Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues
Report generation date: 2024-02-25

Project overview: libyal

High level conclusions

Reachability and coverage overview

Functions statically reachable by fuzzers
55.0%
4233 / 7633
Cyclomatic complexity statically reachable by fuzzers
64.0%
50320 / 78819
Runtime code coverage of functions
41.0%
3095 / 7633

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
libcaes_crypt_xts_fuzzer libcaes/ossfuzz/crypt_xts_fuzzer.cc 18 10 4 4 425 177 crypt_xts_fuzzer.cc
libfplist_property_list_fuzzer libfplist/ossfuzz/property_list_fuzzer.cc 62 96 8 9 1040 430 property_list_fuzzer.cc
libhmac_md5_context_fuzzer libhmac/ossfuzz/md5_context_fuzzer.cc 13 12 5 4 188 89 md5_context_fuzzer.cc
libwrc_message_table_resource_fuzzer libwrc/ossfuzz/message_table_resource_fuzzer.cc 18 203 4 5 348 149 message_table_resource_fuzzer.cc
libqcow_file_fuzzer libqcow/ossfuzz/file_fuzzer.cc 141 415 11 27 2653 1146 file_fuzzer.cc
libfwsi_item_list_fuzzer libfwsi/ossfuzz/item_list_fuzzer.cc 84 243 5 36 2331 954 item_list_fuzzer.cc
libvshadow_volume_fuzzer libvshadow/ossfuzz/volume_fuzzer.cc 123 213 12 20 2456 1065 volume_fuzzer.cc
libfsfat_file_entry_fuzzer libfsfat/ossfuzz/file_entry_fuzzer.cc 152 447 11 30 3171 1353 file_entry_fuzzer.cc
libevt_record_fuzzer libevt/ossfuzz/record_fuzzer.cc 166 469 11 28 3202 1379 record_fuzzer.cc
libodraw_handle_fuzzer libodraw/ossfuzz/handle_fuzzer.cc 130 247 10 19 2688 1099 handle_fuzzer.cc
libfplist_property_fuzzer libfplist/ossfuzz/property_fuzzer.cc 67 91 8 10 1161 480 property_fuzzer.cc
libfsapfs_container_fuzzer libfsapfs/ossfuzz/container_fuzzer.cc 170 709 11 36 3253 1407 container_fuzzer.cc
liblnk_file_fuzzer liblnk/ossfuzz/file_fuzzer.cc 116 434 11 23 2543 1080 file_fuzzer.cc
libfsntfs_mft_metadata_file_fuzzer libfsntfs/ossfuzz/mft_metadata_file_fuzzer.cc 319 757 16 65 7415 3142 mft_metadata_file_fuzzer.cc
libscca_file_fuzzer libscca/ossfuzz/file_fuzzer.cc 525 448 11 48 19179 6874 file_fuzzer.cc
libvsapm_partition_fuzzer libvsapm/ossfuzz/partition_fuzzer.cc 135 203 11 24 2288 1003 partition_fuzzer.cc
libwrc_mui_resource_fuzzer libwrc/ossfuzz/mui_resource_fuzzer.cc 11 197 4 3 252 114 mui_resource_fuzzer.cc
libfwsi_item_fuzzer libfwsi/ossfuzz/item_fuzzer.cc 82 239 5 35 2255 919 item_fuzzer.cc
libregf_file_fuzzer libregf/ossfuzz/file_fuzzer.cc 149 587 11 28 2617 1141 file_fuzzer.cc
libfsfat_volume_fuzzer libfsfat/ossfuzz/volume_fuzzer.cc 127 472 11 25 2719 1161 volume_fuzzer.cc
libfsext_extended_attribute_fuzzer libfsext/ossfuzz/extended_attribute_fuzzer.cc 219 483 12 46 4824 2052 extended_attribute_fuzzer.cc
libesedb_file_fuzzer libesedb/ossfuzz/file_fuzzer.cc 196 1017 11 40 3944 1693 file_fuzzer.cc
libregf_key_fuzzer libregf/ossfuzz/key_fuzzer.cc 254 482 11 76 6311 2428 key_fuzzer.cc
libfshfs_extended_attribute_fuzzer libfshfs/ossfuzz/extended_attribute_fuzzer.cc 279 519 11 83 8194 3096 extended_attribute_fuzzer.cc
libhmac_sha224_context_fuzzer libhmac/ossfuzz/sha224_context_fuzzer.cc 13 12 5 4 190 90 sha224_context_fuzzer.cc
libhmac_sha1_context_fuzzer libhmac/ossfuzz/sha1_context_fuzzer.cc 13 12 5 4 190 90 sha1_context_fuzzer.cc
libfsxfs_file_entry_fuzzer libfsxfs/ossfuzz/file_entry_fuzzer.cc 234 412 11 43 4620 1987 file_entry_fuzzer.cc
libmodi_handle_fuzzer libmodi/ossfuzz/handle_fuzzer.cc 315 343 13 54 7521 3080 handle_fuzzer.cc
libfcrypto_crypt_serpent_cbc_fuzzer libfcrypto/ossfuzz/crypt_serpent_cbc_fuzzer.cc 13 8 4 3 232 104 crypt_serpent_cbc_fuzzer.cc
libcreg_value_fuzzer libcreg/ossfuzz/value_fuzzer.cc 190 455 11 32 3452 1515 value_fuzzer.cc
libfsext_volume_fuzzer libfsext/ossfuzz/volume_fuzzer.cc 188 514 12 37 3878 1655 volume_fuzzer.cc
libfsext_file_entry_fuzzer libfsext/ossfuzz/file_entry_fuzzer.cc 262 440 12 45 5444 2337 file_entry_fuzzer.cc
libesedb_record_fuzzer libesedb/ossfuzz/record_fuzzer.cc 602 611 11 98 21866 7948 record_fuzzer.cc
libfshfs_file_entry_fuzzer libfshfs/ossfuzz/file_entry_fuzzer.cc 396 402 12 88 10302 4053 file_entry_fuzzer.cc
libfmapi_lzfu_fuzzer libfmapi/ossfuzz/lzfu_fuzzer.cc 10 9 4 4 155 70 lzfu_fuzzer.cc
libfwnt_lzxpress_fuzzer libfwnt/ossfuzz/lzxpress_fuzzer.cc 8 18 4 3 139 64 lzxpress_fuzzer.cc
libvsbsdl_partition_fuzzer libvsbsdl/ossfuzz/partition_fuzzer.cc 141 199 11 25 2364 1038 partition_fuzzer.cc
libvsbsdl_volume_fuzzer libvsbsdl/ossfuzz/volume_fuzzer.cc 92 248 11 15 1597 698 volume_fuzzer.cc
libvmdk_handle_fuzzer libvmdk/ossfuzz/handle_fuzzer.cc 198 519 11 38 5340 2220 handle_fuzzer.cc
libfsapfs_volume_fuzzer libfsapfs/ossfuzz/volume_fuzzer.cc 254 625 11 51 5344 2301 volume_fuzzer.cc
libhmac_sha512_context_fuzzer libhmac/ossfuzz/sha512_context_fuzzer.cc 13 12 5 4 190 90 sha512_context_fuzzer.cc
libwrc_stream_fuzzer libwrc/ossfuzz/stream_fuzzer.cc 102 808 12 15 1879 808 stream_fuzzer.cc
libfsntfs_volume_fuzzer libfsntfs/ossfuzz/volume_fuzzer.cc 368 736 16 72 8425 3594 volume_fuzzer.cc
libesedb_table_fuzzer libesedb/ossfuzz/table_fuzzer.cc 241 972 11 77 6244 2376 table_fuzzer.cc
libpff_record_set_fuzzer libpff/ossfuzz/record_set_fuzzer.cc 362 546 16 63 9138 3902 record_set_fuzzer.cc
libfvde_volume_fuzzer libfvde/ossfuzz/volume_fuzzer.cc 385 463 13 91 11541 4239 volume_fuzzer.cc
libfwnt_security_identifier_fuzzer libfwnt/ossfuzz/security_identifier_fuzzer.cc 11 14 4 3 131 62 security_identifier_fuzzer.cc
libesedb_column_fuzzer libesedb/ossfuzz/column_fuzzer.cc 247 966 11 78 6348 2423 column_fuzzer.cc
libluksde_volume_fuzzer libluksde/ossfuzz/volume_fuzzer.cc 192 336 11 37 5122 2077 volume_fuzzer.cc
libregf_value_fuzzer libregf/ossfuzz/value_fuzzer.cc 274 462 11 77 6656 2582 value_fuzzer.cc
libfusn_record_fuzzer libfusn/ossfuzz/record_fuzzer.cc 10 192 4 3 139 65 record_fuzzer.cc
libhmac_sha256_context_fuzzer libhmac/ossfuzz/sha256_context_fuzzer.cc 13 12 5 4 190 90 sha256_context_fuzzer.cc
libfsapfs_file_entry_fuzzer libfsapfs/ossfuzz/file_entry_fuzzer.cc 406 473 11 68 9657 4109 file_entry_fuzzer.cc
libfsxfs_extended_attribute_fuzzer libfsxfs/ossfuzz/extended_attribute_fuzzer.cc 218 428 11 50 4599 1956 extended_attribute_fuzzer.cc
libfwps_record_fuzzer libfwps/ossfuzz/record_fuzzer.cc 25 219 5 5 504 207 record_fuzzer.cc
libpff_item_fuzzer libpff/ossfuzz/item_fuzzer.cc 359 549 16 63 9099 3884 item_fuzzer.cc
libfcrypto_crypt_serpent_ecb_fuzzer libfcrypto/ossfuzz/crypt_serpent_ecb_fuzzer.cc 13 8 4 3 209 95 crypt_serpent_ecb_fuzzer.cc
libfwevt_xml_document_fuzzer libfwevt/ossfuzz/xml_document_fuzzer.cc 422 227 17 23 17978 6268 xml_document_fuzzer.cc
libcaes_crypt_ccm_fuzzer libcaes/ossfuzz/crypt_ccm_fuzzer.cc 15 9 4 3 340 141 crypt_ccm_fuzzer.cc
libcreg_key_fuzzer libcreg/ossfuzz/key_fuzzer.cc 181 464 11 31 3337 1462 key_fuzzer.cc
libfshfs_volume_fuzzer libfshfs/ossfuzz/volume_fuzzer.cc 246 552 11 75 6523 2472 volume_fuzzer.cc
libfmapi_one_off_entry_identifier_fuzzer libfmapi/ossfuzz/one_off_entry_identifier_fuzzer.cc 10 194 4 3 253 108 one_off_entry_identifier_fuzzer.cc
libsmraw_handle_fuzzer libsmraw/ossfuzz/handle_fuzzer.cc 207 601 8 32 3907 1708 handle_fuzzer.cc
libvsmbr_partition_fuzzer libvsmbr/ossfuzz/partition_fuzzer.cc 142 200 11 26 2446 1067 partition_fuzzer.cc
libfwnt_lzx_fuzzer libfwnt/ossfuzz/lzx_fuzzer.cc 24 20 5 6 599 250 lzx_fuzzer.cc
libnk2_file_fuzzer libnk2/ossfuzz/file_fuzzer.cc 90 350 11 16 1632 705 file_fuzzer.cc
libcaes_crypt_cbc_fuzzer libcaes/ossfuzz/crypt_cbc_fuzzer.cc 15 9 4 3 343 143 crypt_cbc_fuzzer.cc
libwrc_manifest_resource_fuzzer libwrc/ossfuzz/manifest_resource_fuzzer.cc 10 184 4 3 120 57 manifest_resource_fuzzer.cc
libvsgpt_partition_fuzzer libvsgpt/ossfuzz/partition_fuzzer.cc 153 212 12 29 2736 1188 partition_fuzzer.cc
libewf_handle_fuzzer libewf/ossfuzz/handle_fuzzer.cc 947 763 16 144 34425 13159 handle_fuzzer.cc
libfcrypto_crypt_blowfish_cbc_fuzzer libfcrypto/ossfuzz/crypt_blowfish_cbc_fuzzer.cc 14 8 4 3 271 116 crypt_blowfish_cbc_fuzzer.cc
libmsiecf_file_fuzzer libmsiecf/ossfuzz/file_fuzzer.cc 103 715 11 19 2041 883 file_fuzzer.cc
libfcrypto_crypt_rc4_fuzzer libfcrypto/ossfuzz/crypt_rc4_fuzzer.cc 11 7 4 3 142 66 crypt_rc4_fuzzer.cc
libfwnt_lzxpress_huffman_fuzzer libfwnt/ossfuzz/lzxpress_huffman_fuzzer.cc 17 9 5 5 385 165 lzxpress_huffman_fuzzer.cc
libfmos_lzfse_fuzzer libfmos/ossfuzz/lzfse_fuzzer.cc 22 7 5 6 619 254 lzfse_fuzzer.cc
libfcrypto_crypt_des3_cbc_fuzzer libfcrypto/ossfuzz/crypt_des3_cbc_fuzzer.cc 12 9 4 3 277 116 crypt_des3_cbc_fuzzer.cc
libbde_volume_fuzzer libbde/ossfuzz/volume_fuzzer.cc 174 453 11 38 4507 1902 volume_fuzzer.cc
libvsapm_volume_fuzzer libvsapm/ossfuzz/volume_fuzzer.cc 88 250 11 14 1544 674 volume_fuzzer.cc
libfmos_adc_fuzzer libfmos/ossfuzz/adc_fuzzer.cc 8 7 4 3 125 59 adc_fuzzer.cc
libfcrypto_crypt_des3_ecb_fuzzer libfcrypto/ossfuzz/crypt_des3_ecb_fuzzer.cc 12 9 4 3 254 107 crypt_des3_ecb_fuzzer.cc
libfmos_lzvn_fuzzer libfmos/ossfuzz/lzvn_fuzzer.cc 8 7 4 3 143 60 lzvn_fuzzer.cc
libfwnt_security_descriptor_fuzzer libfwnt/ossfuzz/security_descriptor_fuzzer.cc 23 40 5 7 494 204 security_descriptor_fuzzer.cc
libvsmbr_volume_fuzzer libvsmbr/ossfuzz/volume_fuzzer.cc 96 246 11 16 1718 745 volume_fuzzer.cc
libwrc_version_information_resource_fuzzer libwrc/ossfuzz/version_information_resource_fuzzer.cc 16 9 5 3 366 158 version_information_resource_fuzzer.cc
libfwps_set_fuzzer libfwps/ossfuzz/set_fuzzer.cc 20 224 5 5 448 181 set_fuzzer.cc
libmdmp_file_fuzzer libmdmp/ossfuzz/file_fuzzer.cc 97 193 11 17 1699 744 file_fuzzer.cc
libfcrypto_crypt_blowfish_ecb_fuzzer libfcrypto/ossfuzz/crypt_blowfish_ecb_fuzzer.cc 14 8 4 3 248 107 crypt_blowfish_ecb_fuzzer.cc
libfsapfs_extended_attribute_fuzzer libfsapfs/ossfuzz/extended_attribute_fuzzer.cc 303 576 11 65 8316 3422 extended_attribute_fuzzer.cc
libfwps_store_fuzzer libfwps/ossfuzz/store_fuzzer.cc 23 226 5 6 508 207 store_fuzzer.cc
libfwnt_lznt1_fuzzer libfwnt/ossfuzz/lznt1_fuzzer.cc 9 7 4 3 155 73 lznt1_fuzzer.cc
libvslvm_logical_volume_fuzzer libvslvm/ossfuzz/logical_volume_fuzzer.cc 228 304 12 37 5649 2411 logical_volume_fuzzer.cc
libevt_file_fuzzer libevt/ossfuzz/file_fuzzer.cc 154 481 11 27 2956 1270 file_fuzzer.cc
libexe_file_fuzzer libexe/ossfuzz/file_fuzzer.cc 132 373 12 24 2322 1014 file_fuzzer.cc
libvslvm_handle_fuzzer libvslvm/ossfuzz/handle_fuzzer.cc 167 365 12 26 4698 1987 handle_fuzzer.cc
libcreg_file_fuzzer libcreg/ossfuzz/file_fuzzer.cc 156 489 11 28 2785 1219 file_fuzzer.cc
libolecf_file_fuzzer libolecf/ossfuzz/file_fuzzer.cc 115 362 11 19 2754 1162 file_fuzzer.cc
libvhdi_file_fuzzer libvhdi/ossfuzz/file_fuzzer.cc 208 402 12 43 4427 1880 file_fuzzer.cc
libfmapi_entry_identifier_fuzzer libfmapi/ossfuzz/entry_identifier_fuzzer.cc 10 8 4 3 112 54 entry_identifier_fuzzer.cc
libcaes_crypt_ecb_fuzzer libcaes/ossfuzz/crypt_ecb_fuzzer.cc 14 10 4 3 286 118 crypt_ecb_fuzzer.cc
libagdb_file_fuzzer libagdb/ossfuzz/file_fuzzer.cc 182 408 11 33 3894 1679 file_fuzzer.cc
libftxf_record_fuzzer libftxf/ossfuzz/record_fuzzer.cc 15 191 4 4 253 112 record_fuzzer.cc
libvsgpt_volume_fuzzer libvsgpt/ossfuzz/volume_fuzzer.cc 108 257 12 19 2012 870 volume_fuzzer.cc
libpff_file_fuzzer libpff/ossfuzz/file_fuzzer.cc 351 557 16 62 8874 3787 file_fuzzer.cc
libevtx_record_fuzzer libevtx/ossfuzz/record_fuzzer.cc 571 540 21 49 21064 7598 record_fuzzer.cc
libolecf_item_fuzzer libolecf/ossfuzz/item_fuzzer.cc 122 355 11 20 2881 1218 item_fuzzer.cc
libwrc_string_table_resource_fuzzer libwrc/ossfuzz/string_table_resource_fuzzer.cc 19 202 4 5 318 139 string_table_resource_fuzzer.cc
libphdi_handle_fuzzer libphdi/ossfuzz/handle_fuzzer.cc 184 645 11 39 3734 1564 handle_fuzzer.cc
libfwevt_manifest_fuzzer libfwevt/ossfuzz/manifest_fuzzer.cc 65 687 6 15 1476 637 manifest_fuzzer.cc
libmsiecf_item_fuzzer libmsiecf/ossfuzz/item_fuzzer.cc 468 350 11 39 18742 6615 item_fuzzer.cc
libfsxfs_volume_fuzzer libfsxfs/ossfuzz/volume_fuzzer.cc 110 536 11 19 2090 897 volume_fuzzer.cc
libevtx_file_fuzzer libevtx/ossfuzz/file_fuzzer.cc 561 550 21 48 20868 7511 file_fuzzer.cc
libfsntfs_file_entry_fuzzer libfsntfs/ossfuzz/file_entry_fuzzer.cc 468 636 16 86 10664 4565 file_entry_fuzzer.cc

Fuzzer details

Fuzzer: libcaes_crypt_xts_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 74 80.4%
gold [1:9] 2 2.17%
yellow [10:29] 2 2.17%
greenyellow [30:49] 2 2.17%
lawngreen 50+ 12 13.0%
All colors 92 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
85 85 1 :

['libcaes_internal_context_set_decryption_key']

85 117 libcaes_context_set_key call site: 00033 /src/libcaes/libcaes/libcaes_context.c:585
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 68 3 :

['free', 'libcaes_context_free', 'libcerror_error_set']

0 68 libcaes_tweaked_context_initialize call site: 00022 /src/libcaes/libcaes/libcaes_tweaked_context.c:155
0 32 2 :

['free', 'libcerror_error_set']

0 32 libcaes_context_initialize call site: 00018 /src/libcaes/libcaes/libcaes_context.c:360
0 32 1 :

['libcerror_error_set']

0 32 libcaes_context_free call site: 00024 /src/libcaes/libcaes/libcaes_context.c:406
0 32 1 :

['libcerror_error_set']

0 32 libcaes_context_set_key call site: 00034 /src/libcaes/libcaes/libcaes_context.c:587
0 32 1 :

['libcerror_error_set']

0 32 libcaes_initialize_tables call site: 00018 /src/libcaes/libcaes/libcaes_context.c:644
0 32 1 :

['libcerror_error_set']

0 32 libcaes_internal_context_set_encryption_key call site: 00036 /src/libcaes/libcaes/libcaes_context.c:1064
0 32 1 :

['libcerror_error_set']

0 32 libcaes_tweaked_context_free call site: 00090 /src/libcaes/libcaes/libcaes_tweaked_context.c:275
0 32 1 :

['libcerror_error_set']

0 32 libcaes_tweaked_context_set_keys call site: 00052 /src/libcaes/libcaes/libcaes_tweaked_context.c:435
0 32 1 :

['libcerror_error_set']

0 32 libcaes_crypt_xts call site: 00084 /src/libcaes/libcaes/libcaes_tweaked_context.c:1244
0 0 None 0 356 libcaes_crypt_xts call site: 00075 /src/libcaes/libcaes/libcaes_tweaked_context.c:981

Runtime coverage analysis

Covered functions
12
Functions that are reachable but not covered
6
Reachable functions
18
Percentage of reachable functions covered
66.67%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libcaes/ossfuzz/crypt_xts_fuzzer.cc 1
libcaes/libcaes/libcaes_tweaked_context.c 4
libcaes/libcerror/libcerror_error.c 3
libcaes/libcaes/libcaes_context.c 7

Fuzzer: libfplist_property_list_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 167 75.9%
gold [1:9] 4 1.81%
yellow [10:29] 3 1.36%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 46 20.9%
All colors 220 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
85 85 8 :

['getc', 'fread', 'ferror', '__errno_location', 'libfplist_xml_scanner_realloc', 'yy_fatal_error', 'libfplist_xml_scanner_restart', 'clearerr']

85 85 yy_get_next_buffer call site: 00057 /src/libfplist/libfplist/libfplist_xml_scanner.c:158629
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 78 3 :

['free', 'libcdata_array_free', 'libcerror_error_set']

0 78 libfplist_xml_tag_initialize call site: 00099 /src/libfplist/libfplist/libfplist_xml_tag.c:169
0 70 2 :

['libfplist_xml_attribute_free', 'libcerror_error_set']

0 70 libfplist_xml_tag_append_attribute call site: 00159 /src/libfplist/libfplist/libfplist_xml_tag.c:598
0 68 1 :

['libfplist_xml_tag_free']

0 68 libfplist_property_list_copy_from_byte_stream call site: 00215 /src/libfplist/libfplist/libfplist_property_list.c:490
0 64 1 :

['libcerror_error_set']

0 64 libcdata_internal_array_resize call site: 00123 /src/libfplist/libcdata/libcdata_array.c:823
0 38 1 :

['libfplist_xml_attribute_free']

0 38 libfplist_xml_tag_append_attribute call site: 00160 /src/libfplist/libfplist/libfplist_xml_tag.c:616
0 32 1 :

['libcerror_error_set']

0 135 libfplist_xml_parser_parse_buffer call site: 00167 /src/libfplist/libfplist/libfplist_xml_parser.c:463
0 32 2 :

['free', 'libcerror_error_set']

0 32 libcdata_array_initialize call site: 00096 /src/libfplist/libcdata/libcdata_array.c:162
0 32 1 :

['libcerror_error_set']

0 32 libcdata_array_free call site: 00103 /src/libfplist/libcdata/libcdata_array.c:260
0 32 1 :

['libcerror_error_set']

0 32 libcdata_internal_array_resize call site: 00122 /src/libfplist/libcdata/libcdata_array.c:797
0 32 1 :

['libcerror_error_set']

0 32 libcdata_array_get_number_of_entries call site: 00200 /src/libfplist/libcdata/libcdata_array.c:1052

Runtime coverage analysis

Covered functions
41
Functions that are reachable but not covered
21
Reachable functions
62
Percentage of reachable functions covered
66.13%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libfplist/ossfuzz/property_list_fuzzer.cc 1
libfplist/libfplist/libfplist_property_list.c 4
libfplist/libcerror/libcerror_error.c 3
libfplist/libfplist/libfplist_xml_parser.c 3
libfplist/libfplist/libfplist_xml_scanner.c 17
libfplist/libfplist/libfplist_xml_scanner.l 5
libfplist/libfplist/libfplist_xml_tag.c 8
libfplist/libcdata/libcdata_array.c 7
libfplist/libfplist/libfplist_xml_attribute.c 2

Fuzzer: libhmac_md5_context_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 41 83.6%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 8 16.3%
All colors 49 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
32 68 2 :

['libhmac_md5_context_free', 'libcerror_error_set']

32 68 libhmac_md5_calculate call site: 00045 /src/libhmac/libhmac/libhmac_md5.c:196
32 32 1 :

['libcerror_error_set']

32 32 libhmac_md5_context_transform call site: 00027 /src/libhmac/libhmac/libhmac_md5_context.c:388
32 32 2 :

['free', 'libcerror_error_set']

32 32 libhmac_md5_context_initialize call site: 00013 /src/libhmac/libhmac/libhmac_md5_context.c:560
32 32 1 :

['libcerror_error_set']

32 32 libhmac_md5_context_free call site: 00045 /src/libhmac/libhmac/libhmac_md5_context.c:599
32 32 1 :

['libcerror_error_set']

32 32 libhmac_md5_context_update call site: 00032 /src/libhmac/libhmac/libhmac_md5_context.c:955
32 32 1 :

['libcerror_error_set']

32 32 libhmac_md5_context_finalize call site: 00042 /src/libhmac/libhmac/libhmac_md5_context.c:1274
0 0 None 192 274 libhmac_md5_context_update call site: 00019 /src/libhmac/libhmac/libhmac_md5_context.c:856
0 0 None 32 68 libhmac_md5_calculate call site: 00002 /src/libhmac/libhmac/libhmac_md5.c:153
0 0 None 32 68 libhmac_md5_calculate call site: 00016 /src/libhmac/libhmac/libhmac_md5.c:166
0 0 None 32 68 libhmac_md5_calculate call site: 00035 /src/libhmac/libhmac/libhmac_md5.c:181
0 0 None 32 32 libhmac_md5_context_transform call site: 00022 /src/libhmac/libhmac/libhmac_md5_context.c:235
0 0 None 32 32 libhmac_md5_context_transform call site: 00023 /src/libhmac/libhmac/libhmac_md5_context.c:246

Runtime coverage analysis

Covered functions
7
Functions that are reachable but not covered
6
Reachable functions
13
Percentage of reachable functions covered
53.85%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libhmac/ossfuzz/md5_context_fuzzer.cc 1
libhmac/libhmac/libhmac_md5.c 1
libhmac/libhmac/libhmac_md5_context.c 5
libhmac/libcerror/libcerror_error.c 3

Fuzzer: libwrc_message_table_resource_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 56 74.6%
gold [1:9] 1 1.33%
yellow [10:29] 3 4.0%
greenyellow [30:49] 1 1.33%
lawngreen 50+ 14 18.6%
All colors 75 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 64 1 :

['libcerror_error_set']

0 64 libcdata_internal_array_resize call site: 00058 /src/libfplist/libcdata/libcdata_array.c:823
0 37 1 :

['libwrc_table_entry_free']

0 37 libwrc_message_table_resource_read call site: 00062 /src/libwrc/libwrc/libwrc_message_table_resource.c:537
0 32 2 :

['free', 'libcerror_error_set']

0 32 libcdata_array_initialize call site: 00021 /src/libfplist/libcdata/libcdata_array.c:162
0 32 1 :

['libcerror_error_set']

0 32 libcdata_array_free call site: 00069 /src/libfplist/libcdata/libcdata_array.c:260
0 32 1 :

['libcerror_error_set']

0 32 libcdata_internal_array_resize call site: 00057 /src/libfplist/libcdata/libcdata_array.c:797
0 32 1 :

['libcerror_error_set']

0 32 libcdata_array_append_entry call site: 00051 /src/libfplist/libcdata/libcdata_array.c:1609
0 32 2 :

['free', 'libcerror_error_set']

0 32 libwrc_message_table_resource_initialize call site: 00013 /src/libwrc/libwrc/libwrc_message_table_resource.c:101
0 32 1 :

['libcerror_error_set']

0 32 libwrc_message_table_resource_free call site: 00073 /src/libwrc/libwrc/libwrc_message_table_resource.c:155
0 32 2 :

['free', 'libcerror_error_set']

0 32 libwrc_table_entry_initialize call site: 00036 /src/libwrc/libwrc/libwrc_table_entry.c:76
0 32 1 :

['libcerror_error_set']

0 32 libwrc_table_entry_free call site: 00063 /src/libwrc/libwrc/libwrc_table_entry.c:112
0 32 2 :

['free', 'libcerror_error_set']

0 32 libwrc_table_entry_set_string call site: 00044 /src/libwrc/libwrc/libwrc_table_entry.c:211

Runtime coverage analysis

Covered functions
13
Functions that are reachable but not covered
5
Reachable functions
18
Percentage of reachable functions covered
72.22%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libwrc/ossfuzz/message_table_resource_fuzzer.cc 1
libwrc/libwrc/libwrc_message_table_resource.c 3
libwrc/libcerror/libcerror_error.c 3
libwrc/libcdata/libcdata_array.c 5
libwrc/libwrc/libwrc_table_entry.c 3

Fuzzer: libqcow_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 544 80.4%
gold [1:9] 7 1.03%
yellow [10:29] 2 0.29%
greenyellow [30:49] 28 4.14%
lawngreen 50+ 95 14.0%
All colors 676 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
264 264 1 :

['libcdata_range_list_insert_range']

264 360 libbfio_internal_handle_read_buffer call site: 00174 /src/libqcow/libbfio/libbfio_handle.c:1139
164 292 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']

164 292 libcdata_range_list_empty call site: 00030 /src/libqcow/libcdata/libcdata_range_list.c:326
146 274 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']

146 274 libcdata_list_empty call site: 00591 /src/libqcow/libcdata/libcdata_list.c:238
46 46 1 :

['libcerror_system_set_error']

46 46 libcthreads_read_write_lock_release_for_write call site: 00622 /src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38 142 4 :

['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']

38 142 libfdata_segments_array_append_segment call site: 00553 /src/libqcow/libfdata/libfdata_segments_array.c:592
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
2 2 1 :

['realloc']

2 98 libcdata_internal_array_resize call site: 00541 /src/libfplist/libcdata/libcdata_array.c:753
0 463 7 :

['free', 'libfcache_cache_free', 'libqcow_cluster_table_free', 'libfdata_vector_free', 'libqcow_encryption_free', 'libcerror_error_set', 'libqcow_file_header_free']

0 463 libqcow_internal_file_open_read call site: 00585 /src/libqcow/libqcow/libqcow_file.c:1630
0 255 1 :

['libqcow_file_close']

0 491 libqcow_file_free call site: 00664 /src/libqcow/libqcow/libqcow_file.c:198
0 124 3 :

['free', 'libcdata_array_free', 'libcerror_error_set']

0 124 libfdata_vector_initialize call site: 00421 /src/libqcow/libfdata/libfdata_vector.c:180
0 116 3 :

['free', 'libcerror_error_set', 'libcdata_range_list_free']

0 116 libbfio_handle_initialize call site: 00022 /src/libqcow/libbfio/libbfio_handle.c:140
0 99 1 :

['libbfio_handle_free']

0 1080 libqcow_file_close call site: 00636 /src/libqcow/libqcow/libqcow_file.c:897

Runtime coverage analysis

Covered functions
76
Functions that are reachable but not covered
65
Reachable functions
141
Percentage of reachable functions covered
53.9%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libqcow/ossfuzz/file_fuzzer.cc 1
libqcow/libbfio/libbfio_memory_range.c 2
libqcow/libcerror/libcerror_error.c 3
libqcow/libbfio/libbfio_memory_range_io_handle.c 3
libqcow/libbfio/libbfio_handle.c 9
libqcow/libcdata/libcdata_range_list.c 15
libqcow/libcdata/libcdata_list_element.c 10
libqcow/libcdata/libcdata_range_list_value.c 3
libqcow/libqcow/libqcow_file.c 6
libqcow/libqcow/libqcow_io_handle.c 5
libqcow/libqcow/libqcow_i18n.c 1
libqcow/libcthreads/libcthreads_read_write_lock.c 4
libqcow/libcerror/libcerror_system.c 2
libqcow/libqcow/libqcow_file_header.c 4
libqcow/libqcow/libqcow_encryption.c 3
libqcow/libcaes/libcaes_context.c 6
libqcow/libqcow/libqcow_cluster_table.c 3
libqcow/libfdata/libfdata_vector.c 4
libqcow/libcdata/libcdata_array.c 8
libqcow/libfcache/libfcache_date_time.c 1
libqcow/libfdata/libfdata_segments_array.c 2
libqcow/libfdata/libfdata_range.c 4
libqcow/libfcache/libfcache_cache.c 3
libqcow/libcdata/libcdata_list.c 7
libqcow/libfcache/libfcache_cache_value.c 6
libqcow/libfdata/libfdata_mapped_range.c 3
libqcow/libqcow/libqcow_cluster_block.c 3

Fuzzer: libfwsi_item_list_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 313 96.9%
gold [1:9] 1 0.30%
yellow [10:29] 0 0.0%
greenyellow [30:49] 8 2.47%
lawngreen 50+ 1 0.30%
All colors 323 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
1067 1067 5 :

['libfwsi_item_copy_from_byte_stream', 'libfwsi_item_set_parent_item', 'libfwsi_internal_item_free', 'libcdata_array_append_entry', 'libfwsi_internal_item_initialize']

1067 1259 libfwsi_item_list_copy_from_byte_stream call site: 00026 /src/libfwsi/libfwsi/libfwsi_item_list.c:234
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 32 2 :

['free', 'libcerror_error_set']

0 32 libcdata_array_initialize call site: 00019 /src/libfplist/libcdata/libcdata_array.c:162
0 32 1 :

['libcerror_error_set']

0 32 libcdata_array_free call site: 00312 /src/libfplist/libcdata/libcdata_array.c:260
0 32 2 :

['free', 'libcerror_error_set']

0 32 libfwsi_item_list_initialize call site: 00013 /src/libfwsi/libfwsi/libfwsi_item_list.c:96
0 32 1 :

['libcerror_error_set']

0 32 libfwsi_item_list_free call site: 00322 /src/libfwsi/libfwsi/libfwsi_item_list.c:150
0 0 None 0 128 libcdata_array_initialize call site: 00016 /src/libfplist/libcdata/libcdata_array.c:112
0 0 None 0 32 libcdata_array_initialize call site: 00013 /src/libfplist/libcdata/libcdata_array.c:46
0 0 None 0 32 libcdata_array_initialize call site: 00013 /src/libfplist/libcdata/libcdata_array.c:57
0 0 None 0 32 libcdata_array_initialize call site: 00013 /src/libfplist/libcdata/libcdata_array.c:68
0 0 None 0 32 libcdata_array_initialize call site: 00014 /src/libfplist/libcdata/libcdata_array.c:82
0 0 None 0 32 libcdata_array_initialize call site: 00015 /src/libfplist/libcdata/libcdata_array.c:93

Runtime coverage analysis

Covered functions
8
Functions that are reachable but not covered
76
Reachable functions
84
Percentage of reachable functions covered
9.52%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libfwsi/ossfuzz/item_list_fuzzer.cc 1
libfwsi/libfwsi/libfwsi_item_list.c 3
libfwsi/libcerror/libcerror_error.c 3
libfwsi/libcdata/libcdata_array.c 5
libfwsi/libfwsi/libfwsi_item.c 5
libfwsi/libfwsi/libfwsi_uri_sub_values.c 2
libfwsi/libfwsi/libfwsi_cdburn_values.c 2
libfwsi/libfwsi/libfwsi_compressed_folder_values.c 2
libfwsi/libfwsi/libfwsi_control_panel_item_values.c 2
libfwsi/libfwsi/libfwsi_control_panel_category_values.c 2
libfwsi/libfwsi/libfwsi_control_panel_cpl_file_values.c 2
libfwsi/libfwsi/libfwsi_delegate_values.c 2
libfwsi/libfwsi/libfwsi_file_entry_values.c 2
libfwsi/libfwsi/libfwsi_game_folder_values.c 2
libfwsi/libfwsi/libfwsi_mtp_file_entry_values.c 2
libfwsi/libfwsi/libfwsi_mtp_volume_values.c 2
libfwsi/libfwsi/libfwsi_network_location_values.c 2
libfwsi/libfwsi/libfwsi_root_folder_values.c 2
libfwsi/libfwsi/libfwsi_uri_values.c 2
libfwsi/libfwsi/libfwsi_users_files_folder_values.c 2
libfwsi/libfwsi/libfwsi_users_property_view_values.c 2
libfwsi/libfwsi/libfwsi_volume_values.c 2
libfwsi/libfwsi/libfwsi_extension_block.c 3
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0000_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0001_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0003_values.c 2
libfwsi/libfwsi/libfwsi_file_entry_extension_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0005_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0006_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef000a_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0013_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0014_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0019_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0025_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0026_values.c 2
libfwsi/libfwsi/libfwsi_extension_block_0xbeef0029_values.c 2

Fuzzer: libvshadow_volume_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 472 73.2%
gold [1:9] 10 1.55%
yellow [10:29] 2 0.31%
greenyellow [30:49] 12 1.86%
lawngreen 50+ 148 22.9%
All colors 644 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
264 264 1 :

['libcdata_range_list_insert_range']

264 360 libbfio_internal_handle_read_buffer call site: 00219 /src/libqcow/libbfio/libbfio_handle.c:1139
164 292 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']

164 292 libcdata_range_list_empty call site: 00030 /src/libqcow/libcdata/libcdata_range_list.c:326
146 274 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']

146 274 libcdata_list_empty call site: 00143 /src/libqcow/libcdata/libcdata_list.c:238
46 46 1 :

['libcerror_system_set_error']

46 46 libcthreads_read_write_lock_release_for_write call site: 00510 /src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 298 3 :

['libvshadow_block_tree_free', 'libcerror_error_set', 'libvshadow_store_descriptor_free']

0 298 libvshadow_io_handle_read_catalog call site: 00549 /src/libvshadow/libvshadow/libvshadow_io_handle.c:897
0 253 1 :

['libvshadow_volume_close']

0 530 libvshadow_volume_free call site: 00634 /src/libvshadow/libvshadow/libvshadow_volume.c:193
0 182 4 :

['free', 'libcdata_list_free', 'libcerror_error_set', 'libcdata_range_list_free']

0 182 libvshadow_store_descriptor_initialize call site: 00488 /src/libvshadow/libvshadow/libvshadow_store_descriptor.c:150
0 116 3 :

['free', 'libcerror_error_set', 'libcdata_range_list_free']

0 116 libbfio_handle_initialize call site: 00022 /src/libqcow/libbfio/libbfio_handle.c:140
0 112 2 :

['libcdata_array_get_entry_by_index', 'libvshadow_block_tree_node_free']

0 254 libvshadow_block_tree_node_free call site: 00118 /src/libvshadow/libvshadow/libvshadow_block_tree_node.c:203
0 105 2 :

['libcerror_error_set', 'libvshadow_block_tree_node_free']

0 105 libvshadow_block_tree_insert_block_descriptor_by_offset call site: 00458 /src/libvshadow/libvshadow/libvshadow_block_tree.c:440
0 104 2 :

['libcerror_error_set', 'libvshadow_ntfs_volume_header_free']

0 104 libvshadow_volume_open_read_ntfs_volume_headers call site: 00390 /src/libvshadow/libvshadow/libvshadow_volume.c:1304

Runtime coverage analysis

Covered functions
79
Functions that are reachable but not covered
44
Reachable functions
123
Percentage of reachable functions covered
64.23%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libvshadow/ossfuzz/volume_fuzzer.cc 1
libvshadow/libbfio/libbfio_memory_range.c 2
libvshadow/libcerror/libcerror_error.c 3
libvshadow/libbfio/libbfio_memory_range_io_handle.c 3
libvshadow/libbfio/libbfio_handle.c 9
libvshadow/libcdata/libcdata_range_list.c 15
libvshadow/libcdata/libcdata_list_element.c 10
libvshadow/libcdata/libcdata_range_list_value.c 3
libvshadow/libvshadow/libvshadow_volume.c 6
libvshadow/libcdata/libcdata_array.c 10
libvshadow/libvshadow/libvshadow_io_handle.c 8
libvshadow/libcthreads/libcthreads_read_write_lock.c 4
libvshadow/libcerror/libcerror_system.c 2
libvshadow/libvshadow/libvshadow_store_descriptor.c 6
libvshadow/libvshadow/libvshadow_block_tree.c 3
libvshadow/libvshadow/libvshadow_block_tree_node.c 6
libvshadow/libvshadow/libvshadow_block_descriptor.c 3
libvshadow/libcdata/libcdata_list.c 3
libvshadow/libvshadow/libvshadow_ntfs_volume_header.c 4
libvshadow/libvshadow/libvshadow_store_block.c 4

Fuzzer: libfsfat_file_entry_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 567 71.6%
gold [1:9] 20 2.52%
yellow [10:29] 8 1.01%
greenyellow [30:49] 3 0.37%
lawngreen 50+ 193 24.3%
All colors 791 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
653 653 1 :

['libfsfat_internal_file_entry_get_directory']

653 1153 libfsfat_internal_file_entry_get_sub_file_entry_by_index call site: 00723 /src/libfsfat/libfsfat/libfsfat_file_entry.c:1290
653 653 1 :

['libfsfat_internal_file_entry_get_directory']

653 857 libfsfat_file_entry_get_number_of_sub_file_entries call site: 00696 /src/libfsfat/libfsfat/libfsfat_file_entry.c:1190
264 264 1 :

['libcdata_range_list_insert_range']

264 360 libbfio_internal_handle_read_buffer call site: 00152 /src/libqcow/libbfio/libbfio_handle.c:1139
164 292 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']

164 292 libcdata_range_list_empty call site: 00030 /src/libqcow/libcdata/libcdata_range_list.c:326
146 274 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']

146 274 libcdata_list_empty call site: 00344 /src/libqcow/libcdata/libcdata_list.c:238
64 64 1 :

['libfdata_stream_free']

64 174 libfsfat_file_entry_free call site: 00674 /src/libfsfat/libfsfat/libfsfat_file_entry.c:315
46 46 1 :

['libcerror_system_set_error']

46 46 libcthreads_read_write_lock_release_for_read call site: 00711 /src/libqcow/libcthreads/libcthreads_read_write_lock.c:614
46 46 1 :

['libcerror_system_set_error']

46 46 libcthreads_read_write_lock_release_for_write call site: 00624 /src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 259 5 :

['libfsfat_directory_free', 'libfsfat_directory_entry_free', 'libfsfat_block_tree_free', 'libcdata_array_free', 'libcerror_error_set']

0 259 libfsfat_file_system_read_directory call site: 00591 /src/libfsfat/libfsfat/libfsfat_file_system.c:1082
0 245 1 :

['libfsfat_volume_close']

0 444 libfsfat_volume_free call site: 00784 /src/libfsfat/libfsfat/libfsfat_volume.c:175
0 227 3 :

['libfsfat_file_system_free', 'libfsfat_boot_record_free', 'libcerror_error_set']

0 227 libfsfat_internal_volume_open_read call site: 00600 /src/libfsfat/libfsfat/libfsfat_volume.c:1101

Runtime coverage analysis

Covered functions
103
Functions that are reachable but not covered
49
Reachable functions
152
Percentage of reachable functions covered
67.76%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libfsfat/ossfuzz/file_entry_fuzzer.cc 1
libfsfat/libbfio/libbfio_memory_range.c 2
libfsfat/libcerror/libcerror_error.c 3
libfsfat/libbfio/libbfio_memory_range_io_handle.c 3
libfsfat/libbfio/libbfio_handle.c 9
libfsfat/libcdata/libcdata_range_list.c 15
libfsfat/libcdata/libcdata_list_element.c 10
libfsfat/libcdata/libcdata_range_list_value.c 3
libfsfat/libfsfat/libfsfat_volume.c 6
libfsfat/libfsfat/libfsfat_io_handle.c 3
libfsfat/libcthreads/libcthreads_read_write_lock.c 6
libfsfat/libcerror/libcerror_system.c 2
libfsfat/libfsfat/libfsfat_boot_record.c 4
libfsfat/libfsfat/libfsfat_file_system.c 8
libfsfat/libfcache/libfcache_date_time.c 1
libfsfat/libfcache/libfcache_cache.c 2
libfsfat/libcdata/libcdata_array.c 8
libfsfat/libcdata/libcdata_list.c 3
libfsfat/libfcache/libfcache_cache_value.c 1
libfsfat/libfsfat/libfsfat_allocation_table.c 4
libfsfat/libfsfat/libfsfat_directory.c 4
libfsfat/libfsfat/libfsfat_directory_entry.c 13
libfsfat/libfsfat/libfsfat_block_tree.c 3
libfsfat/libfsfat/libfsfat_block_tree_node.c 6
libfsfat/libfsfat/libfsfat_block_descriptor.c 2
libfsfat/libfsfat/libfsfat_file_entry.c 6
libfsfat/libfdata/libfdata_stream.c 1
libfsfat/libfdata/libfdata_range.c 1
libfsfat/libfdata/libfdata_mapped_range.c 1
libfsfat/libfsfat/libfsfat_extent.c 1

Fuzzer: libevt_record_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 580 70.4%
gold [1:9] 3 0.36%
yellow [10:29] 13 1.57%
greenyellow [30:49] 1 0.12%
lawngreen 50+ 226 27.4%
All colors 823 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
264 264 1 :

['libcdata_range_list_insert_range']

264 360 libbfio_internal_handle_read_buffer call site: 00128 /src/libqcow/libbfio/libbfio_handle.c:1139
93 292 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']

93 292 libcdata_range_list_empty call site: 00030 /src/libqcow/libcdata/libcdata_range_list.c:326
72 147 4 :

['libcdata_list_get_last_element', 'libcdata_list_element_get_value', 'libfcache_cache_value_get_cache_index', 'libcdata_array_get_entry_by_index']

72 415 libfcache_cache_set_value_by_identifier call site: 00392 /src/libqcow/libfcache/libfcache_cache.c:801
46 46 1 :

['libcerror_system_set_error']

46 46 libcthreads_read_write_lock_release_for_write call site: 00658 /src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
35 137 4 :

['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element', 'libcdata_list_element_set_elements']

35 137 libcdata_list_remove_element call site: 00723 /src/libqcow/libcdata/libcdata_list.c:2812
35 102 3 :

['libcdata_list_element_set_previous_element', 'libcerror_error_set', 'libcdata_list_element_set_next_element']

35 102 libcdata_list_prepend_element call site: 00421 /src/libqcow/libcdata/libcdata_list.c:1314
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 230 1 :

['libevt_file_close']

0 757 libevt_file_free call site: 00804 /src/libevt/libevt/libevt_file.c:246
0 206 4 :

['free', 'libfdata_list_free', 'libevt_io_handle_free', 'libcerror_error_set']

0 206 libevt_file_initialize call site: 00468 /src/libevt/libevt/libevt_file.c:175
0 147 4 :

['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libfdata_list_element_free', 'libcerror_error_set']

0 147 libfdata_list_append_element call site: 00591 /src/libevt/libfdata/libfdata_list.c:1489
0 116 3 :

['free', 'libcerror_error_set', 'libcdata_range_list_free']

0 116 libbfio_handle_initialize call site: 00022 /src/libqcow/libbfio/libbfio_handle.c:140
0 113 4 :

['free', 'libfwnt_security_identifier_free', 'libcerror_error_set', 'libevt_strings_array_free']

0 113 libevt_event_record_read_data call site: 00334 /src/libevt/libevt/libevt_event_record.c:887

Runtime coverage analysis

Covered functions
130
Functions that are reachable but not covered
36
Reachable functions
166
Percentage of reachable functions covered
78.31%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libevt/ossfuzz/record_fuzzer.cc 1
libevt/libbfio/libbfio_memory_range.c 2
libevt/libcerror/libcerror_error.c 4
libevt/libbfio/libbfio_memory_range_io_handle.c 3
libevt/libbfio/libbfio_handle.c 10
libevt/libcdata/libcdata_range_list.c 15
libevt/libcdata/libcdata_list_element.c 10
libevt/libcdata/libcdata_range_list_value.c 3
libevt/libevt/libevt_file.c 7
libevt/libevt/libevt_io_handle.c 7
libevt/libfdata/libfdata_list.c 8
libevt/libcdata/libcdata_array.c 10
libevt/libevt/libevt_record_values.c 5
libevt/libevt/libevt_event_record.c 3
libevt/libfwnt/libfwnt_security_identifier.c 4
libevt/libevt/libevt_strings_array.c 3
libevt/libevt/libevt_end_of_file_record.c 3
libevt/libfdata/libfdata_list_element.c 7
libevt/libfdata/libfdata_range.c 4
libevt/libfcache/libfcache_cache.c 5
libevt/libcdata/libcdata_list.c 9
libevt/libfcache/libfcache_cache_value.c 8
libevt/libcthreads/libcthreads_read_write_lock.c 4
libevt/libcerror/libcerror_system.c 2
libevt/libfdata/libfdata_mapped_range.c 3
libevt/libevt/libevt_file_header.c 4
libevt/libfcache/libfcache_date_time.c 1
libevt/libevt/libevt_record.c 2

Fuzzer: libodraw_handle_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 524 80.2%
gold [1:9] 10 1.53%
yellow [10:29] 2 0.30%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 117 17.9%
All colors 653 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
264 264 2 :

['libbfio_pool_close_all', 'libbfio_pool_free']

264 776 libodraw_handle_close call site: 00549 /src/libodraw/libodraw/libodraw_handle.c:1724
264 264 1 :

['libcdata_range_list_insert_range']

264 360 libbfio_internal_handle_read_buffer call site: 00179 /src/libqcow/libbfio/libbfio_handle.c:1139
168 2074 12 :

['libodraw_cue_parser_parse_msf', 'libodraw_handle_append_track', 'libodraw_cue_parser_parse_number', 'yygrowstack', 'libodraw_handle_append_session', 'libodraw_handle_append_data_file', 'memcmp', 'libodraw_cue_scanner_lex', 'libodraw_handle_append_lead_out', 'libodraw_cue_parser_parse_track_type', 'libodraw_cue_scanner_error', 'libcerror_error_set']

168 2074 libodraw_cue_scanner_parse call site: 00511 /src/libodraw/libodraw/libodraw_cue_parser.c:2177
164 292 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']

164 292 libcdata_range_list_empty call site: 00030 /src/libqcow/libcdata/libcdata_range_list.c:326
79 79 1 :

['libodraw_handle_append_session']

158 373 libodraw_cue_parser_parse_buffer call site: 00514 /src/libodraw/libodraw/libodraw_cue_parser.c:1186
79 79 1 :

['libodraw_handle_append_lead_out']

79 262 libodraw_cue_parser_parse_buffer call site: 00518 /src/libodraw/libodraw/libodraw_cue_parser.c:1204
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 262 3 :

['free', 'libcdata_array_free', 'libcerror_error_set']

0 262 libodraw_handle_initialize call site: 00091 /src/libodraw/libodraw/libodraw_handle.c:189
0 254 1 :

['libodraw_handle_close']

0 744 libodraw_handle_free call site: 00634 /src/libodraw/libodraw/libodraw_handle.c:278
0 116 3 :

['free', 'libcerror_error_set', 'libcdata_range_list_free']

0 116 libbfio_handle_initialize call site: 00022 /src/libqcow/libbfio/libbfio_handle.c:140
0 99 1 :

['libbfio_handle_free']

264 907 libodraw_handle_close call site: 00541 /src/libodraw/libodraw/libodraw_handle.c:1705
0 69 2 :

['libcerror_error_set', 'libodraw_data_file_descriptor_free']

0 69 libodraw_handle_append_data_file call site: 00400 /src/libodraw/libodraw/libodraw_handle.c:6253

Runtime coverage analysis

Covered functions
68
Functions that are reachable but not covered
62
Reachable functions
130
Percentage of reachable functions covered
52.31%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libodraw/ossfuzz/handle_fuzzer.cc 1
libodraw/libbfio/libbfio_memory_range.c 2
libodraw/libcerror/libcerror_error.c 3
libodraw/libbfio/libbfio_memory_range_io_handle.c 3
libodraw/libbfio/libbfio_handle.c 9
libodraw/libcdata/libcdata_range_list.c 15
libodraw/libcdata/libcdata_list_element.c 10
libodraw/libcdata/libcdata_range_list_value.c 3
libodraw/libodraw/libodraw_handle.c 9
libodraw/libcdata/libcdata_array.c 8
libodraw/libodraw/libodraw_io_handle.c 3
libodraw/libodraw/libodraw_track_value.c 3
libodraw/libodraw/libodraw_sector_range.c 3
libodraw/libodraw/libodraw_cue_parser.c 6
libodraw/libodraw/libodraw_cue_scanner.c 17
libodraw/libodraw/libodraw_cue_scanner.l 5
libodraw/libodraw/libodraw_data_file_descriptor.c 3
libodraw/libbfio/libbfio_pool.c 3
libodraw/libcdata/libcdata_list.c 3

Fuzzer: libfplist_property_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 192 75.8%
gold [1:9] 4 1.58%
yellow [10:29] 3 1.18%
greenyellow [30:49] 7 2.76%
lawngreen 50+ 47 18.5%
All colors 253 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
85 85 8 :

['getc', 'fread', 'ferror', '__errno_location', 'libfplist_xml_scanner_realloc', 'yy_fatal_error', 'libfplist_xml_scanner_restart', 'clearerr']

85 85 yy_get_next_buffer call site: 00057 /src/libfplist/libfplist/libfplist_xml_scanner.c:158629
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
4 4 1 :

['memcmp']

4 4 libfplist_xml_tag_get_value_type call site: 00239 /src/libfplist/libfplist/libfplist_xml_tag.c:340
0 78 3 :

['free', 'libcdata_array_free', 'libcerror_error_set']

0 78 libfplist_xml_tag_initialize call site: 00099 /src/libfplist/libfplist/libfplist_xml_tag.c:169
0 70 2 :

['libfplist_xml_attribute_free', 'libcerror_error_set']

0 70 libfplist_xml_tag_append_attribute call site: 00159 /src/libfplist/libfplist/libfplist_xml_tag.c:598
0 68 1 :

['libfplist_xml_tag_free']

0 68 libfplist_property_list_copy_from_byte_stream call site: 00215 /src/libfplist/libfplist/libfplist_property_list.c:490
0 64 1 :

['libcerror_error_set']

0 64 libcdata_internal_array_resize call site: 00123 /src/libfplist/libcdata/libcdata_array.c:823
0 41 1 :

['libfplist_xml_tag_compare_name']

0 169 libfplist_property_initialize call site: 00222 /src/libfplist/libfplist/libfplist_property.c:84
0 38 1 :

['libfplist_xml_attribute_free']

0 38 libfplist_xml_tag_append_attribute call site: 00160 /src/libfplist/libfplist/libfplist_xml_tag.c:616
0 32 1 :

['libcerror_error_set']

0 135 libfplist_xml_parser_parse_buffer call site: 00167 /src/libfplist/libfplist/libfplist_xml_parser.c:463
0 32 2 :

['free', 'libcerror_error_set']

0 32 libcdata_array_initialize call site: 00096 /src/libfplist/libcdata/libcdata_array.c:162
0 32 1 :

['libcerror_error_set']

0 32 libcdata_array_free call site: 00103 /src/libfplist/libcdata/libcdata_array.c:260

Runtime coverage analysis

Covered functions
46
Functions that are reachable but not covered
21
Reachable functions
67
Percentage of reachable functions covered
68.66%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libfplist/ossfuzz/property_fuzzer.cc 1
libfplist/libfplist/libfplist_property_list.c 5
libfplist/libcerror/libcerror_error.c 3
libfplist/libfplist/libfplist_xml_parser.c 3
libfplist/libfplist/libfplist_xml_scanner.c 17
libfplist/libfplist/libfplist_xml_scanner.l 5
libfplist/libfplist/libfplist_xml_tag.c 9
libfplist/libcdata/libcdata_array.c 7
libfplist/libfplist/libfplist_xml_attribute.c 2
libfplist/libfplist/libfplist_property.c 3

Fuzzer: libfsapfs_container_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 518 74.1%
gold [1:9] 6 0.85%
yellow [10:29] 3 0.42%
greenyellow [30:49] 49 7.01%
lawngreen 50+ 123 17.5%
All colors 699 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
271 718 9 :

['libfsapfs_checksum_calculate_fletcher64', 'libfsapfs_key_bag_header_read_data', 'libfsapfs_key_bag_entry_initialize', 'libfsapfs_key_bag_entry_free', 'libfsapfs_key_bag_header_free', 'libfsapfs_key_bag_entry_read_data', 'libfsapfs_key_bag_header_initialize', 'libcdata_array_append_entry', 'libcerror_error_set']

271 718 libfsapfs_container_key_bag_read_data call site: 00578 /src/libfsapfs/libfsapfs/libfsapfs_container_key_bag.c:504
264 264 1 :

['libcdata_range_list_insert_range']

264 360 libbfio_internal_handle_read_buffer call site: 00149 /src/libqcow/libbfio/libbfio_handle.c:1139
164 292 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']

164 292 libcdata_range_list_empty call site: 00030 /src/libqcow/libcdata/libcdata_range_list.c:326
146 274 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_list_element_set_next_element', 'libcdata_list_element_free', 'libcerror_error_set']

146 274 libcdata_list_empty call site: 00618 /src/libqcow/libcdata/libcdata_list.c:238
46 46 1 :

['libcerror_system_set_error']

46 46 libcthreads_read_write_lock_release_for_write call site: 00654 /src/libqcow/libcthreads/libcthreads_read_write_lock.c:673
38 142 4 :

['libfdata_mapped_range_free', 'libcdata_array_set_entry_by_index', 'libcerror_error_set', 'libfdata_range_free']

38 142 libfdata_segments_array_append_segment call site: 00427 /src/libqcow/libfdata/libfdata_segments_array.c:592
38 38 1 :

['libcdata_array_set_entry_by_index']

38 74 libfdata_segments_array_append_segment call site: 00429 /src/libqcow/libfdata/libfdata_segments_array.c:642
36 36 1 :

['libfsapfs_fusion_middle_tree_free']

36 571 libfsapfs_container_close call site: 00678 /src/libfsapfs/libfsapfs/libfsapfs_container.c:922
36 36 1 :

['libfsapfs_fusion_middle_tree_free']

36 108 libfsapfs_internal_container_open_read call site: 00643 /src/libfsapfs/libfsapfs/libfsapfs_container.c:1861
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 270 1 :

['libfsapfs_container_close']

0 469 libfsapfs_container_free call site: 00691 /src/libfsapfs/libfsapfs/libfsapfs_container.c:178
0 124 3 :

['free', 'libcdata_array_free', 'libcerror_error_set']

0 124 libfdata_vector_initialize call site: 00396 /src/libqcow/libfdata/libfdata_vector.c:180

Runtime coverage analysis

Covered functions
99
Functions that are reachable but not covered
71
Reachable functions
170
Percentage of reachable functions covered
58.24%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
libfsapfs/ossfuzz/container_fuzzer.cc 1
libfsapfs/libbfio/libbfio_memory_range.c 2
libfsapfs/libcerror/libcerror_error.c 3
libfsapfs/libbfio/libbfio_memory_range_io_handle.c 3
libfsapfs/libbfio/libbfio_handle.c 8
libfsapfs/libcdata/libcdata_range_list.c 15
libfsapfs/libcdata/libcdata_list_element.c 10
libfsapfs/libcdata/libcdata_range_list_value.c 3
libfsapfs/libfsapfs/libfsapfs_container.c 5
libfsapfs/libfsapfs/libfsapfs_io_handle.c 3
libfsapfs/libcthreads/libcthreads_read_write_lock.c 4
libfsapfs/libcerror/libcerror_system.c 2
libfsapfs/libfsapfs/libfsapfs_container_superblock.c 4
libfsapfs/libfsapfs/libfsapfs_checksum.c 1
libfsapfs/libfsapfs/libfsapfs_object.c 4
libfsapfs/libfsapfs/libfsapfs_checkpoint_map.c 4
libfsapfs/libcdata/libcdata_array.c 6
libfsapfs/libfsapfs/libfsapfs_checkpoint_map_entry.c 3
libfsapfs/libfsapfs/libfsapfs_container_data_handle.c 2
libfsapfs/libfdata/libfdata_vector.c 3
libfsapfs/libfcache/libfcache_date_time.c 1
libfsapfs/libfdata/libfdata_segments_array.c 1
libfsapfs/libfdata/libfdata_mapped_range.c 3
libfsapfs/libfdata/libfdata_range.c 3
libfsapfs/libfsapfs/libfsapfs_object_map.c 4
libfsapfs/libfsapfs/libfsapfs_object_map_btree.c 2
libfsapfs/libfcache/libfcache_cache.c 2
libfsapfs/libcdata/libcdata_list.c 3
libfsapfs/libfsapfs/libfsapfs_container_key_bag.c 4
libfsapfs/libfsapfs/libfsapfs_encryption_context.c 4
libfsapfs/libcaes/libcaes_tweaked_context.c 4
libfsapfs/libcaes/libcaes_context.c 7
libfsapfs/libfsapfs/libfsapfs_key_bag_header.c 3
libfsapfs/libfsapfs/libfsapfs_key_bag_entry.c 3
libfsapfs/libfcache/libfcache_cache_value.c 1
libfsapfs/libfsapfs/libfsapfs_fusion_middle_tree.c 1

Fuzzer: liblnk_file_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 437 71.5%
gold [1:9] 19 3.10%
yellow [10:29] 19 3.10%
greenyellow [30:49] 27 4.41%
lawngreen 50+ 109 17.8%
All colors 611 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
264 264 1 :

['libcdata_range_list_insert_range']

264 360 libbfio_internal_handle_read_buffer call site: 00166 /src/libqcow/libbfio/libbfio_handle.c:1139
164 292 5 :

['libcdata_list_element_set_previous_element', 'libcdata_list_element_get_next_element', 'libcdata_internal_range_list_free_element', 'libcdata_list_element_set_next_element', 'libcerror_error_set']

164 292 libcdata_range_list_empty call site: 00030 /src/libqcow/libcdata/libcdata_range_list.c:326
16 16 5 :

['free', 'libcerror_error_resize', 'libcerror_error_initialize', 'strlen', 'realloc']

16 16 libcerror_error_set call site: 00002 /src/libcaes/libcerror/libcerror_error.c:328
0 194 1 :

['liblnk_file_close']

0 471 liblnk_file_free call site: 00599 /src/liblnk/liblnk/liblnk_file.c:201
0 116 3 :

['free', 'libcerror_error_set', 'libcdata_range_list_free']

0 116 libbfio_handle_initialize call site: 00022 /src/libqcow/libbfio/libbfio_handle.c:140
0 116 3 :

['libcerror_error_set', 'libcdata_array_empty', 'liblnk_internal_data_block_free']

0 116 liblnk_internal_file_read_extra_data_blocks call site: 00457 /src/liblnk/liblnk/liblnk_file.c:1799
0 99 1 :

['libbfio_handle_free']

0 966 liblnk_file_close call site: 00569 /src/liblnk/liblnk/liblnk_file.c:799
0 69 2 :

['liblnk_data_string_free', 'libcerror_error_set']

0 69 liblnk_strings_data_block_read call site: 00470 /src/liblnk/liblnk/liblnk_strings_data_block.c:257
0 69 2 :

['liblnk_data_string_free', 'libcerror_error_set']

0 69 liblnk_strings_data_block_read call site: 00472 /src/liblnk/liblnk/liblnk_strings_data_block.c:291
0 68 2 :

['libcerror_error_set', 'libbfio_memory_range_io_handle_free']

0 68 libbfio_memory_range_initialize call site: 00059 /src/libqcow/libbfio/libbfio_memory_range.c:83
0 68 3 :

['free', 'libcerror_error_set', 'liblnk_io_handle_free']