c	3
libpff/libpff/libpff_index.c	5
libpff/libcdata/libcdata_btree.c	3
libpff/libcdata/libcdata_array.c	10
libpff/libcdata/libcdata_tree_node.c	19
libpff/libcdata/libcdata_btree_values_list.c	1
libpff/libcdata/libcdata_list.c	11
libpff/libpff/libpff_index_values_list.c	3
libpff/libpff/libpff_index_value.c	3
libpff/libpff/libpff_offsets_index.c	3
libpff/libpff/libpff_item_tree.c	7
libpff/libpff/libpff_item_descriptor.c	3
libpff/libpff/libpff_index_node.c	6
libpff/libpff/libpff_block_tree.c	3
libpff/libpff/libpff_block_tree_node.c	6
libpff/libpff/libpff_block_descriptor.c	2
libpff/libpff/libpff_name_to_id_map.c	5
libpff/libcdata/libcdata_btree_node.c	2
libpff/libpff/libpff_item_values.c	3
libpff/libpff/libpff_table.c	33
libpff/libpff/libpff_table_header.c	8
libpff/libpff/libpff_local_descriptors_tree.c	3
libpff/libpff/libpff_local_descriptors.c	4
libpff/libfcache/libfcache_cache.c	4
libpff/libfcache/libfcache_cache_value.c	8
libpff/libpff/libpff_data_block.c	5
libpff/libpff/libpff_compression.c	1
libpff/libpff/libpff_deflate.c	8
libpff/libpff/libpff_bit_stream.c	3
libpff/libpff/libpff_huffman_tree.c	4
libpff/libpff/libpff_data_array.c	3
libpff/libfdata/libfdata_list.c	17
libpff/libpff/libpff_data_array_entry.c	2
libpff/libfdata/libfdata_list_element.c	8
libpff/libfdata/libfdata_range.c	4
libpff/libfdata/libfdata_mapped_range.c	4
libpff/libfcache/libfcache_date_time.c	1
libpff/libpff/libpff_encryption.c	1
libpff/libpff/libpff_table_block_index.c	5
libpff/libpff/libpff_table_index_value.c	2
libpff/libpff/libpff_reference_descriptor.c	2
libpff/libpff/libpff_record_set.c	6
libpff/libpff/libpff_record_entry.c	7
libpff/libpff/libpff_column_definition.c	2
libpff/libpff/libpff_local_descriptors_node.c	5
libpff/libpff/libpff_local_descriptor_value.c	3
libpff/libpff/libpff_descriptor_data_stream.c	3
libpff/libfdata/libfdata_stream.c	8
libpff/libfdata/libfdata_segments_array.c	2
libpff/libpff/libpff_value_type.c	1

Fuzzer: libevtx_record_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	937	63.9%
gold	[1:9]	58	3.95%
yellow	[10:29]	36	2.45%
greenyellow	[30:49]	22	1.50%
lawngreen	50+	413	28.1%
All colors	1466	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00142	/src/libqcow/libbfio/libbfio_handle.c:1139
193	356	5 : View List ['free', 'libbfio_handle_free', 'libbfio_handle_set_open_on_demand', 'libcerror_error_set', 'libbfio_handle_clone']	193	356	libevtx_record_initialize	call site: 01416	/src/libevtx/libevtx/libevtx_record.c:124
115	5946	7 : View List ['free', 'libfwevt_xml_tag_free', 'libfwevt_xml_tag_set_value_type', 'libfvalue_utf16_string_with_index_copy_from_integer', 'libfvalue_string_size_from_integer', 'libfwevt_xml_tag_append_value_data', 'malloc']	115	6394	libfwevt_xml_document_read_character_reference	call site: 00997	/src/libfwevt/libfwevt/libfwevt_xml_document.c:1264
93	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	93	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
72	147	4 : View List ['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']	72	415	libfcache_cache_set_value_by_identifier	call site: 00461	/src/libqcow/libfcache/libfcache_cache.c:801
35	137	4 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element', 'libcdata_list_element_set_elements']	35	137	libcdata_list_remove_element	call site: 00619	/src/libqcow/libcdata/libcdata_list.c:2812
35	102	3 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element']	35	102	libcdata_list_prepend_element	call site: 00489	/src/libqcow/libcdata/libcdata_list.c:1314
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	58993	13 : View List ['libfwevt_xml_document_read_element', 'libfwevt_xml_document_read_attribute', 'libfwevt_xml_document_read_optional_substitution', 'libfwevt_xml_document_read_pi_target', 'libfwevt_xml_document_read_value', 'libfwevt_xml_tag_append_element', 'libfwevt_xml_document_read_cdata_section', 'libfwevt_xml_token_read_data', 'libfwevt_xml_document_read_entity_reference', 'libfwevt_xml_document_read_name', 'libfwevt_xml_document_read_character_reference', 'libfwevt_xml_tag_initialize', 'libfwevt_xml_document_read_normal_substitution']	0	60367	libfwevt_xml_document_read_element	call site: 00808	/src/libfwevt/libfwevt/libfwevt_xml_document.c:2274
0	58993	13 : View List ['libfwevt_xml_document_read_element', 'libfwevt_xml_document_read_attribute', 'libfwevt_xml_document_read_optional_substitution', 'libfwevt_xml_document_read_pi_target', 'libfwevt_xml_document_read_value', 'libfwevt_xml_tag_append_element', 'libfwevt_xml_document_read_cdata_section', 'libfwevt_xml_token_read_data', 'libfwevt_xml_document_read_entity_reference', 'libfwevt_xml_document_read_name', 'libfwevt_xml_document_read_character_reference', 'libfwevt_xml_tag_initialize', 'libfwevt_xml_document_read_normal_substitution']	0	60367	libfwevt_xml_document_read_element	call site: 00808	/src/libfwevt/libfwevt/libfwevt_xml_document.c:2306
0	205	3 : View List ['libbfio_handle_free', 'libcerror_error_set', 'libbfio_handle_close']	0	205	libevtx_record_free	call site: 01440	/src/libevtx/libevtx/libevtx_record.c:213
0	204	1 : View List ['libevtx_file_close']	0	304	libevtx_file_free	call site: 01462	/src/libevtx/libevtx/libevtx_file.c:178

Runtime coverage analysis

Covered functions

209

Functions that are reachable but not covered

362

Reachable functions

571

Percentage of reachable functions covered

36.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libevtx/ossfuzz/record_fuzzer.cc	1
libevtx/libbfio/libbfio_memory_range.c	2
libevtx/libcerror/libcerror_error.c	4
libevtx/libbfio/libbfio_memory_range_io_handle.c	3
libevtx/libbfio/libbfio_handle.c	12
libevtx/libcdata/libcdata_range_list.c	15
libevtx/libcdata/libcdata_list_element.c	10
libevtx/libcdata/libcdata_range_list_value.c	3
libevtx/libevtx/libevtx_file.c	7
libevtx/libevtx/libevtx_io_handle.c	5
libevtx/libevtx/libevtx_i18n.c	1
libevtx/libevtx/libevtx_checksum.c	2
libevtx/libfdata/libfdata_vector.c	5
libevtx/libcdata/libcdata_array.c	10
libevtx/libfcache/libfcache_date_time.c	1
libevtx/libevtx/libevtx_chunk.c	7
libevtx/libevtx/libevtx_byte_stream.c	1
libevtx/libevtx/libevtx_record_values.c	5
libevtx/libfwevt/libfwevt_xml_document.c	20
libevtx/libfwevt/libfwevt_xml_tag.c	14
libevtx/libfvalue/libfvalue_value.c	12
libevtx/libfvalue/libfvalue_data_handle.c	9
libevtx/libfvalue/libfvalue_value_entry.c	2
libevtx/libfdata/libfdata_segments_array.c	2
libevtx/libfdata/libfdata_range.c	5
libevtx/libfcache/libfcache_cache.c	4
libevtx/libcdata/libcdata_list.c	9
libevtx/libfcache/libfcache_cache_value.c	8
libevtx/libfdata/libfdata_mapped_range.c	3
libevtx/libevtx/libevtx_chunks_table.c	3
libevtx/libfdata/libfdata_list.c	7
libevtx/libfwevt/libfwevt_xml_token.c	3
libevtx/libfvalue/libfvalue_value_type.c	5
libevtx/libfvalue/libfvalue_binary_data.c	1
libevtx/libfvalue/libfvalue_floating_point.c	1
libevtx/libfvalue/libfvalue_integer.c	3
libevtx/libfvalue/libfvalue_string.c	1
libevtx/libfdatetime/libfdatetime_fat_date_time.c	1
libevtx/libfdatetime/libfdatetime_filetime.c	2
libevtx/libfvalue/libfvalue_filetime.c	1
libevtx/libfdatetime/libfdatetime_floatingtime.c	1
libevtx/libfdatetime/libfdatetime_nsf_timedate.c	1
libevtx/libfdatetime/libfdatetime_posix_time.c	2
libevtx/libfdatetime/libfdatetime_systemtime.c	1
libevtx/libfguid/libfguid_identifier.c	1
libevtx/libfwnt/libfwnt_security_identifier.c	1
libevtx/libfwevt/libfwevt_xml_template_value.c	9
libevtx/libfdata/libfdata_list_element.c	7
libevtx/libevtx/libevtx_record.c	2

Fuzzer: libolecf_item_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	467	64.1%
gold	[1:9]	13	1.78%
yellow	[10:29]	18	2.47%
greenyellow	[30:49]	11	1.51%
lawngreen	50+	219	30.0%
All colors	728	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	406	6 : View List ['libcdata_range_list_free', 'libcdata_tree_node_free', 'libcdata_list_free', 'libolecf_allocation_table_free', 'libolecf_file_header_free', 'libcerror_error_set']	0	406	libolecf_file_open_read	call site: 00647	/src/libolecf/libolecf/libolecf_file.c:1126
0	264	1 : View List ['libcdata_range_list_insert_range']	0	360	libbfio_internal_handle_read_buffer	call site: 00139	/src/libqcow/libbfio/libbfio_handle.c:1139
0	215	6 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcdata_list_element_set_elements', 'libcdata_range_list_value_free', 'libcerror_error_set']	0	215	libcdata_internal_range_list_insert_range_before_element	call site: 00197	/src/libqcow/libcdata/libcdata_range_list.c:1813
0	214	4 : View List ['libcdata_range_list_free', 'libcdata_list_empty', 'libcerror_error_set', 'libolecf_directory_entry_free']	0	214	libolecf_io_handle_read_directory_entries	call site: 00415	/src/libolecf/libolecf/libolecf_io_handle.c:1361
0	176	1 : View List ['libolecf_file_close']	0	276	libolecf_file_free	call site: 00723	/src/libolecf/libolecf/libolecf_file.c:157
0	137	4 : View List ['libcdata_tree_node_set_previous_node', 'libcerror_error_set', 'libcdata_tree_node_set_next_node', 'libcdata_tree_node_set_nodes']	0	137	libcdata_internal_tree_node_insert_node_before_sub_node	call site: 00582	/src/libfsntfs/libcdata/libcdata_tree_node.c:2697
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	102	3 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element']	0	102	libcdata_internal_range_list_set_last_element	call site: 00203	/src/libqcow/libcdata/libcdata_range_list.c:1002
0	102	3 : View List ['libcdata_tree_node_set_previous_node', 'libcerror_error_set', 'libcdata_tree_node_set_next_node']	0	102	libcdata_internal_tree_node_set_last_sub_node	call site: 00569	/src/libfsntfs/libcdata/libcdata_tree_node.c:1692
0	99	1 : View List ['libbfio_handle_free']	0	631	libolecf_file_close	call site: 00702	/src/libolecf/libolecf/libolecf_file.c:685
0	84	1 : View List ['libcdata_range_list_free']	0	374	libolecf_file_open_read	call site: 00647	/src/libolecf/libolecf/libolecf_file.c:1143

Runtime coverage analysis

Covered functions

111

Functions that are reachable but not covered

11

Reachable functions

122

Percentage of reachable functions covered

90.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libolecf/ossfuzz/item_fuzzer.cc	1
libolecf/libbfio/libbfio_memory_range.c	2
libolecf/libcerror/libcerror_error.c	3
libolecf/libbfio/libbfio_memory_range_io_handle.c	3
libolecf/libbfio/libbfio_handle.c	8
libolecf/libcdata/libcdata_range_list.c	16
libolecf/libcdata/libcdata_list_element.c	10
libolecf/libcdata/libcdata_range_list_value.c	3
libolecf/libolecf/libolecf_file.c	6
libolecf/libolecf/libolecf_io_handle.c	7
libolecf/libolecf/libolecf_file_header.c	4
libolecf/libolecf/libolecf_allocation_table.c	4
libolecf/libcdata/libcdata_list.c	7
libolecf/libolecf/libolecf_directory_entry.c	5
libolecf/libolecf/libolecf_directory_tree.c	2
libolecf/libcdata/libcdata_tree_node.c	19
libolecf/libuna/libuna_utf8_string.c	1
libolecf/libuna/libuna_unicode_character.c	3
libolecf/libolecf/libolecf_directory_list.c	1
libolecf/libolecf/libolecf_item.c	4

Fuzzer: libwrc_string_table_resource_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	59	76.6%
gold	[1:9]	1	1.29%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	22.0%
All colors	77	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00054	/src/libfplist/libcdata/libcdata_array.c:823
0	37	1 : View List ['libwrc_table_entry_free']	0	81	libwrc_string_table_resource_read	call site: 00058	/src/libwrc/libwrc/libwrc_string_table_resource.c:346
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00021	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00073	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_empty	call site: 00063	/src/libfplist/libcdata/libcdata_array.c:328
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_internal_array_resize	call site: 00053	/src/libfplist/libcdata/libcdata_array.c:797
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_append_entry	call site: 00047	/src/libfplist/libcdata/libcdata_array.c:1609
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libwrc_string_table_resource_initialize	call site: 00013	/src/libwrc/libwrc/libwrc_string_table_resource.c:98
0	32	1 : View List ['libcerror_error_set']	0	32	libwrc_string_table_resource_free	call site: 00075	/src/libwrc/libwrc/libwrc_string_table_resource.c:152
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libwrc_table_entry_initialize	call site: 00032	/src/libwrc/libwrc/libwrc_table_entry.c:76
0	32	1 : View List ['libcerror_error_set']	0	32	libwrc_table_entry_free	call site: 00059	/src/libwrc/libwrc/libwrc_table_entry.c:112

Runtime coverage analysis

Covered functions

14

Functions that are reachable but not covered

5

Reachable functions

19

Percentage of reachable functions covered

73.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libwrc/ossfuzz/string_table_resource_fuzzer.cc	1
libwrc/libwrc/libwrc_string_table_resource.c	3
libwrc/libcerror/libcerror_error.c	3
libwrc/libcdata/libcdata_array.c	6
libwrc/libwrc/libwrc_table_entry.c	3

Fuzzer: libphdi_handle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	772	85.8%
gold	[1:9]	21	2.33%
yellow	[10:29]	8	0.88%
greenyellow	[30:49]	2	0.22%
lawngreen	50+	96	10.6%
All colors	899	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
317	317	1 : View List ['libphdi_handle_close']	317	823	libphdi_handle_free	call site: 00883	/src/libphdi/libphdi/libphdi_handle.c:288
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00197	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
147	147	1 : View List ['libphdi_snapshot_values_free']	147	191	libphdi_disk_descriptor_xml_file_get_snapshots	call site: 00764	/src/libphdi/libphdi/libphdi_disk_descriptor_xml_file.c:2067
94	94	1 : View List ['libfcache_cache_free']	158	195	libphdi_internal_handle_open_read	call site: 00789	/src/libphdi/libphdi/libphdi_handle.c:2372
85	85	8 : View List ['getc', 'fread', 'ferror', '__errno_location', 'libfplist_xml_scanner_realloc', 'yy_fatal_error', 'libfplist_xml_scanner_restart', 'clearerr']	85	85	yy_get_next_buffer	call site: 00383	/src/libfplist/libfplist/libfplist_xml_scanner.c:158629
83	178	4 : View List ['libcdata_array_get_entry_by_index', 'libcdata_array_append_entry', 'libphdi_extent_values_get_image_values_by_index', 'libphdi_extent_values_get_number_of_images']	241	598	libphdi_internal_handle_open_read	call site: 00774	/src/libphdi/libphdi/libphdi_handle.c:2267
64	64	1 : View List ['libfdata_vector_free']	64	101	libphdi_internal_handle_open_read	call site: 00790	/src/libphdi/libphdi/libphdi_handle.c:2378
56	56	1 : View List ['libphdi_extent_values_free']	56	100	libphdi_disk_descriptor_xml_file_get_storage_data	call site: 00682	/src/libphdi/libphdi/libphdi_disk_descriptor_xml_file.c:1798
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00802	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
42	42	1 : View List ['libbfio_handle_close']	42	74	libphdi_handle_open_file_io_handle	call site: 00141	/src/libphdi/libphdi/libphdi_handle.c:1117
37	37	1 : View List ['libphdi_image_values_free']	93	137	libphdi_disk_descriptor_xml_file_get_storage_data	call site: 00681	/src/libphdi/libphdi/libphdi_disk_descriptor_xml_file.c:1792

Runtime coverage analysis

Covered functions

85

Functions that are reachable but not covered

99

Reachable functions

184

Percentage of reachable functions covered

46.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libphdi/ossfuzz/handle_fuzzer.cc	1
libphdi/libbfio/libbfio_memory_range.c	2
libphdi/libcerror/libcerror_error.c	3
libphdi/libbfio/libbfio_memory_range_io_handle.c	3
libphdi/libbfio/libbfio_handle.c	9
libphdi/libcdata/libcdata_range_list.c	15
libphdi/libcdata/libcdata_list_element.c	10
libphdi/libcdata/libcdata_range_list_value.c	3
libphdi/libphdi/libphdi_handle.c	5
libphdi/libphdi/libphdi_io_handle.c	3
libphdi/libcdata/libcdata_array.c	8
libphdi/libphdi/libphdi_data_files.c	3
libphdi/libphdi/libphdi_i18n.c	1
libphdi/libcthreads/libcthreads_read_write_lock.c	4
libphdi/libcerror/libcerror_system.c	2
libphdi/libphdi/libphdi_disk_descriptor_xml_file.c	9
libphdi/libphdi/libphdi_xml_parser.c	3
libphdi/libphdi/libphdi_xml_scanner.c	17
libphdi/libphdi/libphdi_xml_scanner.l	5
libphdi/libphdi/libphdi_xml_tag.c	8
libphdi/libphdi/libphdi_xml_attribute.c	2
libphdi/libphdi/libphdi_disk_parameters.c	3
libphdi/libfvalue/libfvalue_integer.c	2
libphdi/libphdi/libphdi_extent_values.c	5
libphdi/libphdi/libphdi_image_values.c	4
libphdi/libphdi/libphdi_uuid_string.c	1
libphdi/libfguid/libfguid_identifier.c	5
libphdi/libphdi/libphdi_snapshot_values.c	4
libphdi/libphdi/libphdi_extent_table.c	3
libphdi/libfdata/libfdata_stream.c	1
libphdi/libfdata/libfdata_range.c	1
libphdi/libfdata/libfdata_mapped_range.c	1
libphdi/libfdata/libfdata_list.c	1
libphdi/libfdata/libfdata_list_element.c	1
libphdi/libfcache/libfcache_cache.c	1
libphdi/libcdata/libcdata_list.c	3
libphdi/libfcache/libfcache_cache_value.c	1
libphdi/libfdata/libfdata_vector.c	1
libphdi/libbfio/libbfio_pool.c	3

Fuzzer: libfwevt_manifest_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	229	51.5%
gold	[1:9]	19	4.27%
yellow	[10:29]	9	2.02%
greenyellow	[30:49]	12	2.70%
lawngreen	50+	175	39.4%
All colors	444	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	354	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	354	libfwevt_provider_initialize	call site: 00052	/src/libfwevt/libfwevt/libfwevt_provider.c:245
0	78	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	78	libfwevt_template_initialize	call site: 00321	/src/libevtx/libfwevt/libfwevt_template.c:116
0	64	1 : View List ['libcerror_error_set']	0	64	libcdata_internal_array_resize	call site: 00091	/src/libfplist/libcdata/libcdata_array.c:823
0	36	1 : View List ['libfwevt_xml_template_value_free']	36	160	libfwevt_template_read_template_items	call site: 00384	/src/libevtx/libfwevt/libfwevt_template.c:960
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libcdata_array_initialize	call site: 00021	/src/libfplist/libcdata/libcdata_array.c:162
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_free	call site: 00056	/src/libfplist/libcdata/libcdata_array.c:260
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_empty	call site: 00138	/src/libfplist/libcdata/libcdata_array.c:328
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_internal_array_resize	call site: 00090	/src/libfplist/libcdata/libcdata_array.c:797
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_get_entry_by_index	call site: 00099	/src/libfplist/libcdata/libcdata_array.c:1146
0	32	1 : View List ['libcerror_error_set']	0	32	libcdata_array_append_entry	call site: 00084	/src/libfplist/libcdata/libcdata_array.c:1609
0	32	2 : View List ['free', 'libcerror_error_set']	0	32	libfwevt_channel_initialize	call site: 00115	/src/libfwevt/libfwevt/libfwevt_channel.c:86

Runtime coverage analysis

Covered functions

59

Functions that are reachable but not covered

6

Reachable functions

65

Percentage of reachable functions covered

90.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfwevt/ossfuzz/manifest_fuzzer.cc	1
libfwevt/libfwevt/libfwevt_manifest.c	3
libfwevt/libcerror/libcerror_error.c	3
libfwevt/libcdata/libcdata_array.c	7
libfwevt/libfwevt/libfwevt_provider.c	11
libfwevt/libfwevt/libfwevt_channel.c	3
libfwevt/libfwevt/libfwevt_event.c	3
libfwevt/libfwevt/libfwevt_keyword.c	3
libfwevt/libfwevt/libfwevt_level.c	3
libfwevt/libfwevt/libfwevt_map.c	3
libfwevt/libfwevt/libfwevt_opcode.c	3
libfwevt/libfwevt/libfwevt_task.c	3
libfwevt/libfwevt/libfwevt_template.c	6
libfwevt/libfwevt/libfwevt_template_item.c	3
libfwevt/libfwevt/libfwevt_xml_template_value.c	6

Fuzzer: libmsiecf_item_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	509	70.2%
gold	[1:9]	7	0.96%
yellow	[10:29]	14	1.93%
greenyellow	[30:49]	6	0.82%
lawngreen	50+	189	26.0%
All colors	725	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
172	172	1 : View List ['libcdata_internal_range_list_insert_range_merge']	172	288	libcdata_range_list_insert_range	call site: 00185	/src/libqcow/libcdata/libcdata_range_list.c:2898
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00477	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00455	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
41	141	3 : View List ['libcdata_list_element_get_value', 'libcerror_error_set', 'libcdata_range_list_value_check_range_overlap']	41	141	libcdata_internal_range_list_check_range_overlap	call site: 00179	/src/libqcow/libcdata/libcdata_range_list.c:1651
35	215	6 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcdata_list_element_set_elements', 'libcdata_range_list_value_free', 'libcerror_error_set']	35	215	libcdata_internal_range_list_insert_range_before_element	call site: 00207	/src/libqcow/libcdata/libcdata_range_list.c:1813
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	436	4 : View List ['libcdata_list_element_get_value', 'libcdata_list_element_get_next_element', 'libcdata_list_element_get_previous_element', 'libcerror_error_set']	0	436	libcdata_internal_range_list_insert_range_find_element	call site: 00161	/src/libqcow/libcdata/libcdata_range_list.c:1453
0	264	1 : View List ['libcdata_range_list_insert_range']	0	360	libbfio_internal_handle_read_buffer	call site: 00147	/src/libqcow/libbfio/libbfio_handle.c:1139
0	205	1 : View List ['libmsiecf_file_close']	0	404	libmsiecf_file_free	call site: 00719	/src/libmsiecf/libmsiecf/libmsiecf_file.c:183
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	102	3 : View List ['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element']	0	102	libcdata_internal_range_list_set_last_element	call site: 00213	/src/libqcow/libcdata/libcdata_range_list.c:1002
0	99	1 : View List ['libbfio_handle_free']	0	726	libmsiecf_file_close	call site: 00698	/src/libmsiecf/libmsiecf/libmsiecf_file.c:876

Runtime coverage analysis

Covered functions

111

Functions that are reachable but not covered

360

Reachable functions

468

Percentage of reachable functions covered

23.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libmsiecf/ossfuzz/item_fuzzer.cc	1
libmsiecf/libbfio/libbfio_memory_range.c	2
libmsiecf/libcerror/libcerror_error.c	3
libmsiecf/libbfio/libbfio_memory_range_io_handle.c	3
libmsiecf/libbfio/libbfio_handle.c	9
libmsiecf/libcdata/libcdata_range_list.c	18
libmsiecf/libcdata/libcdata_list_element.c	10
libmsiecf/libcdata/libcdata_range_list_value.c	3
libmsiecf/libmsiecf/libmsiecf_file.c	7
libmsiecf/libmsiecf/libmsiecf_io_handle.c	5
libmsiecf/libcthreads/libcthreads_read_write_lock.c	6
libmsiecf/libcerror/libcerror_system.c	2
libmsiecf/libmsiecf/libmsiecf_file_header.c	4
libmsiecf/libmsiecf/libmsiecf_cache_directory_table.c	4
libmsiecf/libcdata/libcdata_array.c	8
libmsiecf/libmsiecf/libmsiecf_directory_descriptor.c	3
libmsiecf/libmsiecf/libmsiecf_allocation_table.c	1
libmsiecf/libmsiecf/libmsiecf_hash_table.c	1
libmsiecf/libmsiecf/libmsiecf_item_descriptor.c	2
libmsiecf/libmsiecf/libmsiecf_item.c	3
libmsiecf/libmsiecf/libmsiecf_leak_values.c	3
libmsiecf/libmsiecf/libmsiecf_redirected_values.c	3
libmsiecf/libmsiecf/libmsiecf_url_values.c	3
libmsiecf/libfvalue/libfvalue_value_type.c	5
libmsiecf/libfvalue/libfvalue_value.c	4
libmsiecf/libfvalue/libfvalue_data_handle.c	4
libmsiecf/libfvalue/libfvalue_binary_data.c	1
libmsiecf/libfvalue/libfvalue_floating_point.c	1
libmsiecf/libfvalue/libfvalue_integer.c	1
libmsiecf/libfvalue/libfvalue_string.c	1
libmsiecf/libfdatetime/libfdatetime_fat_date_time.c	1
libmsiecf/libfdatetime/libfdatetime_filetime.c	2
libmsiecf/libfvalue/libfvalue_filetime.c	1
libmsiecf/libfdatetime/libfdatetime_floatingtime.c	1
libmsiecf/libfdatetime/libfdatetime_nsf_timedate.c	1
libmsiecf/libfdatetime/libfdatetime_posix_time.c	2
libmsiecf/libfdatetime/libfdatetime_systemtime.c	1
libmsiecf/libfguid/libfguid_identifier.c	1
libmsiecf/libfvalue/libfvalue_value_entry.c	1

Fuzzer: libfsxfs_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	397	76.0%
gold	[1:9]	8	1.53%
yellow	[10:29]	6	1.14%
greenyellow	[30:49]	6	1.14%
lawngreen	50+	105	20.1%
All colors	522	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00145	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 00424	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 00403	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	206	1 : View List ['libfsxfs_volume_close']	0	405	libfsxfs_volume_free	call site: 00515	/src/libfsxfs/libfsxfs/libfsxfs_volume.c:180
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140
0	99	1 : View List ['libbfio_handle_free']	0	495	libfsxfs_volume_close	call site: 00498	/src/libfsxfs/libfsxfs/libfsxfs_volume.c:869
0	87	3 : View List ['free', 'libcerror_error_set', 'libfsxfs_inode_btree_free']	0	87	libfsxfs_file_system_initialize	call site: 00328	/src/libfsxfs/libfsxfs/libfsxfs_file_system.c:119
0	74	2 : View List ['libcerror_error_set', 'libbfio_handle_close']	0	74	libfsxfs_volume_open_file_io_handle	call site: 00402	/src/libfsxfs/libfsxfs/libfsxfs_volume.c:752
0	68	2 : View List ['libcerror_error_set', 'libbfio_memory_range_io_handle_free']	0	68	libbfio_memory_range_initialize	call site: 00059	/src/libqcow/libbfio/libbfio_memory_range.c:83
0	68	2 : View List ['libfsxfs_inode_information_free', 'libcerror_error_set']	0	68	libfsxfs_inode_btree_read_inode_information	call site: 00364	/src/libfsxfs/libfsxfs/libfsxfs_inode_btree.c:231

Runtime coverage analysis

Covered functions

67

Functions that are reachable but not covered

43

Reachable functions

110

Percentage of reachable functions covered

60.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsxfs/ossfuzz/volume_fuzzer.cc	1
libfsxfs/libbfio/libbfio_memory_range.c	2
libfsxfs/libcerror/libcerror_error.c	3
libfsxfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsxfs/libbfio/libbfio_handle.c	8
libfsxfs/libcdata/libcdata_range_list.c	15
libfsxfs/libcdata/libcdata_list_element.c	10
libfsxfs/libcdata/libcdata_range_list_value.c	3
libfsxfs/libfsxfs/libfsxfs_volume.c	8
libfsxfs/libfsxfs/libfsxfs_io_handle.c	3
libfsxfs/libcthreads/libcthreads_read_write_lock.c	6
libfsxfs/libcerror/libcerror_system.c	2
libfsxfs/libfsxfs/libfsxfs_superblock.c	6
libfsxfs/libfsxfs/libfsxfs_file_system.c	3
libfsxfs/libfsxfs/libfsxfs_inode_btree.c	3
libfsxfs/libcdata/libcdata_array.c	5
libfsxfs/libfsxfs/libfsxfs_inode_information.c	4
libfsxfs/libuna/libuna_utf8_string.c	3
libfsxfs/libuna/libuna_unicode_character.c	3

Fuzzer: libevtx_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1259	89.2%
gold	[1:9]	2	0.14%
yellow	[10:29]	5	0.35%
greenyellow	[30:49]	2	0.14%
lawngreen	50+	142	10.0%
All colors	1410	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
264	264	1 : View List ['libcdata_range_list_insert_range']	264	360	libbfio_internal_handle_read_buffer	call site: 00142	/src/libqcow/libbfio/libbfio_handle.c:1139
164	292	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']	164	292	libcdata_range_list_empty	call site: 00030	/src/libqcow/libcdata/libcdata_range_list.c:326
146	274	5 : View List ['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']	146	274	libcdata_list_empty	call site: 01352	/src/libqcow/libcdata/libcdata_list.c:238
103	135	2 : View List ['libfwevt_xml_document_free', 'libcerror_error_set']	103	135	libevtx_record_values_free	call site: 00393	/src/libevtx/libevtx/libevtx_record_values.c:172
38	147	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']	38	147	libfdata_list_append_element	call site: 01327	/src/libevt/libfdata/libfdata_list.c:1489
38	142	4 : View List ['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']	38	142	libfdata_segments_array_append_segment	call site: 00546	/src/libqcow/libfdata/libfdata_segments_array.c:592
38	38	1 : View List ['libcdata_array_set_entry_by_index']	38	74	libfdata_segments_array_append_segment	call site: 00547	/src/libqcow/libfdata/libfdata_segments_array.c:642
16	16	5 : View List ['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']	16	16	libcerror_error_set	call site: 00002	/src/libcaes/libcerror/libcerror_error.c:328
0	204	1 : View List ['libevtx_file_close']	0	304	libevtx_file_free	call site: 01406	/src/libevtx/libevtx/libevtx_file.c:178
0	145	3 : View List ['free', 'libcerror_error_set', 'libevtx_record_values_free']	0	145	libevtx_chunk_read	call site: 00388	/src/libevtx/libevtx/libevtx_chunk.c:922
0	124	3 : View List ['free', 'libcdata_array_free', 'libcerror_error_set']	0	124	libfdata_vector_initialize	call site: 00310	/src/libqcow/libfdata/libfdata_vector.c:180
0	116	3 : View List ['free', 'libcerror_error_set', 'libcdata_range_list_free']	0	116	libbfio_handle_initialize	call site: 00022	/src/libqcow/libbfio/libbfio_handle.c:140

Runtime coverage analysis

Covered functions

81

Functions that are reachable but not covered

480

Reachable functions

561

Percentage of reachable functions covered

14.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libevtx/ossfuzz/file_fuzzer.cc	1
libevtx/libbfio/libbfio_memory_range.c	2
libevtx/libcerror/libcerror_error.c	4
libevtx/libbfio/libbfio_memory_range_io_handle.c	3
libevtx/libbfio/libbfio_handle.c	9
libevtx/libcdata/libcdata_range_list.c	15
libevtx/libcdata/libcdata_list_element.c	10
libevtx/libcdata/libcdata_range_list_value.c	3
libevtx/libevtx/libevtx_file.c	5
libevtx/libevtx/libevtx_io_handle.c	5
libevtx/libevtx/libevtx_i18n.c	1
libevtx/libevtx/libevtx_checksum.c	2
libevtx/libfdata/libfdata_vector.c	5
libevtx/libcdata/libcdata_array.c	10
libevtx/libfcache/libfcache_date_time.c	1
libevtx/libevtx/libevtx_chunk.c	7
libevtx/libevtx/libevtx_byte_stream.c	1
libevtx/libevtx/libevtx_record_values.c	5
libevtx/libfwevt/libfwevt_xml_document.c	20
libevtx/libfwevt/libfwevt_xml_tag.c	14
libevtx/libfvalue/libfvalue_value.c	12
libevtx/libfvalue/libfvalue_data_handle.c	9
libevtx/libfvalue/libfvalue_value_entry.c	2
libevtx/libfdata/libfdata_segments_array.c	2
libevtx/libfdata/libfdata_range.c	5
libevtx/libfcache/libfcache_cache.c	4
libevtx/libcdata/libcdata_list.c	9
libevtx/libfcache/libfcache_cache_value.c	8
libevtx/libfdata/libfdata_mapped_range.c	3
libevtx/libevtx/libevtx_chunks_table.c	3
libevtx/libfdata/libfdata_list.c	4
libevtx/libfwevt/libfwevt_xml_token.c	3
libevtx/libfvalue/libfvalue_value_type.c	5
libevtx/libfvalue/libfvalue_binary_data.c	1
libevtx/libfvalue/libfvalue_floating_point.c	1
libevtx/libfvalue/libfvalue_integer.c	3
libevtx/libfvalue/libfvalue_string.c	1
libevtx/libfdatetime/libfdatetime_fat_date_time.c	1
libevtx/libfdatetime/libfdatetime_filetime.c	2
libevtx/libfvalue/libfvalue_filetime.c	1
libevtx/libfdatetime/libfdatetime_floatingtime.c	1
libevtx/libfdatetime/libfdatetime_nsf_timedate.c	1
libevtx/libfdatetime/libfdatetime_posix_time.c	2
libevtx/libfdatetime/libfdatetime_systemtime.c	1
libevtx/libfguid/libfguid_identifier.c	1
libevtx/libfwnt/libfwnt_security_identifier.c	1
libevtx/libfwevt/libfwevt_xml_template_value.c	9
libevtx/libfdata/libfdata_list_element.c	7

Fuzzer: libfsntfs_file_entry_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1518	61.6%
gold	[1:9]	72	2.92%
yellow	[10:29]	35	1.42%
greenyellow	[30:49]	54	2.19%
lawngreen	50+	783	31.8%
All colors	2462	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2245	2245	2 : View List ['libfsntfs_reparse_point_attribute_get_compression_method', 'libfsntfs_internal_file_entry_get_reparse_point_attribute']	2245	4646	libfsntfs_file_entry_initialize	call site: 01866	/src/libfsntfs/libfsntfs/libfsntfs_file_entry.c:234
676	772	3 : View List ['libfsntfs_cluster_block_stream_initialize_from_compressed_stream', 'libfdata_stream_free', 'libcerror_error_set']	676	772	libfsntfs_cluster_block_stream_initialize	call site: 01241	/src/libfsntfs/libfsntfs/libfsntfs_cluster_block_stream.c:945
259	469	2 : View List ['libcdata_btree_node_split', 'libcdata_btree_node_get_sub_node_by_value']	259	653	libcdata_btree_insert_value	call site: 02061	/src/libfsntfs/libcdata/libcdata_btree.c:591
82	82	1 : View List ['libfsntfs_internal_attribute_free']	82	580	libfsntfs_volume_close	call site: 02448	/src/libfsntfs/libfsntfs/libfsntfs_volume.c:957
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_stream_get_size	call site: 01286	/src/libfsfat/libfdata/libfdata_stream.c:2554
63	95	2 : View List ['libfdata_segments_array_calculate_mapped_ranges', 'libcerror_error_set']	63	95	libfdata_vector_get_size	call site: 01225	/src/libqcow/libfdata/libfdata_vector.c:1910
63	63	1 : View List ['libfdata_segments_array_calculate_mapped_ranges']	63	539	libfdata_stream_get_segment_index_at_offset	call site: 00986	/src/libfsfat/libfdata/libfdata_stream.c:1085
63	63	1 : View List ['libfdata_segments_array_calculate_mapped_ranges']	63	539	libfdata_vector_get_element_index_at_offset	call site: 01914	/src/libqcow/libfdata/libfdata_vector.c:1078
53	53	1 : View List ['libcdata_tree_node_get_sub_node_by_index']	89	385	libcdata_btree_node_get_sub_node_by_value	call site: 01472	/src/libfsntfs/libcdata/libcdata_btree_node.c:193
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_read	call site: 02372	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46	46	1 : View List ['libcerror_system_set_error']	46	46	libcthreads_read_write_lock_release_for_write	call site: 01837	/src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
40	40	1 : View List ['libbfio_handle_get_size']	40	4754	libfsntfs_file_system_read_mft	call site: 00655	/src/libfsntfs/libfsntfs/libfsntfs_file_system.c:391

Runtime coverage analysis

Covered functions

369

Functions that are reachable but not covered

99

Reachable functions

468

Percentage of reachable functions covered

78.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libfsntfs/ossfuzz/file_entry_fuzzer.cc	1
libfsntfs/libbfio/libbfio_memory_range.c	2
libfsntfs/libcerror/libcerror_error.c	3
libfsntfs/libbfio/libbfio_memory_range_io_handle.c	3
libfsntfs/libbfio/libbfio_handle.c	10
libfsntfs/libcdata/libcdata_range_list.c	16
libfsntfs/libcdata/libcdata_list_element.c	10
libfsntfs/libcdata/libcdata_range_list_value.c	3
libfsntfs/libfsntfs/libfsntfs_volume.c	6
libfsntfs/libfsntfs/libfsntfs_io_handle.c	3
libfsntfs/libcthreads/libcthreads_read_write_lock.c	6
libfsntfs/libcerror/libcerror_system.c	2
libfsntfs/libfsntfs/libfsntfs_volume_header.c	9
libfsntfs/libfsntfs/libfsntfs_file_system.c	5
libfsntfs/libfsntfs/libfsntfs_mft_entry.c	19
libfsntfs/libcdata/libcdata_array.c	11
libfsntfs/libfsntfs/libfsntfs_mft_entry_header.c	7
libfsntfs/libfsntfs/libfsntfs_fixup_values.c	1
libfsntfs/libfsntfs/libfsntfs_mft_attribute.c	21
libfsntfs/libfsntfs/libfsntfs_data_run.c	3
libfsntfs/libuna/libuna_utf8_string.c	4
libfsntfs/libuna/libuna_unicode_character.c	7
libfsntfs/libfsntfs/libfsntfs_name.c	1
libfsntfs/libfsntfs/libfsntfs_mft.c	4
libfsntfs/libfdata/libfdata_vector.c	11
libfsntfs/libfcache/libfcache_date_time.c	1
libfsntfs/libfdata/libfdata_segments_array.c	4
libfsntfs/libfdata/libfdata_range.c	5
libfsntfs/libfcache/libfcache_cache.c	5
libfsntfs/libcdata/libcdata_list.c	17
libfsntfs/libfcache/libfcache_cache_value.c	9
libfsntfs/libfsntfs/libfsntfs_mft_attribute_list.c	11
libfsntfs/libfsntfs/libfsntfs_mft_attribute_list_entry.c	4
libfsntfs/libfdata/libfdata_mapped_range.c	4
libfsntfs/libfsntfs/libfsntfs_cluster_block_stream.c	5
libfsntfs/libfsntfs/libfsntfs_buffer_data_handle.c	2
libfsntfs/libfdata/libfdata_stream.c	8
libfsntfs/libfsntfs/libfsntfs_compressed_block_data_handle.c	2
libfsntfs/libfsntfs/libfsntfs_compressed_block_vector.c	2
libfsntfs/libfsntfs/libfsntfs_compression_unit_data_handle.c	4
libfsntfs/libfsntfs/libfsntfs_compression_unit_descriptor.c	3
libfsntfs/libfsntfs/libfsntfs_cluster_block_data.c	1
libfsntfs/libfsntfs/libfsntfs_compressed_block.c	2
libfsntfs/libfsntfs/libfsntfs_compression.c	1
libfsntfs/libfwnt/libfwnt_lznt1.c	2
libfsntfs/libfwnt/libfwnt_lzx.c	7
libfsntfs/libfwnt/libfwnt_bit_stream.c	4
libfsntfs/libcnotify/libcnotify_print.c	1
libfsntfs/libfwnt/libfwnt_huffman_tree.c	4
libfsntfs/libfwnt/libfwnt_lzxpress.c	2
libfsntfs/libfsntfs/libfsntfs_compressed_data_handle.c	2
libfsntfs/libcdata/libcdata_btree.c	4
libfsntfs/libcdata/libcdata_tree_node.c	16
libfsntfs/libcdata/libcdata_btree_values_list.c	1
libfsntfs/libfsntfs/libfsntfs_path_hint.c	1
libfsntfs/libcdata/libcdata_btree_node.c	5
libfsntfs/libfsntfs/libfsntfs_file_name_values.c	6
libfsntfs/libfsntfs/libfsntfs_security_descriptor_index.c	3
libfsntfs/libfsntfs/libfsntfs_data_stream.c	2
libfsntfs/libfsntfs/libfsntfs_extent.c	2
libfsntfs/libfsntfs/libfsntfs_index.c	10
libfsntfs/libfsntfs/libfsntfs_index_root_header.c	6
libfsntfs/libfsntfs/libfsntfs_bitmap_values.c	4
libfsntfs/libfsntfs/libfsntfs_cluster_block_vector.c	2
libfsntfs/libfsntfs/libfsntfs_cluster_block.c	4
libfsntfs/libfsntfs/libfsntfs_index_node.c	6
libfsntfs/libfsntfs/libfsntfs_index_node_header.c	3
libfsntfs/libfsntfs/libfsntfs_index_value.c	3
libfsntfs/libfsntfs/libfsntfs_index_entry_vector.c	2
libfsntfs/libfsntfs/libfsntfs_index_entry.c	3
libfsntfs/libfsntfs/libfsntfs_index_entry_header.c	5
libfsntfs/libfsntfs/libfsntfs_file_entry.c	6
libfsntfs/libfsntfs/libfsntfs_directory_entries_tree.c	8
libfsntfs/libfdata/libfdata_list.c	7
libfsntfs/libfdata/libfdata_list_element.c	8
libfsntfs/libfsntfs/libfsntfs_directory_entry.c	5
libfsntfs/libfsntfs/libfsntfs_standard_information_values.c	4
libfsntfs/libfsntfs/libfsntfs_attribute.c	4
libfsntfs/libfsntfs/libfsntfs_txf_data_values.c	3
libfsntfs/libfsntfs/libfsntfs_logged_utility_stream_values.c	3
libfsntfs/libfsntfs/libfsntfs_object_identifier_values.c	3
libfsntfs/libfsntfs/libfsntfs_reparse_point_values.c	4
libfsntfs/libfsntfs/libfsntfs_security_descriptor_values.c	6
libfsntfs/libfsntfs/libfsntfs_volume_information_values.c	3
libfsntfs/libfsntfs/libfsntfs_volume_name_values.c	3
libfsntfs/libfsntfs/libfsntfs_reparse_point_attribute.c	1