High level conclusions

Fuzzers reach 65.74% of cyclomatic complexity.

Fuzzers reach 62.22% of all functions.

Fuzzer lys_parse_mem is blocked:

The runtime code coverage of lys_parse_mem covers 27.88% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1102 / 1771

Cyclomatic complexity statically reachable by fuzzers

15596 / 23722

Runtime code coverage of functions

735 / 1771

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: lys_parse_mem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5914	72.1%
gold	[1:9]	138	1.68%
yellow	[10:29]	85	1.03%
greenyellow	[30:49]	37	0.45%
lawngreen	50+	2022	24.6%
All colors	8196	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
47140	126766	12 : View List ['lys_compile_unres_must', 'lys_compile_unres_depset_implement', 'lys_compile_unres_disabled_bitenum', 'lys_compile_unres_llist_dflts', 'ly_set_rm_index', 'lys_compile_unres_leafref', 'lysc_unres_dflt_free', 'lys_compile_unres_when', 'lys_compile_unres_leaf_dlft', 'lysc_unres_must_free', 'free', 'lysc_type_free']	63274	176860	lys_compile_unres_depset	call site: 08127	/src/libyang/src/schema_compile.c:1433
15754	15754	1 : View List ['lys_compile_node_list_unique']	15754	62857	lys_compile_node_list	call site: 00000	/src/libyang/src/schema_compile_node.c:3545
15711	15714	2 : View List ['lysc_data_node', 'lys_compile_when']	15715	48003	lys_compile_node_	call site: 04996	/src/libyang/src/schema_compile_node.c:2751
15709	15709	1 : View List ['ly_vlog_build_data_path']	15709	15709	ly_vlog_build_path_line	call site: 00157	/src/libyang/src/log.c:816
15707	31701	5 : View List ['ly_vlog', 'ly_log', 'calloc', 'lyxp_expr_free', 'reparse_or_expr']	15707	31876	lyxp_expr_parse	call site: 00378	/src/libyang/src/xpath.c:3207
334	459	5 : View List ['strdup', 'ly_ctx_set_searchdir', 'strchr', 'ly_log', 'free']	334	48943	ly_ctx_new	call site: 00101	/src/libyang/src/context.c:332
223	223	1 : View List ['lysc_unres_llist_dflts_add']	223	47320	lys_compile_node_leaflist	call site: 00000	/src/libyang/src/schema_compile_node.c:3090
173	173	1 : View List ['lysp_yin_ctx_free']	173	173	lys_parse_in	call site: 03951	/src/libyang/src/tree_schema.c:1977
138	138	1 : View List ['lysc_patterns_dup']	146	33006	lys_compile_type_patterns	call site: 05614	/src/libyang/src/schema_compile_node.c:1377
60	125697	5 : View List ['lyxp_next_token', 'ly_vlog', 'lysc_data_node', 'ly_path_compile_snode', 'lys_nodetype2str']	60	125697	ly_path_compile_predicate_leafref	call site: 00713	/src/libyang/src/path.c:840
16	16	1 : View List ['lysp_path_until']	28	528	lysp_resolve_ext_instance_log_path	call site: 03995	/src/libyang/src/tree_schema.c:1308
6	6	3 : View List ['stat', 'strerror', '__errno_location']	6	516	lys_search_localfile_file_type	call site: 04253	/src/libyang/src/tree_schema.c:2128

Runtime coverage analysis

Covered functions

373

Functions that are reachable but not covered

843

Reachable functions

1169

Percentage of reachable functions covered

27.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lys_parse_mem.c	1
src/log.c	25
src/context.c	25
src/hash_table.c	21
src/dict.c	8
src/hash_table_internal.h	1
src/plugins.c	6
src/set.c	11
src/in.c	5
src/tree_schema.c	30
src/parser_yin.c	76
src/xml.c	24
src/tree_schema_common.c	54
src/tree_data.c	64
src/tree_data.h	3
src/tree_data_common.c	36
src/ly_common.c	11
src/plugins_exts.c	6
src/plugins_exts/schema_mount.c	3
src/path.c	16
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	7
src/tree_schema_free.c	49
src/tree_data_new.c	16
src/tree_data_hash.c	5
src/tree_data_sorted.c	32
src/tree_data_free.c	13
src/parser_lyb.c	39
build/libyang/tree_data.h	1
src/parser_yang.c	60
src/parser_common.c	10
src/schema_features.c	15
src/schema_compile.c	34
src/schema_compile_amend.c	39
src/schema_compile_node.c	23
src/parser_xml.c	15
src/parser_json.c	22
src/json.c	21
src/lyb.c	5
src/validation.c	27
src/diff.c	18
src/plugins_exts/metadata.h	1
src/out.c	10
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	31

Fuzzer: lyd_parse_mem_xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5530	67.4%
gold	[1:9]	50	0.60%
yellow	[10:29]	49	0.59%
greenyellow	[30:49]	14	0.17%
lawngreen	50+	2555	31.1%
All colors	8198	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
47140	126766	12 : View List ['lys_compile_unres_must', 'lys_compile_unres_depset_implement', 'lys_compile_unres_disabled_bitenum', 'lys_compile_unres_llist_dflts', 'ly_set_rm_index', 'lys_compile_unres_leafref', 'lysc_unres_dflt_free', 'lys_compile_unres_when', 'lys_compile_unres_leaf_dlft', 'lysc_unres_must_free', 'free', 'lysc_type_free']	63274	176860	lys_compile_unres_depset	call site: 08127	/src/libyang/src/schema_compile.c:1433
31432	31432	2 : View List ['lys_getnext_data', 'lyd_validate_autodel_node_del']	31432	31432	lyd_validate_autodel_case_dflt	call site: 06694	/src/libyang/src/validation.c:749
31420	31424	3 : View List ['set_scnode_clear_ctx', 'moveto_attr', 'moveto_attr_alldesc']	31420	63260	eval_name_test_with_predicate	call site: 07622	/src/libyang/src/xpath.c:8175
15754	15754	1 : View List ['lys_compile_node_list_unique']	15754	62857	lys_compile_node_list	call site: 00000	/src/libyang/src/schema_compile_node.c:3545
15722	15722	1 : View List ['lydxml_subtree_any']	47159	126904	lydxml_subtree_r	call site: 05753	/src/libyang/src/parser_xml.c:1078
15720	15720	1 : View List ['lyd_insert_after']	15720	16229	lydxml_subtree_r	call site: 05753	/src/libyang/src/parser_xml.c:1120
15718	15721	2 : View List ['lyd_parent', 'lyd_find_schema_ctx']	31421	78629	lyd_find_sibling_val	call site: 00862	/src/libyang/src/tree_data.c:3174
15712	15712	1 : View List ['lydxml_attrs']	78587	189789	lydxml_subtree_r	call site: 05725	/src/libyang/src/parser_xml.c:1060
15711	15714	2 : View List ['lysc_data_node', 'lys_compile_when']	15715	48003	lys_compile_node_	call site: 04996	/src/libyang/src/schema_compile_node.c:2751
15711	15711	1 : View List ['moveto_scnode_alldesc_child']	31416	63252	eval_name_test_with_predicate	call site: 07688	/src/libyang/src/xpath.c:8205
15711	15711	1 : View List ['lydxml_envelope']	31415	126399	lyd_parse_xml	call site: 05564	/src/libyang/src/parser_xml.c:1251
15711	15711	1 : View List ['moveto_node_alldesc_child']	15711	47547	eval_name_test_with_predicate	call site: 07706	/src/libyang/src/xpath.c:8240

Runtime coverage analysis

Covered functions

664

Functions that are reachable but not covered

616

Reachable functions

1169

Percentage of reachable functions covered

47.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_xml.c	1
src/log.c	25
src/context.c	25
src/hash_table.c	21
src/dict.c	8
src/hash_table_internal.h	1
src/plugins.c	6
src/set.c	11
src/in.c	5
src/tree_schema.c	30
src/parser_yin.c	76
src/xml.c	24
src/tree_schema_common.c	54
src/tree_data.c	64
src/tree_data.h	3
src/tree_data_common.c	36
src/ly_common.c	11
src/plugins_exts.c	6
src/plugins_exts/schema_mount.c	3
src/path.c	16
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	7
src/tree_schema_free.c	49
src/tree_data_new.c	16
src/tree_data_hash.c	5
src/tree_data_sorted.c	32
src/tree_data_free.c	13
src/parser_lyb.c	39
build/libyang/tree_data.h	1
src/parser_yang.c	60
src/parser_common.c	10
src/schema_features.c	15
src/schema_compile.c	34
src/schema_compile_amend.c	39
src/schema_compile_node.c	23
src/parser_xml.c	15
src/parser_json.c	22
src/json.c	21
src/lyb.c	5
src/validation.c	27
src/diff.c	18
src/plugins_exts/metadata.h	1
src/out.c	10
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	31

Fuzzer: lyd_parse_mem_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5804	70.7%
gold	[1:9]	319	3.89%
yellow	[10:29]	82	1.00%
greenyellow	[30:49]	39	0.47%
lawngreen	50+	1954	23.8%
All colors	8198	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
64100	95680	11 : View List ['memcmp', 'strlen', 'lyd_compare_single_data', 'lysc_node_child', 'lyd_compare_single_value', 'lyd_compare_single_schema', 'lyd_lyb_data_length', 'ly_log', 'lyd_child.321', 'strcmp', 'lyd_compare_siblings_']	64100	95680	lyd_compare_single_data	call site: 01086	/src/libyang/src/tree_data.c:1676
47140	126766	12 : View List ['lys_compile_unres_must', 'lys_compile_unres_depset_implement', 'lys_compile_unres_disabled_bitenum', 'lys_compile_unres_llist_dflts', 'ly_set_rm_index', 'lys_compile_unres_leafref', 'lysc_unres_dflt_free', 'lys_compile_unres_when', 'lys_compile_unres_leaf_dlft', 'lysc_unres_must_free', 'free', 'lysc_type_free']	63274	176860	lys_compile_unres_depset	call site: 08127	/src/libyang/src/schema_compile.c:1433
31442	47142	3 : View List ['lyd_find_sibling_first', 'lyd_create_list2', 'lyd_create_term']	31442	62849	lyd_find_sibling_val	call site: 00890	/src/libyang/src/tree_data.c:3198
31429	31429	2 : View List ['ly_value_validate', 'lydjson_check_list']	31429	47140	lydjson_data_check_opaq	call site: 06046	/src/libyang/src/parser_json.c:516
31420	31424	3 : View List ['set_scnode_clear_ctx', 'moveto_attr', 'moveto_attr_alldesc']	31420	63260	eval_name_test_with_predicate	call site: 07622	/src/libyang/src/xpath.c:8175
15876	15876	2 : View List ['lyht_find_next', 'lyd_find_sibling_first']	15876	32300	lyd_validate_duplicates	call site: 06687	/src/libyang/src/validation.c:460
15754	15754	1 : View List ['lys_compile_node_list_unique']	15754	62857	lys_compile_node_list	call site: 00000	/src/libyang/src/schema_compile_node.c:3545
15729	15729	1 : View List ['lydjson_parse_any']	15729	16412	lydjson_parse_instance	call site: 06073	/src/libyang/src/parser_json.c:1521
15724	15724	1 : View List ['moveto_node_hash_child']	15724	47560	eval_name_test_with_predicate	call site: 07715	/src/libyang/src/xpath.c:8243
15721	15721	1 : View List ['moveto_scnode']	15721	15721	xpath_pi_node	call site: 05266	/src/libyang/src/xpath.c:5567
15718	15721	2 : View List ['lyd_parent', 'lyd_find_schema_ctx']	47162	78629	lyd_find_sibling_val	call site: 00862	/src/libyang/src/tree_data.c:3174
15711	15714	2 : View List ['lysc_data_node', 'lys_compile_when']	15715	48003	lys_compile_node_	call site: 04996	/src/libyang/src/schema_compile_node.c:2751

Runtime coverage analysis

Covered functions

622

Functions that are reachable but not covered

641

Reachable functions

1169

Percentage of reachable functions covered

45.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_json.c	1
src/log.c	25
src/context.c	25
src/hash_table.c	21
src/dict.c	8
src/hash_table_internal.h	1
src/plugins.c	6
src/set.c	11
src/in.c	5
src/tree_schema.c	30
src/parser_yin.c	76
src/xml.c	24
src/tree_schema_common.c	54
src/tree_data.c	64
src/tree_data.h	3
src/tree_data_common.c	36
src/ly_common.c	11
src/plugins_exts.c	6
src/plugins_exts/schema_mount.c	3
src/path.c	16
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	7
src/tree_schema_free.c	49
src/tree_data_new.c	16
src/tree_data_hash.c	5
src/tree_data_sorted.c	32
src/tree_data_free.c	13
src/parser_lyb.c	39
build/libyang/tree_data.h	1
src/parser_yang.c	60
src/parser_common.c	10
src/schema_features.c	15
src/schema_compile.c	34
src/schema_compile_amend.c	39
src/schema_compile_node.c	23
src/parser_xml.c	15
src/parser_json.c	22
src/json.c	21
src/lyb.c	5
src/validation.c	27
src/diff.c	18
src/plugins_exts/metadata.h	1
src/out.c	10
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	31

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
structure_aug_parse	/src/libyang/src/plugins_exts/structure.c	2	['N/A', 'N/A']	52	0	568	37	15	1218	0	16667	971
yangdata_compile	/src/libyang/src/plugins_exts/yangdata.c	3	['N/A', 'N/A', 'N/A']	53	0	364	40	15	1190	0	16546	850
yang_print_parsed_submodule	/src/libyang/src/printer_yang.c	3	['N/A', 'N/A', 'int']	39	0	428	54	20	103	0	868	538
schema_mount_validate	/src/libyang/src/plugins_exts/schema_mount.c	6	['N/A', 'N/A', 'N/A', 'int', 'int', 'N/A']	60	0	539	88	32	1183	0	16040	344
lyd_parse_ext_op	/src/libyang/src/tree_data.c	7	['N/A', 'N/A', 'N/A', 'int', 'int', 'N/A', 'N/A']	58	0	124	20	9	1173	0	15973	277
lyd_diff_siblings_r	/src/libyang/src/diff.c	5	['N/A', 'N/A', 'short', 'char', 'N/A']	54	0	833	152	49	1169	4	15965	269
ly_ctx_get_yanglib_data	/src/libyang/src/context.c	3	['N/A', 'N/A', 'N/A']	52	0	711	113	48	1173	0	15937	222
yang_print_compiled	/src/libyang/src/printer_yang.c	3	['N/A', 'N/A', 'int']	44	0	832	111	38	1204	0	16102	222
schema_mount_sprinter_ctree	/src/libyang/src/plugins_exts/schema_mount.c	4	['N/A', 'N/A', 'N/A', 'N/A']	60	0	500	80	30	1184	0	15882	182
lyd_new_ext_path	/src/libyang/src/tree_data_new.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A']	57	0	261	49	20	1168	0	15882	179

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1336 / 1771

Cyclomatic complexity statically reachable by fuzzers

19601 / 23722

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

build/../tests/fuzz/lys_parse_mem.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ly_err_last', 'lys_compile_unres_depset', 'lysc_path_until', 'ly_store_prefix_data', 'lyxp_expr_dup', 'lyht_free', 'ly_ctx_get_module_latest', 'lys_compile_type_patterns', 'lys_search_localfile', 'lys_getnext_']

build/../tests/fuzz/lyd_parse_mem_xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lyd_parse_data_mem', 'lyd_parse_xml', 'lyd_validate_choice_r', 'lyxp_expr_dup', 'ly_store_prefix_data', 'ly_ctx_get_module_latest', 'lys_search_localfile', 'lysp_check_date', 'rb_iter_begin', 'lyd_new_implicit_r']

build/../tests/fuzz/lyd_parse_mem_json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lyd_parse_data_mem', 'lyd_validate_choice_r', 'lyxp_expr_dup', 'ly_store_prefix_data', 'lydjson_parse_instance', 'ly_ctx_get_module_latest', 'lys_search_localfile', 'lyd_validate_unres', 'lysp_check_date', 'rb_iter_begin']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
lys_parser_fill_filepath	33	14	42.42%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_parse_ext_instance_stmt	122	39	31.96%	[]
lysp_stmt_parse	207	26	12.56%	[]
lysp_stmt_type_enum	44	18	40.90%	[]
lysp_stmt_type	79	30	37.97%	[]
lys_compile_ext_instance_stmt	180	35	19.44%	[]
lys_compile	89	47	52.80%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_compile_identity_circular_check	35	8	22.85%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_compile_unres_depset_implement	65	26	40.0%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_compile_unres_mod	41	11	26.82%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_precompile_uses_augments_refines	64	18	28.12%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lysp_dev_node_free	46	4	8.695%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_compile_node_deviations_refines	52	14	26.92%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_compile_node_augments	50	14	28.00%	[]
lys_precompile_own_deviations	50	12	24.0%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_precompile_augments_deviations	38	15	39.47%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_precompile_mod_augments_deviations	61	22	36.06%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_compile_type_range	195	63	32.30%	[]
lys_compile_type_enums	128	63	49.21%	[]
lys_compile_node_connect	97	52	53.60%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_compile_type_	298	136	45.63%	[]
lys_compile_node_uniqness	98	53	54.08%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lysc_unres_must_add	34	13	38.23%	[]
lys_compile_node_list	138	60	43.47%	[]
lys_compile_node_leaflist	42	23	54.76%	[]
lys_set_features	46	10	21.73%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
_lys_set_implemented	39	16	41.02%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_unres_glob_revert	36	15	41.66%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_search_localfile	136	61	44.85%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_getnext_	164	82	50.0%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_unres_dep_sets_create_mod_r	66	35	53.03%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_search_localfile_file_type	43	20	46.51%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lysp_load_submodules	72	6	8.333%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lysp_ext_instance_resolve_argument	48	5	10.41%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lysp_check_dup_typedef	49	20	40.81%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_parse_localfile	36	13	36.11%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyplg_ext_pfree_instance_substatements	139	40	28.77%	[]
lyplg_ext_cfree_instance_substatements	131	34	25.95%	[]
lyd_parser_find_operation	36	6	16.66%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_parser_node_schema	38	10	26.31%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_parser_check_schema	51	13	25.49%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_parse_set_data_flags	43	13	30.23%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydxml_data_check_opaq	37	6	16.21%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
ly_path_compile_predicate	133	58	43.60%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyplg_type_resolve_leafref	87	35	40.22%	[]
lyplg_type_resolve_leafref_get_target_path	46	24	52.17%	[]
lyplg_type_store_bits	54	28	51.85%	[]
lyplg_type_store_enum	64	28	43.75%	[]
union_store_type	58	28	48.27%	[]
lys_compile_iffeature	154	67	43.50%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_find_sibling_val	43	21	48.83%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_compare_single_data	102	42	41.17%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_compare_single_value	52	21	40.38%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_first_module_sibling	40	18	45.0%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_new_implicit_r	108	45	41.66%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_validate_unres	60	31	51.66%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_validate_unres_when	43	8	18.60%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_validate_autodel_cont_leaf_dflt	33	18	54.54%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_validate_must	65	18	27.69%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyd_validate_minmax	55	18	32.72%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyxp_set_cast	112	25	22.32%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
reparse_relative_location_path	57	30	52.63%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
reparse_function_call	182	33	18.13%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
eval_expr_select	48	25	52.08%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
moveto_op_comp	75	30	40.0%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
set_comp_canonize	36	14	38.88%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
print_set_debug	102	8	7.843%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
set_sort_compare	40	8	20.0%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
eval_relative_location_path	98	53	54.08%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
moveto_axis_scnode_next	102	32	31.37%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
moveto_axis_scnode_next_first	66	32	48.48%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
moveto_scnode_check	39	16	41.02%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
moveto_axis_node_next	67	20	29.85%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
moveto_axis_node_next_first	73	32	43.83%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
moveto_resolve_model	40	17	42.5%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
eval_name_test_with_predicate_get_scnode	55	29	52.72%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
eval_function_call	192	43	22.39%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
eval_predicate	119	52	43.69%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
cast_string_recursive	116	30	25.86%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyjson_token2str	33	6	18.18%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyjson_next_value	75	41	54.66%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lyjson_exp_number	115	34	29.56%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydjson_get_snode	69	32	46.37%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydjson_parse_attribute	56	26	46.42%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydjson_metadata	143	71	49.65%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydjson_value_type_hint	31	10	32.25%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydjson_parse_instance	56	30	53.57%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydjson_data_check_opaq	33	17	51.51%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydjson_parse_instance_inner	36	15	41.66%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lydjson_metadata_finish	114	46	40.35%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
ly_dup_prefix_data	56	19	33.92%	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
lys_datatype2str	44	8	18.18%	[]

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libyang/src/plugins_types/boolean.c	[]	[]
/src/libyang/src/parser_yang.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/tree_data_hash.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/parser_json.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_json']
/src/libyang/src/ly_common.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/schema_features.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/parser_xml.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml']
/src/libyang/build/../tests/fuzz/lyd_parse_mem_xml.c	['lyd_parse_mem_xml']	[]
/src/libyang/src/plugins_types/empty.c	[]	[]
/src/libyang/src/tree_schema.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/printer_lyb.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/printer_data.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/validation.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_exts/nacm.c	[]	[]
/src/libyang/src/plugins.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/dict.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/build/../tests/fuzz/lys_parse_mem.c	['lys_parse_mem']	[]
/src/libyang/src/xml.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml']
/src/libyang/src/tree_schema_free.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_exts/yangdata.c	[]	[]
/src/libyang/src/plugins_types/ipv6_address.c	[]	[]
/src/libyang/src/plugins_types/node_instanceid.c	[]	[]
/src/libyang/src/parser_lyb.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/printer_json.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/lyb.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/hash_table_internal.h	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/tree_data.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/decimal64.c	[]	[]
/src/libyang/src/plugins_types/ipv6_prefix.c	[]	[]
/src/libyang/src/plugins_types/ipv6_address_no_zone.c	[]	[]
/src/libyang/src/log.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/ipv4_address.c	[]	[]
/src/libyang/src/plugins_types/ipv4_address_no_zone.c	[]	[]
/src/libyang/src/printer_yang.c	[]	[]
/src/libyang/src/plugins_types/binary.c	[]	[]
/src/libyang/src/plugins_types/integer.c	[]	[]
/src/libyang/src/path.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/leafref.c	[]	[]
/src/libyang/src/tree_data_common.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/tree_schema_common.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/in.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/hash_table.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_exts/metadata.h	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/out.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_exts/structure.c	[]	[]
/src/libyang/src/tree_data_new.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/identityref.c	[]	[]
/src/libyang/src/json.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_json']
/src/libyang/src/tree_data_free.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/schema_compile.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/context.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/date_and_time.c	[]	[]
/src/libyang/src/plugins_types/bits.c	[]	[]
/src/libyang/src/tree_data.h	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_exts.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/parser_yin.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/parser_common.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/enumeration.c	[]	[]
/src/libyang/src/diff.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_exts/schema_mount.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types/union.c	[]	[]
/src/libyang/src/set.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/string.c	[]	[]
/src/libyang/build/../tests/fuzz/lyd_parse_mem_json.c	['lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types/ipv4_prefix.c	[]	[]
/src/libyang/src/plugins_exts/metadata.c	[]	[]
/src/libyang/src/plugins_types/hex_string.c	[]	[]
/src/libyang/src/plugins_types/instanceid.c	[]	[]
/src/libyang/src/plugins_types/lyds_tree.c	[]	[]
/src/libyang/src/xpath.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/xpath1.0.c	[]	[]
/src/libyang/src/tree_data_sorted.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/compat/compat.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/schema_compile_node.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/schema_compile_amend.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/printer_xml.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types/instanceid_keys.c	[]	[]

Directories in report

Directory
/src/libyang/build/../tests/fuzz/
/src/libyang/src/plugins_types/
/src/libyang/src/
/src/libyang/src/plugins_exts/
/src/libyang/compat/