High level conclusions

Fuzzers reach 66.37% of cyclomatic complexity.

Fuzzers reach 62.98% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1135 / 1802

Cyclomatic complexity statically reachable by fuzzers

16247 / 24477

Runtime code coverage of functions

852 / 1802

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: lys_parse_mem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6560	70.3%
gold	[1:9]	173	1.85%
yellow	[10:29]	66	0.70%
greenyellow	[30:49]	17	0.18%
lawngreen	50+	2503	26.8%
All colors	9319	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
33089	49452	8 : View List ['print_set_type', 'lyplg_type_resolve_leafref', 'set_insert_node', 'ly_vlog', 'lyd_get_value.4844', 'lyxp_set_free_content', 'ly_path_eval', 'free']	33089	49713	xpath_deref	call site: 00000	/src/libyang/src/xpath.c:4027
32734	32734	4 : View List ['strlen', 'lyxp_set_cast', 'set_fill_boolean', 'strncmp']	32734	32734	xpath_starts_with	call site: 00000	/src/libyang/src/xpath.c:5074
32734	32734	3 : View List ['strlen', 'set_fill_number', 'lyxp_set_cast']	32734	32734	xpath_string_length	call site: 00000	/src/libyang/src/xpath.c:5156
32698	32881	2 : View List ['set_fill_set', 'lyxp_set_cast']	32698	32881	xpath_number	call site: 00000	/src/libyang/src/xpath.c:4880
17206	33585	9 : View List ['print_set_type', 'set_dup_node_check', 'moveto_node_check', 'moveto_axis_node_next', 'set_init', 'set_insert_node', 'set_sort', 'ly_vlog', 'lyxp_set_free_content']	17206	33585	moveto_node	call site: 02946	/src/libyang/src/xpath.c:6132
16913	49627	11 : View List ['print_set_type', 'set_dup_node_check', 'lyd_parent.4851', 'moveto_node_check', 'set_init', 'lyd_child.4843', 'set_insert_node', 'set_sort', 'ly_vlog', 'lyxp_set_free_content', 'xpath_pi_node']	16913	49627	moveto_node_alldesc_child	call site: 05812	/src/libyang/src/xpath.c:6857
16461	32810	8 : View List ['print_set_type', 'lyd_parent.4851', 'lyxp_set_cast', 'set_fill_boolean', 'ly_vlog', 'tolower', 'lyd_get_meta_value.4891', 'strcmp']	16461	32810	xpath_lang	call site: 00000	/src/libyang/src/xpath.c:4407
16407	16407	1 : View List ['lys_compile_node_list_unique']	16407	65454	lys_compile_node_list	call site: 00000	/src/libyang/src/schema_compile_node.c:3557
16381	32747	3 : View List ['set_fill_number', 'xpath_floor', 'lyxp_set_cast']	16381	32747	xpath_round	call site: 00000	/src/libyang/src/xpath.c:5026
16381	16381	2 : View List ['set_fill_boolean', 'lyxp_set_cast']	16381	16381	xpath_not	call site: 00000	/src/libyang/src/xpath.c:4850
16381	16381	2 : View List ['set_fill_number', 'lyxp_set_cast']	16381	16381	xpath_ceiling	call site: 00000	/src/libyang/src/xpath.c:3792
16369	49125	3 : View List ['set_fill_string', 'xpath_round', 'lyxp_set_cast']	16369	49125	xpath_substring	call site: 00000	/src/libyang/src/xpath.c:5210

Runtime coverage analysis

Covered functions

523

Functions that are reachable but not covered

768

Reachable functions

1203

Percentage of reachable functions covered

36.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lys_parse_mem.c	1
src/log.c	27
src/context.c	31
src/hash_table.c	21
src/hash_table_internal.h	1
src/dict.c	10
src/plugins.c	6
src/set.c	11
src/in.c	7
src/tree_schema.c	33
src/parser_yin.c	76
src/xml.c	25
src/tree_schema_common.c	55
src/tree_data.c	68
src/tree_data.h	3
src/tree_data_common.c	39
src/ly_common.c	12
src/plugins_exts.c	6
src/plugins_exts/schema_mount.c	7
src/path.c	16
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	7
src/tree_schema_free.c	49
src/tree_data_new.c	19
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/tree_data_free.c	13
src/parser_lyb.c	38
build/libyang/tree_data.h	1
src/schema_compile.c	34
src/schema_features.c	15
src/schema_compile_amend.c	40
src/schema_compile_node.c	23
src/parser_xml.c	16
src/parser_common.c	11
src/validation.c	34
src/parser_json.c	22
src/json.c	21
src/lyb.c	4
src/diff.c	24
src/plugins_exts/metadata.h	1
src/out.c	10
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	31
src/parser_yang.c	60

Fuzzer: lyd_parse_mem_xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6493	69.6%
gold	[1:9]	78	0.83%
yellow	[10:29]	39	0.41%
greenyellow	[30:49]	14	0.15%
lawngreen	50+	2698	28.9%
All colors	9322	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
49050	131864	12 : View List ['lys_compile_unres_depset_implement', 'lys_compile_unres_llist_dflts', 'ly_set_rm_index', 'lysc_unres_must_free', 'lys_compile_unres_when', 'lys_compile_unres_leafref', 'lysc_type_free', 'lys_compile_unres_disabled_bitenum', 'lys_compile_unres_leaf_dlft', 'lys_compile_unres_must', 'lysc_unres_dflt_free', 'free']	65815	183742	lys_compile_unres_depset	call site: 06327	/src/libyang/src/schema_compile.c:1443
32698	32702	3 : View List ['moveto_attr', 'set_scnode_clear_ctx', 'moveto_attr_alldesc']	32698	65810	eval_name_test_with_predicate	call site: 05797	/src/libyang/src/xpath.c:8214
32698	32698	2 : View List ['lys_getnext_data', 'lyd_validate_autodel_node_del']	32698	32698	lyd_validate_autodel_case_dflt	call site: 04743	/src/libyang/src/validation.c:869
16407	16407	1 : View List ['lys_compile_node_list_unique']	16407	65454	lys_compile_node_list	call site: 00000	/src/libyang/src/schema_compile_node.c:3557
16349	49047	3 : View List ['lyd_create_list2', 'lyd_find_sibling_first', 'lyd_create_term']	16349	65396	lyd_find_sibling_val	call site: 00962	/src/libyang/src/tree_data.c:3278
16349	32698	2 : View List ['lyplg_ext_insert', 'lyd_free_tree']	16349	33209	lydxml_subtree_r	call site: 03605	/src/libyang/src/parser_xml.c:1140
16349	16378	2 : View List ['lysc_has_when', 'lyd_validate_dummy_when']	16349	50218	lyd_validate_minmax	call site: 05183	/src/libyang/src/validation.c:1179
16349	16365	2 : View List ['lys_unres_glob_revert', 'lys_unres_glob_erase']	16349	16365	lys_parse	call site: 09314	/src/libyang/src/tree_schema.c:2294
16349	16352	2 : View List ['lyd_find_schema_ctx', 'lyd_parent']	32700	81805	lyd_find_sibling_val	call site: 00932	/src/libyang/src/tree_data.c:3254
16349	16352	2 : View List ['lys_compile_when', 'lysc_data_node']	16353	49920	lys_compile_node_	call site: 02504	/src/libyang/src/schema_compile_node.c:2764
16349	16349	1 : View List ['lydxml_attrs']	81754	197517	lydxml_subtree_r	call site: 03567	/src/libyang/src/parser_xml.c:1079
16349	16349	1 : View List ['lydxml_subtree_any']	49056	131991	lydxml_subtree_r	call site: 03605	/src/libyang/src/parser_xml.c:1096

Runtime coverage analysis

Covered functions

678

Functions that are reachable but not covered

639

Reachable functions

1203

Percentage of reachable functions covered

46.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_xml.c	1
src/log.c	27
src/context.c	31
src/hash_table.c	21
src/hash_table_internal.h	1
src/dict.c	10
src/plugins.c	6
src/set.c	11
src/in.c	7
src/tree_schema.c	33
src/parser_yin.c	76
src/xml.c	25
src/tree_schema_common.c	55
src/tree_data.c	68
src/tree_data.h	3
src/tree_data_common.c	39
src/ly_common.c	12
src/plugins_exts.c	6
src/plugins_exts/schema_mount.c	7
src/path.c	16
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	7
src/tree_schema_free.c	49
src/tree_data_new.c	19
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/tree_data_free.c	13
src/parser_lyb.c	38
build/libyang/tree_data.h	1
src/schema_compile.c	34
src/schema_features.c	15
src/schema_compile_amend.c	40
src/schema_compile_node.c	23
src/parser_xml.c	16
src/parser_common.c	11
src/validation.c	34
src/parser_json.c	22
src/json.c	21
src/lyb.c	4
src/diff.c	24
src/plugins_exts/metadata.h	1
src/out.c	10
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	31
src/parser_yang.c	60

Fuzzer: lyd_parse_mem_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6293	67.5%
gold	[1:9]	162	1.73%
yellow	[10:29]	71	0.76%
greenyellow	[30:49]	15	0.16%
lawngreen	50+	2781	29.8%
All colors	9322	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
49050	131864	12 : View List ['lys_compile_unres_depset_implement', 'lys_compile_unres_llist_dflts', 'ly_set_rm_index', 'lysc_unres_must_free', 'lys_compile_unres_when', 'lys_compile_unres_leafref', 'lysc_type_free', 'lys_compile_unres_disabled_bitenum', 'lys_compile_unres_leaf_dlft', 'lys_compile_unres_must', 'lysc_unres_dflt_free', 'free']	65815	183742	lys_compile_unres_depset	call site: 06327	/src/libyang/src/schema_compile.c:1443
32698	32702	3 : View List ['moveto_attr', 'set_scnode_clear_ctx', 'moveto_attr_alldesc']	32698	65810	eval_name_test_with_predicate	call site: 05797	/src/libyang/src/xpath.c:8214
32698	32702	3 : View List ['ly_temp_log_options', 'lydjson_check_list', 'ly_value_validate']	32698	49054	lydjson_data_check_opaq	call site: 03939	/src/libyang/src/parser_json.c:524
32698	32698	1 : View List ['lyd_val_diff_add']	32698	49440	lyd_validate_autodel_node_del	call site: 04712	/src/libyang/src/validation.c:323
16407	16407	1 : View List ['lys_compile_node_list_unique']	16407	65454	lys_compile_node_list	call site: 00000	/src/libyang/src/schema_compile_node.c:3557
16349	32698	2 : View List ['lys_getnext_data', 'lyd_validate_autodel_node_del']	16349	32698	lyd_validate_autodel_case_dflt	call site: 04743	/src/libyang/src/validation.c:869
16349	16378	2 : View List ['lysc_has_when', 'lyd_validate_dummy_when']	16349	50218	lyd_validate_minmax	call site: 05183	/src/libyang/src/validation.c:1179
16349	16365	2 : View List ['lys_unres_glob_revert', 'lys_unres_glob_erase']	16349	16365	lys_parse	call site: 09314	/src/libyang/src/tree_schema.c:2294
16349	16352	2 : View List ['lyd_find_schema_ctx', 'lyd_parent']	32700	81805	lyd_find_sibling_val	call site: 00932	/src/libyang/src/tree_data.c:3254
16349	16352	2 : View List ['lys_compile_when', 'lysc_data_node']	16353	49920	lys_compile_node_	call site: 02504	/src/libyang/src/schema_compile_node.c:2764
16349	16349	1 : View List ['moveto_scnode_alldesc_child']	32698	65806	eval_name_test_with_predicate	call site: 05866	/src/libyang/src/xpath.c:8244
16349	16349	1 : View List ['lysp_load_module_data_check']	17251	150648	lys_parse_in	call site: 00160	/src/libyang/src/tree_schema.c:2116

Runtime coverage analysis

Covered functions

717

Functions that are reachable but not covered

612

Reachable functions

1203

Percentage of reachable functions covered

49.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_json.c	1
src/log.c	27
src/context.c	31
src/hash_table.c	21
src/hash_table_internal.h	1
src/dict.c	10
src/plugins.c	6
src/set.c	11
src/in.c	7
src/tree_schema.c	33
src/parser_yin.c	76
src/xml.c	25
src/tree_schema_common.c	55
src/tree_data.c	68
src/tree_data.h	3
src/tree_data_common.c	39
src/ly_common.c	12
src/plugins_exts.c	6
src/plugins_exts/schema_mount.c	7
src/path.c	16
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	7
src/tree_schema_free.c	49
src/tree_data_new.c	19
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/tree_data_free.c	13
src/parser_lyb.c	38
build/libyang/tree_data.h	1
src/schema_compile.c	34
src/schema_features.c	15
src/schema_compile_amend.c	40
src/schema_compile_node.c	23
src/parser_xml.c	16
src/parser_common.c	11
src/validation.c	34
src/parser_json.c	22
src/json.c	21
src/lyb.c	4
src/diff.c	24
src/plugins_exts/metadata.h	1
src/out.c	10
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	31
src/parser_yang.c	60

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
structure_aug_parse	/src/libyang/src/plugins_exts/structure.c	2	['N/A', 'N/A']	53	0	555	37	15	1252	0	17320	971
yangdata_compile	/src/libyang/src/plugins_exts/yangdata.c	3	['N/A', 'N/A', 'N/A']	54	0	361	40	15	1224	0	17224	875
yang_print_parsed_submodule	/src/libyang/src/printer_yang.c	3	['N/A', 'N/A', 'int']	39	0	428	54	20	104	0	871	539
lyd_diff_siblings_r	/src/libyang/src/diff.c	5	['N/A', 'N/A', 'short', 'char', 'N/A']	75	0	971	180	61	1207	4	16713	364
schema_mount_validate	/src/libyang/src/plugins_exts/schema_mount.c	6	['N/A', 'N/A', 'N/A', 'int', 'int', 'N/A']	61	0	539	88	32	1217	0	16693	344
lyd_diff_apply_r	/src/libyang/src/diff.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	67	0	903	142	51	1203	3	16573	224
yang_print_compiled	/src/libyang/src/printer_yang.c	3	['N/A', 'N/A', 'int']	45	0	832	111	38	1238	0	16757	224
ly_ctx_get_yanglib_data	/src/libyang/src/context.c	3	['N/A', 'N/A', 'N/A']	53	0	711	113	48	1207	0	16590	222
schema_mount_sprinter_ctree	/src/libyang/src/plugins_exts/schema_mount.c	4	['N/A', 'N/A', 'N/A', 'N/A']	61	0	500	80	30	1218	0	16540	187
lyd_new_ext_path	/src/libyang/src/tree_data_new.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A']	67	0	261	49	20	1201	0	16535	179

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1367 / 1802

Cyclomatic complexity statically reachable by fuzzers

20264 / 24477

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

build/../tests/fuzz/lys_parse_mem.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ly_err_last', 'lysp_resolve_import_include', 'lyxp_atomize', 'lysp_grp_free', 'lyxp_vars_find', 'lys_parse_in', '_lys_set_implemented', 'lyht_free', 'ly_err_new', 'ly_value_prefix_next']

build/../tests/fuzz/lyd_parse_mem_xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lysp_resolve_import_include', 'lyd_parse_data_mem', 'lyd_parse_xml', 'lyd_child_no_keys', 'lysp_grp_free', 'rb_iter_next', 'lys_parse_in', 'lysp_qname_dup', 'lyd_new_implicit_r', '_lys_set_implemented']

build/../tests/fuzz/lyd_parse_mem_json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lysp_resolve_import_include', 'lyd_parse_data_mem', 'lyd_child_no_keys', 'lydjson_parse_instance', 'lysp_grp_free', 'rb_iter_next', 'lys_parse_in', 'lyd_parse', 'lysp_qname_dup', 'parse_module']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
lys_parser_fill_filepath	33	14	42.42%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_parser_ext_instance_stmt	122	39	31.96%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_stmt_parse	207	26	12.56%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_stmt_type_enum	44	18	40.90%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_stmt_type	79	30	37.97%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_when	45	23	51.11%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_any	49	25	51.02%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_maxelements	50	26	52.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_augment	75	32	42.66%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_deviate	214	77	35.98%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_type_fracdigits	45	23	51.11%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_type_pattern	52	24	46.15%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_orderedby	35	17	48.57%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_inout	60	30	50.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_refine	55	24	43.63%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_yangversion	34	16	47.05%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_yinelement	35	15	42.85%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_ext_instance_stmt	180	35	19.44%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_identity_circular_check	35	8	22.85%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_unres_when_cyclic	71	26	36.61%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_precompile_uses_augments_refines	64	18	28.12%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_dev_node_free	46	4	8.695%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_node_deviations_refines	52	14	26.92%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_precompile_own_deviations	50	12	24.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_precompile_augments_deviations	38	19	50.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_schema_nodeid_match	44	23	52.27%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_augment_children	64	17	26.56%	['lys_parse_mem']
lys_compile_type_range	195	63	32.30%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_type_enums	131	66	50.38%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_type_	298	136	45.63%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_node_list	138	60	43.47%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_compile_node_leaflist	42	23	54.76%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_set_features	46	10	21.73%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
_lys_set_implemented	39	16	41.02%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_search_localfile	136	61	44.85%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_unres_dep_sets_create_mod_r	66	35	53.03%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_search_localfile_file_type	43	20	46.51%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_load_submodules	41	9	21.95%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_ext_instance_resolve_argument	48	5	10.41%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_stmt_str	155	44	28.38%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysp_check_dup_typedef	49	20	40.81%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_load_mod_from_clb_or_file	55	28	50.90%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_parse_localfile	35	18	51.42%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lysc_node_free	56	6	10.71%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_ext_pfree_instance_substatements	139	40	28.77%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_ext_cfree_instance_substatements	131	34	25.95%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_scnode_check	39	19	48.71%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
set_copy	48	22	45.83%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_attr	34	5	14.70%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_node_alldesc_child	54	8	14.81%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
xpath_pi_text	34	6	17.64%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
xpath_lang	70	16	22.85%	['lys_parse_mem']
xpath_name	56	9	16.07%	['lys_parse_mem']
xpath_deref	79	43	54.43%	['lys_parse_mem']
xpath_substring	71	23	32.39%	['lys_parse_mem']
xpath_local_name	46	7	15.21%	['lys_parse_mem']
xpath_enum_value	32	17	53.12%	['lys_parse_mem']
xpath_starts_with	32	9	28.12%	['lys_parse_mem']
xpath_string_length	32	15	46.87%	['lys_parse_mem']
xpath_normalize_space	65	19	29.23%	['lys_parse_mem']
lyd_parser_find_operation	36	6	16.66%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parser_node_schema	38	10	26.31%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parser_check_schema	51	23	45.09%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parser_set_data_flags	43	13	30.23%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lydxml_data_check_opaq	41	7	17.07%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
parse_type_reqinstance	34	16	47.05%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_resolve_leafref	87	41	47.12%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_resolve_leafref_get_target_path	46	24	52.17%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_store_bits	54	28	51.85%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_print_uint	46	19	41.30%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_find_sibling_first	71	33	46.47%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_find_sibling_val	43	21	48.83%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_get_or_create_leafref_links_record	33	13	39.39%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_compare_single_data	102	42	41.17%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_compare_single_value	52	21	40.38%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_first_module_sibling	40	18	45.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_new_implicit	114	45	39.47%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_unres	63	31	49.20%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_unres_when	43	8	18.60%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_must	65	18	27.69%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_minmax	72	38	52.77%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyxp_set_cast	112	25	22.32%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_op_comp	75	30	40.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
set_comp_canonize	36	14	38.88%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
print_set_debug	102	8	7.843%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
set_sort_compare	40	8	20.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_axis_node_next	67	20	29.85%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
moveto_axis_node_next_first	73	32	43.83%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
eval_name_test_with_predicate_get_scnode	55	29	52.72%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
cast_string_recursive	116	30	25.86%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyjson_token2str	33	16	48.48%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
log_store	66	26	39.39%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lydjson_data_check_opaq	36	18	50.0%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_sort_uint	43	12	27.90%	['lyd_parse_mem_json']
lyd_parse_opaq_error	95	23	24.21%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
ly_dup_prefix_data	56	19	33.92%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
lys_datatype2str	44	18	40.90%	['lyd_parse_mem_json']
lyd_validate_autodel_node_del	39	15	38.46%	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libyang/src/lyb.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/xpath.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/instanceid.c	[]	[]
/src/libyang/src/plugins_types/date_and_time.c	[]	[]
/src/libyang/src/plugins_exts/metadata.c	[]	[]
/src/libyang/src/path.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/ipv6_address_no_zone.c	[]	[]
/src/libyang/src/plugins_exts/schema_mount.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/schema_features.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/tree_data_new.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/set.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/validation.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/tree_data.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/hash_table.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/build/../tests/fuzz/lys_parse_mem.c	['lys_parse_mem']	[]
/src/libyang/build/../tests/fuzz/lyd_parse_mem_xml.c	['lyd_parse_mem_xml']	[]
/src/libyang/src/in.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_exts/yangdata.c	[]	[]
/src/libyang/src/plugins_types/ipv6_address.c	[]	[]
/src/libyang/src/plugins_types/node_instanceid.c	[]	[]
/src/libyang/src/printer_json.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/tree_data.h	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/ipv4_prefix.c	[]	[]
/src/libyang/src/schema_compile_amend.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/compat/compat.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/printer_yang.c	[]	[]
/src/libyang/src/context.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/lyds_tree.c	[]	[]
/src/libyang/src/plugins_types/time_period.c	[]	[]
/src/libyang/src/diff.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/tree_data_common.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/boolean.c	[]	[]
/src/libyang/src/dict.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/enumeration.c	[]	[]
/src/libyang/src/tree_data_sorted.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/ipv4_address_no_zone.c	[]	[]
/src/libyang/src/plugins_types/hex_string.c	[]	[]
/src/libyang/src/parser_xml.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml']
/src/libyang/src/plugins_exts/structure.c	[]	[]
/src/libyang/src/parser_yin.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types/identityref.c	[]	[]
/src/libyang/build/../tests/fuzz/lyd_parse_mem_json.c	['lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types/xpath1.0.c	[]	[]
/src/libyang/src/plugins_types/empty.c	[]	[]
/src/libyang/src/printer_xml.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types/ipv6_prefix.c	[]	[]
/src/libyang/src/json.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_json']
/src/libyang/src/plugins.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/log.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/parser_json.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_json']
/src/libyang/src/hash_table_internal.h	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/binary.c	[]	[]
/src/libyang/src/plugins_types/union.c	[]	[]
/src/libyang/src/plugins_exts/metadata.h	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/tree_schema.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/string.c	[]	[]
/src/libyang/src/tree_schema_common.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/out.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/printer_data.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types/instanceid_keys.c	[]	[]
/src/libyang/src/ly_common.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/bits.c	[]	[]
/src/libyang/src/plugins_exts/nacm.c	[]	[]
/src/libyang/src/plugins_exts.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/parser_yang.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/printer_lyb.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/parser_lyb.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	[]
/src/libyang/src/plugins_types/leafref.c	[]	[]
/src/libyang/src/parser_common.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/xml.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml']
/src/libyang/src/tree_data_free.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/schema_compile.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/integer.c	[]	[]
/src/libyang/src/schema_compile_node.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/decimal64.c	[]	[]
/src/libyang/src/tree_schema_free.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/tree_data_hash.c	['lys_parse_mem', 'lyd_parse_mem_xml', 'lyd_parse_mem_json']	['lyd_parse_mem_xml', 'lyd_parse_mem_json']
/src/libyang/src/plugins_types/ipv4_address.c	[]	[]

Directories in report

Directory
/src/libyang/src/plugins_types/
/src/libyang/build/../tests/fuzz/
/src/libyang/compat/
/src/libyang/src/plugins_exts/
/src/libyang/src/