High level conclusions

Fuzzers reach 64.89% of cyclomatic complexity.

Fuzzers reach 60.42% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1156 / 1913

Cyclomatic complexity statically reachable by fuzzers

16562 / 25521

Runtime code coverage of functions

897 / 1913

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: lys_parse_mem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4116	54.8%
gold	[1:9]	199	2.65%
yellow	[10:29]	126	1.67%
greenyellow	[30:49]	34	0.45%
lawngreen	50+	3031	40.3%
All colors	7506	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
902	6152	lysp_load_submod_from_clb_or_file	call site: 06152	lys_parse_submodule
294	2055	ly_ctx_get_module_latest	call site: 02055	xml_print_node
254	1334	ly_ctx_get_module_by	call site: 01334	lyd_value_store
239	3755	lys_unres_glob_erase	call site: 03755	lyb_print_siblings
175	3008	lysp_grp_free	call site: 03008	lys_apply_refine
145	2759	lysp_qname_dup	call site: 02759	lysp_dev_node_free
131	7354	_lys_set_implemented	call site: 07354	lys_parse_mem
112	1218	ly_value_prefix_next	call site: 01218	lyd_compare_siblings_
106	1948	lyxp_atomize	call site: 01948	lyxp_eval
84	1054	lyxp_vars_find	call site: 01054	lyd_create_term
80	1806	lysc_node_when	call site: 01806	set_sort
73	787	ly_path_compile_predicate_leafref	call site: 00787	ly_vlog

Runtime coverage analysis

Covered functions

576

Functions that are reachable but not covered

526

Reachable functions

987

Percentage of reachable functions covered

46.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lys_parse_mem.c	1
src/log.c	21
src/context.c	31
src/ly_common.c	27
src/dict.c	14
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	10
src/tree_data_free.c	13
src/tree_data.c	47
src/in.c	7
src/tree_schema.c	33
src/parser_yin.c	76
src/xml.c	21
src/tree_schema_common.c	57
src/tree_data.h	3
src/tree_data_common.c	21
src/plugins_exts.c	7
src/plugins_exts/schema_mount.c	8
src/path.c	17
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	6
src/tree_data_new.c	4
src/tree_data_hash.c	5
src/tree_data_sorted.c	29
build/libyang/tree_data.h	2
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	32
src/lyb.c	6
src/schema_compile.c	35
src/schema_features.c	15
src/tree_schema_free.c	50
src/schema_compile_amend.c	39
src/schema_compile_node.c	18
src/parser_common.c	2
src/validation.c	2
src/plugins_exts/metadata.h	1
src/parser_yang.c	60

Fuzzer: lyd_parse_mem_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6400	67.7%
gold	[1:9]	142	1.50%
yellow	[10:29]	66	0.69%
greenyellow	[30:49]	5	0.05%
lawngreen	50+	2835	30.0%
All colors	9448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
914	6141	lysp_resolve_import_include	call site: 06141	lysp_main_pmod_get_submodule
301	8324	lyd_child_no_keys	call site: 08324	lyd_diff_merge_all
294	2055	ly_ctx_get_module_latest	call site: 02055	xml_print_node
233	8972	lyd_parse	call site: 08972	lyd_parse_lyb
179	3755	lys_unres_glob_erase	call site: 03755	lyb_print_siblings
175	3008	lysp_grp_free	call site: 03008	lys_apply_refine
174	8632	rb_iter_next	call site: 08632	lyd_validate_choice_r
173	5941	lys_parse_in	call site: 05941	lysp_add_internal_ietf_netconf
145	2759	lysp_qname_dup	call site: 02759	lysp_dev_node_free
87	7353	_lys_set_implemented	call site: 07353	lys_compile_depset_all
78	5714	parse_module	call site: 05714	parse_uses
77	7714	lyd_parser_check_schema	call site: 07714	lydxml_data_check_opaq

Runtime coverage analysis

Covered functions

743

Functions that are reachable but not covered

620

Reachable functions

1230

Percentage of reachable functions covered

49.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_json.c	1
src/log.c	24
src/context.c	31
src/ly_common.c	28
src/dict.c	15
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	11
src/tree_data_free.c	13
src/tree_data.c	68
src/in.c	8
src/tree_schema.c	33
src/parser_yin.c	76
src/xml.c	25
src/tree_schema_common.c	57
src/tree_data.h	3
src/tree_data_common.c	40
src/plugins_exts.c	7
src/plugins_exts/schema_mount.c	8
src/path.c	17
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	7
src/tree_data_new.c	18
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
build/libyang/tree_data.h	2
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	32
src/lyb.c	6
src/schema_compile.c	35
src/schema_features.c	15
src/tree_schema_free.c	50
src/schema_compile_amend.c	39
src/schema_compile_node.c	23
src/parser_common.c	11
src/validation.c	34
src/plugins_exts/metadata.h	1
src/parser_yang.c	60
src/parser_xml.c	16
src/parser_json.c	22
src/json.c	21
src/diff.c	24
src/parser_lyb.c	32

Fuzzer: lyd_parse_mem_xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6606	69.9%
gold	[1:9]	75	0.79%
yellow	[10:29]	37	0.39%
greenyellow	[30:49]	5	0.05%
lawngreen	50+	2725	28.8%
All colors	9448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
768	6287	lyxml_ctx_next	call site: 06287	yin_parse_attribute
333	7879	lyd_parse_xml	call site: 07879	lyd_parse_json
301	8324	lyd_child_no_keys	call site: 08324	lyd_diff_merge_all
294	2055	ly_ctx_get_module_latest	call site: 02055	xml_print_node
242	8963	lydxml_subtree_inner	call site: 08963	lyd_parse_lyb
179	3755	lys_unres_glob_erase	call site: 03755	lyb_print_siblings
175	3008	lysp_grp_free	call site: 03008	lys_apply_refine
174	8632	rb_iter_next	call site: 08632	lyd_validate_choice_r
173	5941	lys_parse_in	call site: 05941	lysp_add_internal_ietf_netconf
145	2759	lysp_qname_dup	call site: 02759	lysp_dev_node_free
93	7353	_lys_set_implemented	call site: 07353	lys_compile_depset_all
78	5714	parse_module	call site: 05714	parse_uses

Runtime coverage analysis

Covered functions

706

Functions that are reachable but not covered

644

Reachable functions

1230

Percentage of reachable functions covered

47.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_xml.c	1
src/log.c	24
src/context.c	31
src/ly_common.c	28
src/dict.c	15
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	11
src/tree_data_free.c	13
src/tree_data.c	68
src/in.c	8
src/tree_schema.c	33
src/parser_yin.c	76
src/xml.c	25
src/tree_schema_common.c	57
src/tree_data.h	3
src/tree_data_common.c	40
src/plugins_exts.c	7
src/plugins_exts/schema_mount.c	8
src/path.c	17
src/xpath.c	124
compat/compat.c	1
src/plugins_types.c	7
src/tree_data_new.c	18
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
build/libyang/tree_data.h	2
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	25
src/printer_lyb.c	32
src/lyb.c	6
src/schema_compile.c	35
src/schema_features.c	15
src/tree_schema_free.c	50
src/schema_compile_amend.c	39
src/schema_compile_node.c	23
src/parser_common.c	11
src/validation.c	34
src/plugins_exts/metadata.h	1
src/parser_yang.c	60
src/parser_xml.c	16
src/parser_json.c	22
src/json.c	21
src/diff.c	24
src/parser_lyb.c	32

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
structure_aug_parse	/src/libyang/src/plugins_exts/structure.c	2	['N/A', 'N/A']	51	0	551	37	15	1036	0	14139	973
structure_compile	/src/libyang/src/plugins_exts/structure.c	3	['N/A', 'N/A', 'N/A']	52	0	619	32	13	1018	0	14140	882
yang_print_parsed_submodule	/src/libyang/src/printer_yang.c	3	['N/A', 'N/A', 'int']	37	0	424	54	20	98	0	852	541
lyd_diff_siblings_r	/src/libyang/src/diff.c	5	['N/A', 'N/A', 'short', 'char', 'N/A']	73	0	945	180	61	1013	4	13952	363
schema_mount_validate	/src/libyang/src/plugins_exts/schema_mount.c	6	['N/A', 'N/A', 'N/A', 'int', 'int', 'N/A']	77	0	488	84	32	1110	0	15365	332
schema_mount_compiled_print	/src/libyang/src/plugins_exts/schema_mount.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	22	0	386	21	9	180	0	1411	304
lyd_diff_reverse_siblings_r	/src/libyang/src/diff.c	2	['N/A', 'N/A']	68	0	1201	251	82	1016	2	13761	238

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1357 / 1913

Cyclomatic complexity statically reachable by fuzzers

20050 / 25521

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

build/../tests/fuzz/lys_parse_mem.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lysp_load_submod_from_clb_or_file', 'ly_ctx_get_module_latest', 'ly_ctx_get_module_by', 'lys_unres_glob_erase', 'lysp_grp_free', 'lysp_qname_dup', '_lys_set_implemented', 'ly_value_prefix_next', 'lyxp_atomize', 'lyxp_vars_find']

build/../tests/fuzz/lyd_parse_mem_json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lysp_resolve_import_include', 'lyd_child_no_keys', 'ly_ctx_get_module_latest', 'lyd_parse', 'lys_unres_glob_erase', 'lysp_grp_free', 'rb_iter_next', 'lys_parse_in', 'lysp_qname_dup', '_lys_set_implemented']

build/../tests/fuzz/lyd_parse_mem_xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lyxml_ctx_next', 'lyd_parse_xml', 'lyd_child_no_keys', 'ly_ctx_get_module_latest', 'lydxml_subtree_inner', 'lys_unres_glob_erase', 'lysp_grp_free', 'rb_iter_next', 'lys_parse_in', 'lysp_qname_dup']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ly_ctx_data_add	31	17	54.83%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_parser_fill_filepath	34	15	44.11%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_parser_ext_instance_stmt	122	39	31.96%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lysp_stmt_parse	207	26	12.56%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lysp_stmt_type_enum	44	18	40.90%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lysp_stmt_type	79	30	37.97%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_compile_ext_instance_stmt	180	35	19.44%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_compile_identity_circular_check	34	8	23.52%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_precompile_uses_augments_refines	63	17	26.98%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lysp_dev_node_free	46	4	8.695%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_compile_node_deviations_refines	51	14	27.45%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_precompile_own_deviations	50	12	24.0%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_precompile_augments_deviations	37	18	48.64%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_compile_augment_children	63	16	25.39%	['lys_parse_mem']
lys_compile_type_range	195	63	32.30%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_compile_type_enums	131	66	50.38%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_compile_type_	297	157	52.86%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_compile_node_list	136	71	52.20%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_set_features	46	10	21.73%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
_lys_set_implemented	39	21	53.84%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_search_localfile	136	61	44.85%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_unres_dep_sets_create_mod_r	66	35	53.03%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_search_localfile_file_type	43	20	46.51%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lysp_load_submodules	41	17	41.46%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lysp_ext_instance_resolve_argument	47	6	12.76%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lys_parse_localfile	35	18	51.42%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lysc_node_free	56	6	10.71%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyplg_ext_pfree_instance_substatements	138	39	28.26%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyplg_ext_cfree_instance_substatements	130	33	25.38%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lysc_ident_derived_unlink	69	20	28.98%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
moveto_scnode_check	39	21	53.84%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
moveto_attr_alldesc	48	7	14.58%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
set_copy	48	22	45.83%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
moveto_attr	34	5	14.70%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
moveto_node_alldesc_child	54	8	14.81%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
xpath_pi_text	34	6	17.64%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
xpath_sum	48	24	50.0%	['lys_parse_mem']
xpath_lang	70	18	25.71%	['lys_parse_mem']
xpath_name	56	9	16.07%	['lys_parse_mem']
xpath_substring	71	32	45.07%	['lys_parse_mem']
xpath_local_name	46	7	15.21%	['lys_parse_mem']
xpath_enum_value	32	17	53.12%	['lys_parse_mem']
xpath_starts_with	32	15	46.87%	['lys_parse_mem']
xpath_derived_	93	24	25.80%	['lys_parse_mem']
xpath_namespace_uri	50	8	16.0%	['lys_parse_mem']
xpath_normalize_space	65	19	29.23%	['lys_parse_mem']
xpath_substring_after	34	10	29.41%	['lys_parse_mem']
lyjson_token2str	33	16	48.48%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
log_store	63	25	39.68%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyd_parser_find_operation	36	6	16.66%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parser_node_schema	38	10	26.31%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parser_check_schema	51	23	45.09%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parser_set_data_flags	43	12	27.90%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lydjson_data_check_opaq	37	18	48.64%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_resolve_leafref	89	45	50.56%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_resolve_leafref_get_target_path	46	24	52.17%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyplg_type_sort_uint	43	12	27.90%	['lyd_parse_mem_json']
lyplg_type_print_uint	46	19	41.30%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_find_sibling_first	71	33	46.47%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyd_find_sibling_val	44	21	47.72%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyd_get_or_create_leafref_links_record	32	13	40.62%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyd_compare_single_data	95	42	44.21%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyd_compare_single_value	52	21	40.38%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyd_first_module_sibling	40	18	45.0%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_parse_opaq_error	96	43	44.79%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
ly_dup_prefix_data	55	19	34.54%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lyd_new_implicit	100	40	40.0%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_unres_when	43	8	18.60%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_autodel_node_del	39	15	38.46%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_must	65	18	27.69%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyd_validate_minmax	72	38	52.77%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
lyxp_set_cast	112	25	22.32%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
moveto_op_comp	75	30	40.0%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
set_comp_canonize	31	16	51.61%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
print_set_debug	102	8	7.843%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
set_sort_compare	40	8	20.0%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
moveto_axis_node_next	67	20	29.85%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
moveto_axis_node_next_first	82	36	43.90%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
eval_name_test_with_predicate_get_scnode	55	29	52.72%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
cast_string_recursive	104	29	27.88%	['lyd_parse_mem_json', 'lys_parse_mem', 'lyd_parse_mem_xml']
lydxml_data_check_opaq	42	7	16.66%	['lyd_parse_mem_json', 'lyd_parse_mem_xml']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libyang/src/plugins.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/tree_schema_common.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/date_and_time.c	[]	[]
/src/libyang/src/tree_data_new.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/parser_lyb.c	['lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/plugins_exts/yangdata.c	[]	[]
/src/libyang/src/plugins_types/instanceid.c	[]	[]
/src/libyang/src/plugins_types/instanceid_keys.c	[]	[]
/src/libyang/src/plugins_exts/nacm.c	[]	[]
/src/libyang/src/schema_compile_node.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/parser_yang.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/integer.c	[]	[]
/src/libyang/src/dict.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/string.c	[]	[]
/src/libyang/build/../tests/fuzz/lyd_parse_mem_xml.c	['lyd_parse_mem_xml']	[]
/src/libyang/src/plugins_types/ipv4_prefix.c	[]	[]
/src/libyang/src/json.c	['lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json']
/src/libyang/build/../tests/fuzz/lyd_parse_mem_json.c	['lyd_parse_mem_json']	[]
/src/libyang/src/in.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/ipv4_address_no_zone.c	[]	[]
/src/libyang/src/out.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/xml.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_xml']
/src/libyang/src/plugins_types/binary.c	[]	[]
/src/libyang/src/ly_common.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/leafref.c	[]	[]
/src/libyang/src/plugins_types/ipv6_address.c	[]	[]
/src/libyang/src/tree_data_hash.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/printer_yang.c	[]	[]
/src/libyang/src/plugins_exts/schema_mount.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/plugins_types/boolean.c	[]	[]
/src/libyang/src/plugins_types/lyds_tree.c	[]	[]
/src/libyang/src/plugins_exts.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/ipv6_address_no_zone.c	[]	[]
/src/libyang/src/context.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/validation.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/set.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/parser_json.c	['lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json']
/src/libyang/src/plugins_types/union.c	[]	[]
/src/libyang/src/tree_data.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/schema_features.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/diff.c	['lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/parser_yin.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/hash_table.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/enumeration.c	[]	[]
/src/libyang/src/log.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/tree_schema.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/path.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/decimal64.c	[]	[]
/src/libyang/src/plugins_types/bits.c	[]	[]
/src/libyang/src/plugins_exts/metadata.c	[]	[]
/src/libyang/src/schema_compile.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/identityref.c	[]	[]
/src/libyang/src/printer_json.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/printer_context.c	[]	[]
/src/libyang/src/plugins_types/ipv4_address.c	[]	[]
/src/libyang/src/tree_data_sorted.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/hash_table_internal.h	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/parser_xml.c	['lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_xml']
/src/libyang/src/plugins_types/time_period.c	[]	[]
/src/libyang/src/schema_compile_amend.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/tree_data_free.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/tree_data_common.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_exts/structure.c	[]	[]
/src/libyang/src/plugins_types/node_instanceid.c	[]	[]
/src/libyang/src/printer_lyb.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/printer_xml.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/compat/compat.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/printer_data.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/plugins_exts/metadata.h	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/tree_data.h	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/xpath1.0.c	[]	[]
/src/libyang/src/plugins_types/ipv6_prefix.c	[]	[]
/src/libyang/src/plugins_types/empty.c	[]	[]
/src/libyang/build/../tests/fuzz/lys_parse_mem.c	['lys_parse_mem']	[]
/src/libyang/src/tree_schema_free.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/parser_common.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/lyb.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	[]
/src/libyang/src/xpath.c	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']	['lys_parse_mem', 'lyd_parse_mem_json', 'lyd_parse_mem_xml']
/src/libyang/src/plugins_types/hex_string.c	[]	[]

Directories in report

Directory
/src/libyang/src/plugins_types/
/src/libyang/src/
/src/libyang/compat/
/src/libyang/src/plugins_exts/
/src/libyang/build/../tests/fuzz/