High level conclusions

Fuzzers reach 63.58% of cyclomatic complexity.

Fuzzers reach 58.75% of all functions.

Fuzzer lyd_parse_lyb is blocked:

The runtime code coverage of lyd_parse_lyb covers 3.553% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer lyd_parse_schema_mount_xml is blocked:

The runtime code coverage of lyd_parse_schema_mount_xml covers 3.694% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer lys_parse_mem is blocked:

The runtime code coverage of lys_parse_mem covers 3.758% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer lyd_parse_mem_xml is blocked:

The runtime code coverage of lyd_parse_mem_xml covers 3.559% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer lyd_parse_mem_json is blocked:

The runtime code coverage of lyd_parse_mem_json covers 3.559% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer yang_parse_module is blocked:

The runtime code coverage of yang_parse_module covers 3.758% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1144 / 1947

Cyclomatic complexity statically reachable by fuzzers

16727 / 26305

Runtime code coverage of functions

44 / 1947

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: yang_parse_module

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8717	98.1%
gold	[1:9]	129	1.45%
yellow	[10:29]	27	0.30%
greenyellow	[30:49]	2	0.02%
lawngreen	50+	8	0.09%
All colors	8883	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2704	898	ly_set_free	call site: 00898	lysp_resolve_import_include
2679	6149	lys_unres_glob_erase	call site: 06149	lyb_print_siblings
2012	4127	lys_load_mod_from_clb_or_file	call site: 04127	ly_ctx_compile
474	3651	lys_parse_localfile	call site: 03651	lys_parse_submodule
418	479	ly_set_erase	call site: 00479	yin_parse_mod
111	367	ly_vlog	call site: 00367	lyxml_open_element
89	277	ly_vlog	call site: 00277	lysc_path
60	139	ly_ctx_shared_data_remove_and_free	call site: 00139	lyd_free_leafref_links_rec
27	8855	LLVMFuzzerTestOneInput	call site: 08855	lys_parse_mem
22	3626	lys_search_localfile	call site: 03626	lys_check_date
16	28	ly_ctx_private_data_remove_and_free	call site: 00028	ly_log
16	230	ly_ctx_get_module_by	call site: 00230	lys_get_module_without_revision

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

1101

Reachable functions

1144

Percentage of reachable functions covered

3.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/yang_parse_module.c	1
src/log.c	16
src/context.c	27
src/ly_common.c	30
src/dict.c	15
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	10
src/tree_data_free.c	12
src/tree_data.c	57
src/tree_schema_common.c	57
src/in.c	6
src/tree_schema.c	42
src/parser_yin.c	76
src/xml.c	25
src/tree_data_common.c	30
src/tree_data.h	3
src/plugins_exts.c	5
src/path.c	16
src/xpath.c	126
compat/compat.c	1
src/tree_schema_free.c	50
src/parser_yang.c	60
src/parser_common.c	12
src/schema_features.c	15
src/schema_compile.c	38
src/schema_compile_amend.c	40
src/schema_compile_node.c	18
src/plugins_types.c	1
src/lyb.c	8
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	27
src/printer_lyb.c	33
src/validation.c	19
src/plugins_exts/metadata.h	1
src/tree_data_new.c	17
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/parser_xml.c	16
src/parser_json.c	23
src/json.c	21
src/diff.c	27

Fuzzer: lyd_parse_mem_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9182	98.2%
gold	[1:9]	35	0.37%
yellow	[10:29]	1	0.01%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	128	1.36%
All colors	9347	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2704	898	ly_set_free	call site: 00898	lysp_resolve_import_include
2679	6149	lys_unres_glob_erase	call site: 06149	lyb_print_siblings
2012	4127	lys_load_mod_from_clb_or_file	call site: 04127	ly_ctx_compile
492	8854	ly_ctx_destroy	call site: 08854	lys_parse_mem
474	3651	lys_parse_localfile	call site: 03651	lys_parse_submodule
418	479	ly_set_erase	call site: 00479	yin_parse_mod
111	367	ly_vlog	call site: 00367	lyxml_open_element
89	277	ly_vlog	call site: 00277	lysc_path
60	139	ly_ctx_shared_data_remove_and_free	call site: 00139	lyd_free_leafref_links_rec
22	3626	lys_search_localfile	call site: 03626	lys_check_date
16	28	ly_ctx_private_data_remove_and_free	call site: 00028	ly_log
16	230	ly_ctx_get_module_by	call site: 00230	lys_get_module_without_revision

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

1165

Reachable functions

1208

Percentage of reachable functions covered

3.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_json.c	1
src/log.c	16
src/context.c	27
src/ly_common.c	30
src/dict.c	15
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	11
src/tree_data_free.c	13
src/tree_data.c	61
src/tree_schema_common.c	57
src/in.c	6
src/tree_schema.c	42
src/parser_yin.c	76
src/xml.c	25
src/tree_data_common.c	36
src/tree_data.h	3
src/plugins_exts.c	5
src/path.c	16
src/xpath.c	126
compat/compat.c	1
src/tree_schema_free.c	50
src/parser_yang.c	60
src/parser_common.c	12
src/schema_features.c	15
src/schema_compile.c	38
src/schema_compile_amend.c	40
src/schema_compile_node.c	18
src/plugins_types.c	1
src/lyb.c	8
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	27
src/printer_lyb.c	33
src/validation.c	36
src/plugins_exts/metadata.h	1
src/tree_data_new.c	18
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/parser_xml.c	16
src/parser_json.c	23
src/json.c	21
src/diff.c	27
src/parser_lyb.c	33

Fuzzer: lyd_parse_mem_xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9182	98.2%
gold	[1:9]	35	0.37%
yellow	[10:29]	1	0.01%
greenyellow	[30:49]	96	1.02%
lawngreen	50+	33	0.35%
All colors	9347	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2704	898	ly_set_free	call site: 00898	lysp_resolve_import_include
2679	6149	lys_unres_glob_erase	call site: 06149	lyb_print_siblings
2012	4127	lys_load_mod_from_clb_or_file	call site: 04127	ly_ctx_compile
492	8854	ly_ctx_destroy	call site: 08854	lys_parse_mem
474	3651	lys_parse_localfile	call site: 03651	lys_parse_submodule
418	479	ly_set_erase	call site: 00479	yin_parse_mod
111	367	ly_vlog	call site: 00367	lyxml_open_element
89	277	ly_vlog	call site: 00277	lysc_path
60	139	ly_ctx_shared_data_remove_and_free	call site: 00139	lyd_free_leafref_links_rec
22	3626	lys_search_localfile	call site: 03626	lys_check_date
16	28	ly_ctx_private_data_remove_and_free	call site: 00028	ly_log
16	230	ly_ctx_get_module_by	call site: 00230	lys_get_module_without_revision

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

1165

Reachable functions

1208

Percentage of reachable functions covered

3.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_mem_xml.c	1
src/log.c	16
src/context.c	27
src/ly_common.c	30
src/dict.c	15
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	11
src/tree_data_free.c	13
src/tree_data.c	61
src/tree_schema_common.c	57
src/in.c	6
src/tree_schema.c	42
src/parser_yin.c	76
src/xml.c	25
src/tree_data_common.c	36
src/tree_data.h	3
src/plugins_exts.c	5
src/path.c	16
src/xpath.c	126
compat/compat.c	1
src/tree_schema_free.c	50
src/parser_yang.c	60
src/parser_common.c	12
src/schema_features.c	15
src/schema_compile.c	38
src/schema_compile_amend.c	40
src/schema_compile_node.c	18
src/plugins_types.c	1
src/lyb.c	8
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	27
src/printer_lyb.c	33
src/validation.c	36
src/plugins_exts/metadata.h	1
src/tree_data_new.c	18
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/parser_xml.c	16
src/parser_json.c	23
src/json.c	21
src/diff.c	27
src/parser_lyb.c	33

Fuzzer: lys_parse_mem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	8717	98.1%
gold	[1:9]	35	0.39%
yellow	[10:29]	94	1.05%
greenyellow	[30:49]	3	0.03%
lawngreen	50+	33	0.37%
All colors	8882	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2704	898	ly_set_free	call site: 00898	lysp_resolve_import_include
2679	6149	lys_unres_glob_erase	call site: 06149	lyb_print_siblings
2012	4127	lys_load_mod_from_clb_or_file	call site: 04127	ly_ctx_compile
474	3651	lys_parse_localfile	call site: 03651	lys_parse_submodule
418	479	ly_set_erase	call site: 00479	yin_parse_mod
111	367	ly_vlog	call site: 00367	lyxml_open_element
89	277	ly_vlog	call site: 00277	lysc_path
60	139	ly_ctx_shared_data_remove_and_free	call site: 00139	lyd_free_leafref_links_rec
27	8854	ly_ctx_destroy	call site: 08854	lys_parse_mem
22	3626	lys_search_localfile	call site: 03626	lys_check_date
16	28	ly_ctx_private_data_remove_and_free	call site: 00028	ly_log
16	230	ly_ctx_get_module_by	call site: 00230	lys_get_module_without_revision

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

1101

Reachable functions

1144

Percentage of reachable functions covered

3.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lys_parse_mem.c	1
src/log.c	16
src/context.c	27
src/ly_common.c	30
src/dict.c	15
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	10
src/tree_data_free.c	12
src/tree_data.c	57
src/tree_schema_common.c	57
src/in.c	6
src/tree_schema.c	42
src/parser_yin.c	76
src/xml.c	25
src/tree_data_common.c	30
src/tree_data.h	3
src/plugins_exts.c	5
src/path.c	16
src/xpath.c	126
compat/compat.c	1
src/tree_schema_free.c	50
src/parser_yang.c	60
src/parser_common.c	12
src/schema_features.c	15
src/schema_compile.c	38
src/schema_compile_amend.c	40
src/schema_compile_node.c	18
src/plugins_types.c	1
src/lyb.c	8
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	27
src/printer_lyb.c	33
src/validation.c	19
src/plugins_exts/metadata.h	1
src/tree_data_new.c	17
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/parser_xml.c	16
src/parser_json.c	23
src/json.c	21
src/diff.c	27

Fuzzer: lyd_parse_schema_mount_xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9194	98.1%
gold	[1:9]	139	1.48%
yellow	[10:29]	27	0.28%
greenyellow	[30:49]	1	0.01%
lawngreen	50+	9	0.09%
All colors	9370	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2704	913	ly_set_free	call site: 00913	lysp_resolve_import_include
2679	6164	lys_unres_glob_erase	call site: 06164	lyb_print_siblings
2012	4142	lys_load_mod_from_clb_or_file	call site: 04142	ly_ctx_compile
500	8869	ly_ctx_destroy	call site: 08869	lys_parse_mem
474	3666	lys_parse_localfile	call site: 03666	lys_parse_submodule
418	494	ly_set_erase	call site: 00494	yin_parse_mod
111	382	ly_vlog	call site: 00382	lyxml_open_element
89	292	ly_vlog	call site: 00292	lysc_path
60	154	ly_ctx_shared_data_remove_and_free	call site: 00154	lyd_free_leafref_links_rec
22	3641	lys_search_localfile	call site: 03641	lys_check_date
16	43	ly_ctx_private_data_remove_and_free	call site: 00043	ly_log
16	245	ly_ctx_get_module_by	call site: 00245	lys_get_module_without_revision

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

1173

Reachable functions

1218

Percentage of reachable functions covered

3.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_schema_mount_xml.c	4
src/log.c	16
src/context.c	28
src/ly_common.c	30
src/dict.c	15
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	11
src/tree_data_free.c	13
src/tree_data.c	61
src/tree_schema_common.c	57
src/in.c	6
src/tree_schema.c	42
src/parser_yin.c	76
src/xml.c	25
src/tree_data_common.c	36
src/tree_data.h	3
src/plugins_exts.c	5
src/path.c	16
src/xpath.c	126
compat/compat.c	1
src/tree_schema_free.c	50
src/parser_yang.c	60
src/parser_common.c	12
src/schema_features.c	15
src/schema_compile.c	38
src/schema_compile_amend.c	40
src/schema_compile_node.c	18
src/plugins_types.c	1
src/lyb.c	8
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	27
src/printer_lyb.c	33
src/validation.c	36
src/plugins_exts/metadata.h	1
src/tree_data_new.c	18
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/parser_xml.c	16
src/parser_json.c	23
src/json.c	21
src/diff.c	27
src/parser_lyb.c	33

Fuzzer: lyd_parse_lyb

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9188	98.2%
gold	[1:9]	128	1.36%
yellow	[10:29]	27	0.28%
greenyellow	[30:49]	2	0.02%
lawngreen	50+	8	0.08%
All colors	9353	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2704	898	ly_set_free	call site: 00898	lysp_resolve_import_include
2679	6149	lys_unres_glob_erase	call site: 06149	lyb_print_siblings
2012	4127	lys_load_mod_from_clb_or_file	call site: 04127	ly_ctx_compile
498	8854	ly_ctx_destroy	call site: 08854	lys_parse_mem
474	3651	lys_parse_localfile	call site: 03651	lys_parse_submodule
418	479	ly_set_erase	call site: 00479	yin_parse_mod
111	367	ly_vlog	call site: 00367	lyxml_open_element
89	277	ly_vlog	call site: 00277	lysc_path
60	139	ly_ctx_shared_data_remove_and_free	call site: 00139	lyd_free_leafref_links_rec
22	3626	lys_search_localfile	call site: 03626	lys_check_date
16	28	ly_ctx_private_data_remove_and_free	call site: 00028	ly_log
16	230	ly_ctx_get_module_by	call site: 00230	lys_get_module_without_revision

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

1167

Reachable functions

1210

Percentage of reachable functions covered

3.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
build/../tests/fuzz/lyd_parse_lyb.c	1
src/log.c	16
src/context.c	27
src/ly_common.c	30
src/dict.c	15
src/hash_table.c	21
src/hash_table_internal.h	1
src/plugins.c	7
src/set.c	11
src/tree_data_free.c	13
src/tree_data.c	61
src/tree_schema_common.c	57
src/in.c	6
src/tree_schema.c	42
src/parser_yin.c	76
src/xml.c	25
src/tree_data_common.c	36
src/tree_data.h	3
src/plugins_exts.c	5
src/path.c	16
src/xpath.c	126
compat/compat.c	1
src/tree_schema_free.c	50
src/parser_yang.c	60
src/parser_common.c	12
src/schema_features.c	15
src/schema_compile.c	38
src/schema_compile_amend.c	40
src/schema_compile_node.c	18
src/plugins_types.c	1
src/lyb.c	8
src/out.c	8
src/printer_data.c	2
src/printer_xml.c	13
src/printer_json.c	27
src/printer_lyb.c	33
src/validation.c	36
src/plugins_exts/metadata.h	1
src/tree_data_new.c	18
src/tree_data_hash.c	5
src/tree_data_sorted.c	39
src/parser_xml.c	16
src/parser_json.c	23
src/json.c	21
src/diff.c	27
src/parser_lyb.c	33

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
structure_compile	/src/libyang/src/plugins_exts/structure.c	3	['N/A', 'N/A', 'N/A']	32	0	619	32	13	312	0	4315	1022
structure_aug_parse	/src/libyang/src/plugins_exts/structure.c	2	['N/A', 'N/A']	29	0	551	37	15	190	0	2276	976
yang_print_parsed_submodule	/src/libyang/src/printer_yang.c	3	['N/A', 'N/A', 'int']	37	0	424	54	20	98	0	857	543
schema_mount_validate	/src/libyang/src/plugins_exts/schema_mount.c	6	['N/A', 'N/A', 'N/A', 'int', 'int', 'N/A']	54	0	529	89	34	951	0	12445	489
lyd_diff_siblings_r	/src/libyang/src/diff.c	5	['N/A', 'N/A', 'short', 'char', 'N/A']	48	0	945	180	61	907	4	11781	365
schema_mount_compiled_print	/src/libyang/src/plugins_exts/schema_mount.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	22	0	386	21	9	183	0	1443	317
lyd_diff_reverse_siblings_r	/src/libyang/src/diff.c	2	['N/A', 'N/A']	47	0	1201	251	82	906	2	11670	238

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1368 / 1947

Cyclomatic complexity statically reachable by fuzzers

20524 / 26305

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

build/../tests/fuzz/yang_parse_module.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ly_set_free', 'lys_unres_glob_erase', 'lys_load_mod_from_clb_or_file', 'lys_parse_localfile', 'ly_set_erase', 'ly_vlog', 'ly_ctx_shared_data_remove_and_free', 'LLVMFuzzerTestOneInput', 'lys_search_localfile']

build/../tests/fuzz/lyd_parse_mem_json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ly_set_free', 'lys_unres_glob_erase', 'lys_load_mod_from_clb_or_file', 'ly_ctx_destroy', 'lys_parse_localfile', 'ly_set_erase', 'ly_vlog', 'ly_ctx_shared_data_remove_and_free', 'lys_search_localfile']

build/../tests/fuzz/lyd_parse_mem_xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ly_set_free', 'lys_unres_glob_erase', 'lys_load_mod_from_clb_or_file', 'ly_ctx_destroy', 'lys_parse_localfile', 'ly_set_erase', 'ly_vlog', 'ly_ctx_shared_data_remove_and_free', 'lys_search_localfile']

build/../tests/fuzz/lys_parse_mem.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ly_set_free', 'lys_unres_glob_erase', 'lys_load_mod_from_clb_or_file', 'lys_parse_localfile', 'ly_set_erase', 'ly_vlog', 'ly_ctx_shared_data_remove_and_free', 'ly_ctx_destroy', 'lys_search_localfile']

build/../tests/fuzz/lyd_parse_schema_mount_xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ly_set_free', 'lys_unres_glob_erase', 'lys_load_mod_from_clb_or_file', 'ly_ctx_destroy', 'lys_parse_localfile', 'ly_set_erase', 'ly_vlog', 'ly_ctx_shared_data_remove_and_free', 'lys_search_localfile']

build/../tests/fuzz/lyd_parse_lyb.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ly_set_free', 'lys_unres_glob_erase', 'lys_load_mod_from_clb_or_file', 'ly_ctx_destroy', 'lys_parse_localfile', 'ly_set_erase', 'ly_vlog', 'ly_ctx_shared_data_remove_and_free', 'lys_search_localfile']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ly_ctx_set_searchdir	60	20	33.33%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']
ly_ctx_destroy	49	20	40.81%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']
log_vprintf	42	14	33.33%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']
ly_vlog_build_path_line	52	13	25.0%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']
ly_ctx_data_add	31	17	54.83%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']
lys_search_localfile	136	61	44.85%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']
lys_search_localfile_file_type	50	24	48.0%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']
lys_load_mod_from_clb_or_file	55	30	54.54%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']
lys_parse_localfile	35	18	51.42%	['lyd_parse_schema_mount_xml', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_mem_json', 'yang_parse_module', 'lyd_parse_lyb']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/libyang/src/plugins_exts.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/ipv6_address.c	[]	[]
/src/libyang/src/plugins_types/identityref.c	[]	[]
/src/libyang/src/printer_xml.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/date.c	[]	[]
/src/libyang/src/tree_data.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_exts/structure.c	[]	[]
/src/libyang/src/plugins_types/enumeration.c	[]	[]
/src/libyang/src/plugins_types/node_instanceid.c	[]	[]
/src/libyang/src/plugins_types/decimal64.c	[]	[]
/src/libyang/src/plugins_exts/metadata.h	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/tree_data_common.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/parser_xml.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/tree_schema_free.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/empty.c	[]	[]
/src/libyang/src/log.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/plugins_types/string.c	[]	[]
/src/libyang/src/plugins_types/ipv4_address_prefix.c	[]	[]
/src/libyang/compat/compat.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_exts/yangdata.c	[]	[]
/src/libyang/src/plugins_exts/metadata.c	[]	[]
/src/libyang/src/plugins_exts/nacm.c	[]	[]
/src/libyang/src/ly_common.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/tree_data_hash.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/tree_schema_common.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/parser_yang.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/printer_data.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/hex_string.c	[]	[]
/src/libyang/src/set.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/plugins_types/date_and_time.c	[]	[]
/src/libyang/src/schema_features.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/dict.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/build/../tests/fuzz/lyd_parse_mem_json.c	['lyd_parse_mem_json']	[]
/src/libyang/src/parser_lyb.c	['lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/plugins_types/binary.c	[]	[]
/src/libyang/src/plugins_types/instanceid_keys.c	[]	[]
/src/libyang/src/printer_yang.c	[]	[]
/src/libyang/src/plugins_types/time.c	[]	[]
/src/libyang/build/../tests/fuzz/yang_parse_module.c	['yang_parse_module']	[]
/src/libyang/src/plugins_types/ipv4_address_no_zone.c	[]	[]
/src/libyang/src/plugins_types/time_period.c	[]	[]
/src/libyang/build/../tests/fuzz/lyd_parse_schema_mount_xml.c	['lyd_parse_schema_mount_xml']	[]
/src/libyang/src/plugins_types/union.c	[]	[]
/src/libyang/src/plugins_types/ipv6_address_no_zone.c	[]	[]
/src/libyang/src/context.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/tree_data_free.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/parser_json.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/tree_data_new.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/ipv6_address_prefix.c	[]	[]
/src/libyang/src/parser_common.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/lyds_tree.c	[]	[]
/src/libyang/src/schema_compile.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/tree_data_sorted.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/diff.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/out.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/schema_compile_amend.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/build/../tests/fuzz/lys_parse_mem.c	['lys_parse_mem']	[]
/src/libyang/src/plugins_exts/schema_mount.c	[]	[]
/src/libyang/src/printer_json.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/printer_lyb.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/in.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/leafref.c	[]	[]
/src/libyang/build/../tests/fuzz/lyd_parse_lyb.c	['lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/integer.c	[]	[]
/src/libyang/src/json.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/parser_yin.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/boolean.c	[]	[]
/src/libyang/src/xml.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/hash_table_internal.h	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/validation.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/schema_compile_node.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/printer_context.c	[]	[]
/src/libyang/src/tree_data.h	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/xpath.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/hash_table.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/path.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/lyb.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_types/ipv4_address.c	[]	[]
/src/libyang/src/plugins_types/instanceid.c	[]	[]
/src/libyang/src/plugins_types/bits.c	[]	[]
/src/libyang/src/plugins_types.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	[]
/src/libyang/src/plugins_exts/openconfig.c	[]	[]
/src/libyang/build/../tests/fuzz/lyd_parse_mem_xml.c	['lyd_parse_mem_xml']	[]
/src/libyang/src/tree_schema.c	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']	['yang_parse_module', 'lyd_parse_mem_json', 'lyd_parse_mem_xml', 'lys_parse_mem', 'lyd_parse_schema_mount_xml', 'lyd_parse_lyb']
/src/libyang/src/plugins_types/xpath1.0.c	[]	[]

Directories in report

Directory
/src/libyang/src/
/src/libyang/src/plugins_types/
/src/libyang/compat/
/src/libyang/build/../tests/fuzz/
/src/libyang/src/plugins_exts/