High level conclusions

Fuzzers reach 73.09% of cyclomatic complexity.

Fuzzers reach 67.99% of all functions.

Fuzzer lys_parse_mem is blocked:

The runtime code coverage of lys_parse_mem covers 29.71% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1141/1678

Cyclomatic complexity statically reachable by fuzzers

15688/21462

Functions covered at runtime

656

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: lys_parse_mem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7185	85.9%
gold	[1:9]	103	1.23%
yellow	[10:29]	30	0.35%
greenyellow	[30:49]	18	0.21%
lawngreen	50+	1020	12.2%
All colors	8356	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
566	566	3 : View List ['lysc_iffeature_value', 'lys_compile_iffeature', 'lysc_iffeature_free']	566	566	lys_eval_iffeatures	call site	/src/libyang/src/schema_features.c:514
392	392	1 : View List ['lyxp_next_token2']	392	1366	ly_path_check_predicate	call site	/src/libyang/src/path.c:118
60	3315	5 : View List ['lyxp_next_token', 'ly_path_compile_snode', 'lys_nodetype2str', 'lysc_data_node', 'ly_vlog']	60	3315	ly_path_compile_predicate_leafref	call site	/src/libyang/src/path.c:717
20	20	1 : View List ['calloc']	20	74	lys_compile_type_	call site	/src/libyang/src/schema_compile_node.c:1910
10	10	1 : View List ['ly_format2str']	10	448	ly_path_compile_snode	call site	/src/libyang/src/path.c:457
6	232	5 : View List ['free', 'ly_set_add', 'ly_log', 'calloc', 'realloc']	6	232	lysc_unres_must_add	call site	/src/libyang/src/schema_compile_node.c:81
2	2	1 : View List ['fclose']	9	9	ly_in_free	call site	/src/libyang/src/in.c:270
2	2	1 : View List ['atoi']	2	938	ly_path_check_predicate	call site	/src/libyang/src/path.c:130
0	279	2 : View List ['lysc_type_free', 'free']	0	279	ly_path_predicates_free	call site	/src/libyang/src/path.c:1158
0	268	1 : View List ['ly_path_free']	0	352	_ly_path_compile	call site	/src/libyang/src/path.c:964
0	168	1 : View List ['lydict_insert_zc']	0	352	lyplg_type_store_boolean	call site	/src/libyang/src/plugins_types/boolean.c:86
0	145	2 : View List ['lyht_set_cb', 'lyht_resize']	0	145	lyht_remove_with_resize_cb	call site	/src/libyang/src/hash_table.c:836

Runtime coverage analysis

Covered functions

363

Functions that are reachable but not covered

802

Reachable functions

1141

Percentage of reachable functions covered

29.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lys_parse_mem.c	1
src/log.c	17
src/context.c	21
src/hash_table.c	25
src/plugins.c	7
src/set.c	11
src/in.c	7
src/tree_schema.c	28
src/parser_yin.c	75
src/xml.c	25
src/tree_schema_common.c	54
src/tree_data.c	44
src/tree_data.h	3
src/tree_data_common.c	27
src/common.c	13
src/plugins_exts.c	4
src/plugins_types.c	16
src/path.c	12
src/xpath.c	159
compat/compat.c	1
src/tree_schema_free.c	49
src/parser_yang.c	60
src/parser_common.c	8
src/schema_features.c	15
src/schema_compile.c	32
src/schema_compile_amend.c	41
src/schema_compile_node.c	52
src/parser_xml.c	18
src/tree_data_free.c	11
src/tree_data_new.c	11
src/tree_data_hash.c	5
src/parser_lyb.c	41
src/validation.c	16
src/diff.c	16
src/plugins_exts/metadata.h	1
src/parser_json.c	22
src/json.c	22
src/lyb.c	5
src/out.c	9
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	24
src/printer_lyb.c	31

Fuzzer: lyd_parse_mem_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7027	84.0%
gold	[1:9]	257	3.07%
yellow	[10:29]	132	1.57%
greenyellow	[30:49]	16	0.19%
lawngreen	50+	925	11.0%
All colors	8357	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11373	13473	11 : View List ['ly_log_location', 'ly_set_rm_index', 'ly_set_contains', 'lyd_del_move_root', 'ly_set_rm_index_ordered', 'lyd_val_diff_add', 'lyd_child.4673', 'ly_log_location_revert', 'lyd_validate_node_when', 'lyd_free_tree', 'ly_vlog']	11373	13473	lyd_validate_unres_when	call site	/src/libyang/src/validation.c:198
1165	1165	2 : View List ['lydjson_check_list', 'lys_value_validate']	1165	1863	lydjson_data_check_opaq	call site	/src/libyang/src/parser_json.c:518
1108	1108	1 : View List ['lydjson_metadata']	1108	1108	lydjson_parse_attribute	call site	/src/libyang/src/parser_json.c:1163
886	886	1 : View List ['lyplg_ext_insert']	886	886	lydjson_maintain_children	call site	/src/libyang/src/parser_json.c:928
611	1796	10 : View List ['lyd_lyb_data_length', 'lyxml_value_compare', 'ly_log', 'lysc_node_child', 'memcmp', 'lyd_compare_single_', 'lyd_get_value.239', 'strcmp', 'lyd_child.229', 'strlen']	611	1796	lyd_compare_single_	call site	/src/libyang/src/tree_data.c:1212
379	379	1 : View List ['lyb_fill_subvalue']	379	753	lyplg_type_store_union	call site	/src/libyang/src/plugins_types/union.c:335
224	227	2 : View List ['lyd_parent', 'lyd_dup_find_schema']	4535	6443	lyd_find_sibling_val	call site	/src/libyang/src/tree_data.c:2548
213	213	1 : View List ['lyd_free_attr_single']	213	213	lyd_create_attr	call site	/src/libyang/src/tree_data.c:1075
44	44	2 : View List ['lyd_compare_schema_equal', 'lyd_compare_schema_parents_equal']	655	1840	lyd_compare_single_	call site	/src/libyang/src/tree_data.c:1194
20	20	1 : View List ['calloc']	20	74	lys_compile_type_	call site	/src/libyang/src/schema_compile_node.c:1910
17	386	3 : View List ['lyjson_token2str', 'ly_vlog', 'lys_nodetype2str']	17	1764	lydjson_subtree_r	call site	/src/libyang/src/parser_json.c:1613
11	11	1 : View List ['lyb_parse_union']	11	11	union_store_type	call site	/src/libyang/src/plugins_types/union.c:175

Runtime coverage analysis

Covered functions

558

Functions that are reachable but not covered

643

Reachable functions

1141

Percentage of reachable functions covered

43.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_json.c	1
src/log.c	17
src/context.c	21
src/hash_table.c	25
src/plugins.c	7
src/set.c	11
src/in.c	7
src/tree_schema.c	28
src/parser_yin.c	75
src/xml.c	25
src/tree_schema_common.c	54
src/tree_data.c	44
src/tree_data.h	3
src/tree_data_common.c	27
src/common.c	13
src/plugins_exts.c	4
src/plugins_types.c	16
src/path.c	12
src/xpath.c	159
compat/compat.c	1
src/tree_schema_free.c	49
src/parser_yang.c	60
src/parser_common.c	8
src/schema_features.c	15
src/schema_compile.c	32
src/schema_compile_amend.c	41
src/schema_compile_node.c	52
src/parser_xml.c	18
src/tree_data_free.c	11
src/tree_data_new.c	11
src/tree_data_hash.c	5
src/parser_lyb.c	41
src/validation.c	16
src/diff.c	16
src/plugins_exts/metadata.h	1
src/parser_json.c	22
src/json.c	22
src/lyb.c	5
src/out.c	9
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	24
src/printer_lyb.c	31

Fuzzer: lyd_parse_mem_xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6721	80.4%
gold	[1:9]	48	0.57%
yellow	[10:29]	28	0.33%
greenyellow	[30:49]	15	0.17%
lawngreen	50+	1545	18.4%
All colors	8357	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
11373	13473	11 : View List ['ly_log_location', 'ly_set_rm_index', 'ly_set_contains', 'lyd_del_move_root', 'ly_set_rm_index_ordered', 'lyd_val_diff_add', 'lyd_child.4673', 'ly_log_location_revert', 'lyd_validate_node_when', 'lyd_free_tree', 'ly_vlog']	11373	13473	lyd_validate_unres_when	call site	/src/libyang/src/validation.c:198
4335	4335	1 : View List ['lyplg_type_make_implemented']	4335	4397	identityref_check_ident	call site	/src/libyang/src/plugins_types/identityref.c:205
1429	1772	5 : View List ['lydxml_get_hints_opaq', 'ly_store_prefix_data', 'lyd_create_opaq', 'strlen', 'lyxml_ns_get']	3039	12107	lydxml_subtree_r	call site	/src/libyang/src/parser_xml.c:667
1379	1379	1 : View List ['lyd_dup_single_to_ctx']	1379	7350	lyd_find_sibling_first	call site	/src/libyang/src/tree_data.c:2463
1369	3811	6 : View List ['lyxml_ctx_backup', 'lyxml_ctx_next', 'ly_log', 'lydxml_check_list', 'lys_value_validate', 'lyxml_ctx_restore']	1369	3811	lydxml_data_check_opaq	call site	/src/libyang/src/parser_xml.c:364
1193	1193	1 : View List ['lydxml_attrs']	8381	37439	lydxml_subtree_r	call site	/src/libyang/src/parser_xml.c:656
886	2672	4 : View List ['lyplg_ext_insert', 'lyd_free_meta_siblings', 'lyd_free_attr_siblings', 'lyd_free_tree']	886	2904	lydxml_subtree_r	call site	/src/libyang/src/parser_xml.c:870
715	715	1 : View List ['lyd_insert_after']	715	863	lydxml_subtree_r	call site	/src/libyang/src/parser_xml.c:868
379	379	1 : View List ['lyb_fill_subvalue']	379	753	lyplg_type_store_union	call site	/src/libyang/src/plugins_types/union.c:335
267	267	1 : View List ['lyxml_value_compare']	273	861	lyd_compare_single_	call site	/src/libyang/src/tree_data.c:1217
224	227	2 : View List ['lyd_parent', 'lyd_dup_find_schema']	2327	6443	lyd_find_sibling_val	call site	/src/libyang/src/tree_data.c:2548
64	669	7 : View List ['ly_log', 'free', 'lyd_value_store', 'lydict_insert', 'lyplg_ext_get_storage', 'lyd_insert_meta', 'calloc']	64	669	lyd_create_meta	call site	/src/libyang/src/tree_data.c:968

Runtime coverage analysis

Covered functions

584

Functions that are reachable but not covered

630

Reachable functions

1141

Percentage of reachable functions covered

44.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_xml.c	1
src/log.c	17
src/context.c	21
src/hash_table.c	25
src/plugins.c	7
src/set.c	11
src/in.c	7
src/tree_schema.c	28
src/parser_yin.c	75
src/xml.c	25
src/tree_schema_common.c	54
src/tree_data.c	44
src/tree_data.h	3
src/tree_data_common.c	27
src/common.c	13
src/plugins_exts.c	4
src/plugins_types.c	16
src/path.c	12
src/xpath.c	159
compat/compat.c	1
src/tree_schema_free.c	49
src/parser_yang.c	60
src/parser_common.c	8
src/schema_features.c	15
src/schema_compile.c	32
src/schema_compile_amend.c	41
src/schema_compile_node.c	52
src/parser_xml.c	18
src/tree_data_free.c	11
src/tree_data_new.c	11
src/tree_data_hash.c	5
src/parser_lyb.c	41
src/validation.c	16
src/diff.c	16
src/plugins_exts/metadata.h	1
src/parser_json.c	22
src/json.c	22
src/lyb.c	5
src/out.c	9
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	24
src/printer_lyb.c	31

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
structure_aug_parse	/src/libyang/src/plugins_exts/structure.c	2	['struct.lysp_ctx *', 'struct.lysp_ext_instance.2769 *']	12	0	596	37	15	179	0	2141	960
yang_print_parsed_submodule	/src/libyang/src/printer_yang.c	3	['struct.ly_out *', 'struct.lysp_submodule *', 'int ']	12	0	455	54	20	81	0	616	461
schema_mount_validate	/src/libyang/src/plugins_exts/schema_mount.c	6	['struct.lysc_ext_instance *', 'struct.lyd_node *', 'struct.lyd_node *', 'int ', 'int ', 'struct.lyd_node **']	28	0	543	86	31	736	0	8664	302
lyd_diff_siblings_r	/src/libyang/src/diff.c	5	['struct.lyd_node *', 'struct.lyd_node *', 'N/A', 'char ', 'struct.lyd_node **']	84	0	840	152	49	723	4	8619	265
yang_print_compiled	/src/libyang/src/printer_yang.c	3	['struct.ly_out *', 'struct.lys_module *', 'int ']	8	0	889	111	38	134	0	946	224
schema_mount_sprinter_ctree	/src/libyang/src/plugins_exts/schema_mount.c	4	['struct.lysc_ext_instance *', 'struct.lyspr_tree_ctx *', 'char **', 'char **']	29	0	501	78	29	799	0	9163	204
ly_ctx_get_yanglib_data	/src/libyang/src/context.c	3	['struct.ly_ctx *', 'struct.lyd_node **', 'char *']	36	0	715	113	48	726	0	8575	202
lyd_diff_apply_r	/src/libyang/src/diff.c	6	['struct.lyd_node **', 'struct.lyd_node *', 'struct.lyd_node *', 'func_type *', 'char *', 'struct.lyd_dup_inst **']	10	0	922	145	52	243	3	2652	189
lyd_new_ext_path	/src/libyang/src/tree_data_new.c	6	['struct.lyd_node *', 'struct.lysc_ext_instance *', 'char *', 'char *', 'int ', 'struct.lyd_node **']	14	0	264	49	20	230	0	2519	185
yangdata_compile	/src/libyang/src/plugins_exts/yangdata.c	3	['struct.lysc_ctx *', 'struct.lysp_ext_instance.2769 *', 'struct.lysc_ext_instance.2752 *']	14	0	378	40	15	303	0	4241	146

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1345/1678

Cyclomatic complexity statically reachable by fuzzers

18725 / 21462

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
log_vprintf	61	19	31.14%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_stmt_parse	164	24	14.63%	[]
lys_parser_fill_filepath	33	14	42.42%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_stmt_type_enum	44	18	40.90%	[]
lysp_stmt_type	79	30	37.97%	[]
lys_compile_extension_instance	143	66	46.15%
lys_compile	89	46	51.68%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_identity_circular_check	35	8	22.85%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_unres_mod	33	11	33.33%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_precompile_uses_augments_refines	64	18	28.12%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_dev_node_free	46	4	8.695%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_node_deviations_refines	90	21	23.33%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_node_augments	49	14	28.57%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_precompile_own_deviations	50	12	24.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_precompile_augments_deviations	95	22	23.15%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_type_	279	142	50.89%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_type_range	195	61	31.28%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_type_enums	128	63	49.21%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_node_connect	97	52	53.60%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysc_unres_must_add	33	13	39.39%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_node_list	137	60	43.79%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_node_leaflist	42	23	54.76%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_set_features	46	10	21.73%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_unres_glob_revert	36	10	27.77%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_parse_in	146	79	54.10%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_search_localfile	151	73	48.34%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_unres_dep_sets_create_mod_r	66	35	53.03%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_load_submodules	71	6	8.450%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_ext_instance_resolve_argument	47	4	8.510%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_check_dup_typedef	49	18	36.73%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_parse_localfile	36	13	36.11%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_ext_instance_substatements_free	86	43	50.0%
lyjson_value	43	21	48.83%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyjson_exp_number	115	33	28.69%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parser_find_operation	34	6	17.64%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parser_check_schema	51	13	25.49%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parse_set_data_flags	34	8	23.52%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parse_json	71	39	54.92%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lydjson_parse_opaq	38	13	34.21%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lydjson_value_type_hint	31	10	32.25%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lydjson_parse_instance	45	23	51.11%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lydjson_data_check_opaq	35	16	45.71%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
ly_path_compile_predicate	125	58	46.40%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_resolve_leafref	69	33	47.82%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_resolve_leafref_get_target_path	46	24	52.17%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_store_bits	54	28	51.85%	[]
lys_compile_iffeature	150	69	46.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_compare_single_	160	49	30.62%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_first_module_sibling	40	18	45.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
ly_dup_prefix_data	56	17	30.35%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_free_meta	34	5	14.70%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_new_implicit_r	108	45	41.66%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
_lys_set_implemented	39	16	41.02%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_datatype2str	44	6	13.63%	[]
lyd_validate_unres	57	29	50.87%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_unres_when	52	8	15.38%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_final_r	63	34	53.96%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_must	50	17	34.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_minmax	39	15	38.46%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyxp_set_cast	112	24	21.42%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
eval_expr_select	48	25	52.08%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_op_comp	75	29	38.66%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
set_comp_canonize	36	14	38.88%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
print_set_debug	101	8	7.920%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
set_sort_compare	40	8	20.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
eval_relative_location_path	98	52	53.06%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_axis_node_next	67	19	28.35%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_axis_node_next_first	73	27	36.98%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_resolve_model	40	17	42.5%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
eval_predicate	112	51	45.53%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
cast_string_recursive	108	27	25.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parse_xml	108	46	42.59%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lydxml_data_check_opaq	37	6	16.21%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_store_enum	64	28	43.75%	[]
identityref_check_base	34	14	41.17%	[]
lyd_create_meta	42	19	45.23%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_find_sibling_first	65	29	44.61%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_axis_scnode_next	102	32	31.37%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_axis_scnode_next_first	66	30	45.45%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_scnode_check	39	16	41.02%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
eval_function_call	188	43	22.87%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libyang/src/tree_data.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/validation.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/schema_compile_amend.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/decimal64.c	[]	[]
/src/libyang/src/schema_features.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/printer_lyb.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/parser_yin.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/schema_compile.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/date_and_time.c	[]	[]
/src/libyang/compat/compat.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/instanceid_keys.c	[]	[]
/src/libyang/src/tree_schema_free.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/set.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/parser_xml.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_xml']
/src/libyang/src/printer_json.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/log.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/context.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/xpath.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/identityref.c	[]	[]
/src/libyang/src/plugins_types/ipv4_address.c	[]	[]
/src/libyang/src/parser_json.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json']
/src/libyang/src/plugins_types/ipv6_address.c	[]	[]
/src/libyang/src/lyb.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/tree_data_hash.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/in.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_exts/metadata.c	[]	[]
/src/libyang/src/plugins_types/leafref.c	[]	[]
/src/libyang/src/schema_compile_node.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/binary.c	[]	[]
/src/libyang/src/plugins_types/node_instanceid.c	[]	[]
/src/libyang/src/tree_data_free.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/json.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json']
/src/libyang/src/plugins_types/union.c	[]	[]
/src/libyang/src/tree_schema_common.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/xml.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_xml']
/src/libyang/build/../tests/fuzz/lyd_parse_mem_json.c	['lyd_parse_mem_json']	[]
/src/libyang/src/plugins_exts.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/plugins_types/integer.c	[]	[]
/src/libyang/src/plugins_types/xpath1.0.c	[]	[]
/src/libyang/src/plugins_types/bits.c	[]	[]
/src/libyang/src/plugins_types/ipv4_prefix.c	[]	[]
/src/libyang/src/plugins_exts/nacm.c	[]	[]
/src/libyang/src/plugins_types/empty.c	[]	[]
/src/libyang/src/hash_table.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/tree_schema.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/build/../tests/fuzz/lyd_parse_mem_xml.c	['lyd_parse_mem_xml']	[]
/src/libyang/src/plugins_types/ipv6_address_no_zone.c	[]	[]
/src/libyang/src/printer_xml.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/tree_data_common.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/parser_yang.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_exts/schema_mount.c	[]	[]
/src/libyang/src/parser_lyb.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/plugins_types/enumeration.c	[]	[]
/src/libyang/src/plugins_types/ipv4_address_no_zone.c	[]	[]
/src/libyang/src/plugins_types/ipv6_prefix.c	[]	[]
/src/libyang/src/path.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_exts/yangdata.c	[]	[]
/src/libyang/src/plugins_types/string.c	[]	[]
/src/libyang/build/../tests/fuzz/lys_parse_mem.c	['lys_parse_mem']	[]
/src/libyang/src/printer_yang.c	[]	[]
/src/libyang/src/parser_common.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/out.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/diff.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/plugins.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_exts/structure.c	[]	[]
/src/libyang/src/tree_data_new.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/instanceid.c	[]	[]
/src/libyang/src/common.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/boolean.c	[]	[]
/src/libyang/src/printer_data.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/tree_data.h	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_exts/metadata.h	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]

Directories in report

Directory
/src/libyang/build/../tests/fuzz/
/src/libyang/src/plugins_types/
/src/libyang/src/
/src/libyang/src/plugins_exts/
/src/libyang/compat/