High level conclusions

Fuzzer gdal/fuzzers/wkt_import_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/wkt_import_fuzzer.cpp covers 17.64% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/gdal_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/gdal_fuzzer.cpp covers 16.25% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/osr_set_from_user_input_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/osr_set_from_user_input_fuzzer.cpp covers 6.666% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer mapfuzzer is blocked:

The runtime code coverage of mapfuzzer covers 27.16% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/gdal_vector_translate_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/gdal_vector_translate_fuzzer.cpp covers 6.622% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/gdal_algorithm_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/gdal_algorithm_fuzzer.cpp covers 15.08% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/ogr_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/ogr_fuzzer.cpp covers 13.50% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/spatialite_geom_import_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/spatialite_geom_import_fuzzer.cpp covers 13.52% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/filename_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/filename_fuzzer.cpp covers 19.32% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/gdal_translate_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/gdal_translate_fuzzer.cpp covers 8.826% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/get_jpeg2000_structure_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/get_jpeg2000_structure_fuzzer.cpp covers 13.51% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer shapefuzzer is blocked:

The runtime code coverage of shapefuzzer covers 15.38% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer gdal/fuzzers/gml_geom_import_fuzzer.cpp is blocked:

The runtime code coverage of gdal/fuzzers/gml_geom_import_fuzzer.cpp covers 8.108% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer configfuzzer is blocked:

The runtime code coverage of configfuzzer covers 17.87% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 3.025% of cyclomatic complexity.

Fuzzers reach 2.180% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

887 / 40676

Cyclomatic complexity statically reachable by fuzzers

7185 / 237447

Runtime code coverage of functions

388 / 40676

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: configfuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1558	88.8%
gold	[1:9]	44	2.50%
yellow	[10:29]	3	0.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	149	8.49%
All colors	1754	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
375	712	msDebug	call site: 00712	CPLParseXMLString
289	1088	VSIStrdup	call site: 01088	OGRPGTableLayer::SetMetadataItem
231	1	LLVMFuzzerTestOneInput	call site: 00001	VSIFfopenHelper
128	384	CPLsnprintf	call site: 00384	CPLvsnprintf
119	1626	VSIUnlink	call site: 01626	WSIOCILobFSHandle::GetConnection
95	583	CPLSPrintf	call site: 00583	OGRFeature::IsFieldSetAndNotNull
43	1386	VSIGetDirectorySeparator	call site: 01386	CPLLoadConfigOptionsFromFile
40	1433	CSLAddStringMayFail	call site: 01433	VSIFree
21	535	CPLRealloc	call site: 00535	VSICheckMarkerBegin
17	243	VSIInstallZipFileHandler	call site: 00243	VSIInstall7zFileHandler
16	1501	msInsertHashTable	call site: 01501	insert
13	280	VSIInstallCachedFileHandler	call site: 00280	OGRPGTableLayer::SetMetadataItem

Runtime coverage analysis

Covered functions

409

Functions that are reachable but not covered

216

Reachable functions

263

Percentage of reachable functions covered

17.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
MapServer/fuzzers/configfuzzer.c	9
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	58
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/port/cpl_vsil.cpp	52
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsi_mem.cpp	2
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	26
gdal/port/cpl_conv.cpp	41
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	24
gdal/ogr/ogrct.cpp	2
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	2
gdal/gcore/gdalalgorithm.h	2
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
MapServermaputil.c	7
MapServermapio.c	21
MapServermaperror.c	20
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	12
MapServermapthread.c	6
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	30
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	10
gdal/port/cpl_findfile.cpp	11
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermapows.c	5
MapServermaphash.c	10
MapServermapserv-config.cpp	24
MapServermapproject.c	13
gdal/ogr/ogr_proj_p.cpp	5
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
MapServerrenderers/aggclipper.cpp	6
MapServerrenderers/agg/include/agg_array.h	3
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	2

Fuzzer: gdal/fuzzers/gml_geom_import_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4506	95.0%
gold	[1:9]	53	1.11%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	183	3.85%
All colors	4742	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1835	1789	msSmallMalloc	call site: 01789	GML2OGRGeometry_XMLNode_Internal
783	3633	OGR_GT_SetM	call site: 03633	OGRGeometryFactory::forceTo
266	1520	CPLError	call site: 01520	GML2OGRGeometry_XMLNode
254	4484	msFreeShape	call site: 04484	GML2OGRGeometry_XMLNode_Internal
227	98	CPLsnprintf	call site: 00098	CPLGetProcessMemorySize
111	1089	CPLParseXMLString	call site: 01089	OGRPGTableLayer::SetMetadataItem
110	621	msIO_fprintf	call site: 00621	OGRAPISpyGetFeatureDefnVar
81	809	CPLStrtodDelim	call site: 00809	OGRFeatureFormatDateTimeBuffer
81	922	CPLParseXMLString	call site: 00922	ReadToken
54	1269	VSIFTellL	call site: 01269	CPLError
52	4421	msAddLineDirectly	call site: 04421	msGEOSGeometry2Shape
42	463	OGR_GT_IsCurve	call site: 00463	OGR_Fld_GetSubType

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

850

Reachable functions

925

Percentage of reachable functions covered

8.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/gml_geom_import_fuzzer.cpp	7
gdal/ogr/gml2ogrgeometry.cpp	161
gdal/port/cpl_error.cpp	44
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_vsisimple.cpp	24
gdal/port/cpl_string.cpp	24
gdal/ogr/ogrct.cpp	2
gdal/port/cpl_conv.cpp	38
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	63
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/port/cpl_vsil.cpp	51
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsi_mem.cpp	2
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	57
gdal/gcore/gdalalgorithm.h	2
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
MapServermaputil.c	7
MapServermapio.c	21
MapServermaperror.c	16
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	7
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
MapServermapthread.c	6
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/ogr/ogrutils.cpp	13
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	5
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	31
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	10
gdal/port/cpl_findfile.cpp	11
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermapows.c	5
MapServermaphash.c	8
gdal/port/cpl_minixml.h	1
MapServerflatgeobuf/include/flatbuffers/vector_downward.h	2
gdal/ogr/ogrcurve.cpp	18
gdal/ogr/ogrsurface.cpp	3
gdal/ogr/ogrcurvepolygon.cpp	17
gdal/ogr/ogrsf_frmts/dwg/ogrdgnv8layer.cpp	1
gdal/ogr/ogr_geometry.h	2
MapServermapscript/v8/line.cpp	12
MapServermapgeos.c	55
MapServermapprimitive.c	11
MapServermappostgis.cpp	2
gdal/ogr/ogr_proj_p.cpp	11
gdal/ogr/ogrlinestring.cpp	20
MapServerrenderers/agg/include/pixman-combine-float-extract.h	2
gdal/ogr/ogrspatialreference.cpp	26
gdal/ogr/ogr_geo_utils.cpp	5
gdal/ogr/ogrgeometryfactory.cpp	158
gdal/ogr/ogrgeometrycollection.cpp	65
gdal/ogr/ogrpolygon.cpp	11
gdal/ogr/ogrpoint.cpp	7
gdal/ogr/ogrcurvecollection.cpp	8
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	7
gdal/ogr/ogrcompoundcurve.cpp	22
gdal/ogr/ogrsf_frmts/ili/ili2reader.cpp	11
gdal/ogr/ogrmultisurface.cpp	3
gdal/ogr/ogrcircularstring.cpp	5
gdal/ogr/ogr_wkb.cpp	1
gdal/ogr/ogrlinearring.cpp	3
MapServermapsearch.c	6
gdal/ogr/ogrmulticurve.cpp	3
gdal/ogr/ogrtriangle.cpp	2
gdal/ogr/ogrtriangulatedsurface.cpp	5
gdal/ogr/ogrmultipolygon.cpp	2
gdal/ogr/ogrmultilinestring.cpp	2
gdal/ogr/ogrpolyhedralsurface.cpp	2
gdal/port/cpl_error.h	1

Fuzzer: shapefuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2454	90.1%
gold	[1:9]	27	0.99%
yellow	[10:29]	3	0.11%
greenyellow	[30:49]	17	0.62%
lawngreen	50+	222	8.15%
All colors	2723	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
898	443	msDebug	call site: 00443	OGRPGTableLayer::SetMetadataItem
616	1655	VSIMkdirRecursive	call site: 01655	cpl::VSIWebHDFSFSHandler::Mkdir
327	91	VSICalloc	call site: 00091	CPLvsnprintf
119	2601	VSIUnlink	call site: 02601	WSIOCILobFSHandle::GetConnection
80	1440	VSIFCloseL	call site: 01440	CPLLoadConfigOptionsFromFile
70	1543	VSIFileFromMemBuffer	call site: 01543	OSM_AddString
54	1385	VSIFTellL	call site: 01385	CPLError
34	1342	VSIFReadL	call site: 01342	OGRFeature::SetFieldNull
34	1620	VSIStatExL	call site: 01620	CPLJSONObject::GetType
26	61	VSIInstallCachedFileHandler	call site: 00061	OGRPGTableLayer::SetMetadataItem
21	2272	VSIFileFromMemBuffer	call site: 02272	VSIError
17	24	VSIInstallZipFileHandler	call site: 00024	VSIInstall7zFileHandler

Runtime coverage analysis

Covered functions

351

Functions that are reachable but not covered

341

Reachable functions

403

Percentage of reachable functions covered

15.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
MapServer/fuzzers/shapefuzzer.c	14
gdal/port/cpl_vsi_mem.cpp	30
gdal/port/cpl_vsil.cpp	68
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	34
gdal/port/cpl_conv.cpp	41
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	24
gdal/ogr/ogrct.cpp	2
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	60
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermaputil.c	7
MapServermapio.c	21
MapServermaperror.c	20
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	7
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
MapServermapthread.c	6
MapServermapows.c	5
MapServermaphash.c	8
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	2
gdal/gcore/gdalalgorithm.h	2
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	30
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	18
gdal/port/cpl_findfile.cpp	11
MapServerrenderers/agg/include/pixman-combine-float-extract.h	1
gdal/ogr/ogrsf_frmts/osm/osm_parser.cpp	4
gdal/port/cplstringlist.cpp	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	7
MapServermapogcsos.c	1
gdal/ogr/ogrsf_frmts/mvt/mvtutils.cpp	5
gdal/port/cpl_json.cpp	14
gdal/ogr/ogrsf_frmts/geojson/libjson/json_object.c	52
gdal/ogr/ogrsf_frmts/geojson/libjson/json_util.c	7
MapServerthird-party/pantor/inja.hpp	1
gdal/port/cpl_vsil_webhdfs.cpp	38
gdal/port/cpl_vsil_curl.cpp	15
gdal/port/cpl_http.cpp	41
gdal/port/cpl_google_cloud.cpp	2
gdal/port/cpl_vsil_curl_class.h	1
gdal/ogr/ogrsf_frmts/geojson/libjson/linkhash.c	11
gdal/ogr/ogrsf_frmts/geojson/libjson/printbuf.c	3
gdal/ogr/ogrsf_frmts/geojson/libjson/arraylist.c	4
gdal/ogr/ogrsf_frmts/geojson/libjson/json_tokener.c	47
gdal/port/cpl_vsi_error.cpp	11
MapServermapshape.c	34
MapServermapbits.c	1
MapServermapxbase.c	13
MapServermaptree.c	2
MapServermapprimitive.c	4
MapServermapgeos.c	3
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
MapServerrenderers/aggclipper.cpp	6
MapServerrenderers/agg/include/agg_array.h	3
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	2

Fuzzer: gdal/fuzzers/get_jpeg2000_structure_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2392	89.5%
gold	[1:9]	47	1.75%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.07%
lawngreen	50+	231	8.64%
All colors	2672	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
350	2147	CPLReadLineL	call site: 02147	json_tokener_parse_ex
227	102	CPLsnprintf	call site: 00102	CPLGetProcessMemorySize
160	1986	CPLIsDebugEnabled	call site: 01986	CPLReadLineL
122	1423	CPLParseXMLString	call site: 01423	OGRPGTableLayer::SetMetadataItem
119	2552	VSIUnlink	call site: 02552	WSIOCILobFSHandle::GetConnection
110	669	msIO_fprintf	call site: 00669	OGRAPISpyGetFeatureDefnVar
81	857	CPLStrtodDelim	call site: 00857	OGRFeatureFormatDateTimeBuffer
81	1292	CPLParseXMLString	call site: 01292	ReadToken
60	1597	initLegend	call site: 01597	CPLParseXMLString
56	1881	VSIMkdirRecursive	call site: 01881	cpl::VSIWebHDFSFSHandler::Mkdir
55	1675	initLegend	call site: 01675	GDALVRTRegisterProcessedDatasetFunc
54	978	VSIFTellL	call site: 00978	CPLError

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

448

Reachable functions

518

Percentage of reachable functions covered

13.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/get_jpeg2000_structure_fuzzer.cpp	11
gdal/frmts/gtiff/geotiff.cpp	6
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	39
gdal/port/cpl_conv.cpp	41
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	24
gdal/ogr/ogrct.cpp	2
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	60
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/port/cpl_vsil.cpp	68
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsi_mem.cpp	30
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	2
gdal/gcore/gdalalgorithm.h	2
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
MapServermaputil.c	6
MapServermapio.c	21
MapServermaperror.c	16
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	6
MapServermapthread.c	6
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	18
gdal/port/cpl_findfile.cpp	11
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermapows.c	5
MapServermaphash.c	8
gdal/port/cpl_minixml.cpp	31
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/frmts/vrt/vrtdriver.cpp	13
gdal/frmts/vrt/pixelfunctions.cpp	2
gdal/frmts/vrt/vrtprocesseddatasetfunctions.cpp	1
gdal/frmts/vrt/vrtprocesseddataset.cpp	15
gdal/port/cpl_minixml.h	1
gdal/alg/gdaltransformer.cpp	4
gdal/port/cpl_list.cpp	3
MapServerrenderers/agg/include/pixman-combine-float-extract.h	1
gdal/ogr/ogrsf_frmts/osm/osm_parser.cpp	4
gdal/port/cplstringlist.cpp	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	7
MapServermapogcsos.c	1
gdal/ogr/ogrsf_frmts/mvt/mvtutils.cpp	5
gdal/port/cpl_json.cpp	14
gdal/ogr/ogrsf_frmts/geojson/libjson/json_object.c	52
gdal/ogr/ogrsf_frmts/geojson/libjson/json_util.c	7
MapServerthird-party/pantor/inja.hpp	1
gdal/port/cpl_vsil_webhdfs.cpp	38
gdal/port/cpl_vsil_curl.cpp	15
gdal/port/cpl_http.cpp	41
gdal/port/cpl_google_cloud.cpp	2
gdal/port/cpl_vsil_curl_class.h	1
gdal/ogr/ogrsf_frmts/geojson/libjson/linkhash.c	11
gdal/ogr/ogrsf_frmts/geojson/libjson/printbuf.c	3
gdal/ogr/ogrsf_frmts/geojson/libjson/arraylist.c	4
gdal/ogr/ogrsf_frmts/geojson/libjson/json_tokener.c	47
gdal/port/cpl_vsi_error.cpp	11
gdal/gcore/gdaljp2structure.cpp	5
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
MapServerrenderers/aggclipper.cpp	6
MapServerrenderers/agg/include/agg_array.h	3
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	2

Fuzzer: gdal/fuzzers/gdal_translate_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15456	97.7%
gold	[1:9]	56	0.35%
yellow	[10:29]	4	0.02%
greenyellow	[30:49]	5	0.03%
lawngreen	50+	290	1.83%
All colors	15811	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3703	9881	msAddImageSymbol	call site: 09881	GTiffDataset::ApplyPamInfo
2462	6932	VSIUnlink	call site: 06932	GTiffDataset::WriteGeoTIFFInfo
2225	13585	CPLAtoGIntBig	call site: 13585	GTiffDataset::CreateMaskBand
1691	5128	VSIIngestFile	call site: 05128	GTiffDataset::CreateMaskBand
1118	3557	initLegend	call site: 03557	GDALTranslate
426	2307	VSIFileFromMemBuffer	call site: 02307	OGRLIBKMLDataSource::OpenDir
420	2871	InvGeoTransform	call site: 02871	OGRLIBKMLDataSource::AddLayer
350	1918	CPLReadLineL	call site: 01918	json_tokener_parse_ex
312	9397	CPLParseXMLFile	call site: 09397	TileDBRasterDataset::TrySaveXML
227	162	CPLsnprintf	call site: 00162	CPLGetProcessMemorySize
218	3310	msFreeCharArray	call site: 03310	OGRLIBKMLDataSource::ParseLayers
160	1757	CPLIsDebugEnabled	call site: 01757	CPLReadLineL

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

1033

Reachable functions

1133

Percentage of reachable functions covered

8.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/gdal_translate_fuzzer.cpp	26
gdal/port/cpl_vsi_mem.cpp	31
gdal/port/cpl_vsil.cpp	96
gdal/port/cpl_vsil_win32.cpp	4
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	20
gdal/frmts/gtiff/gtiffrasterband_write.cpp	7
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	55
gdal/port/cpl_conv.cpp	55
gdal/port/cpl_multiproc.cpp	4
gdal/port/cpl_error.cpp	46
gdal/port/cpl_vsisimple.cpp	38
gdal/ogr/ogrct.cpp	85
gdal/port/vsipreload.cpp	24
MapServerthird-party/nlohmann/json.hpp	83
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	21
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermaputil.c	22
MapServermapio.c	23
MapServermaperror.c	20
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	18
MapServermapfile.c	9
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
MapServermapthread.c	7
MapServermapows.c	19
MapServermaphash.c	8
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	10
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	2
gdal/gcore/gdalalgorithm.h	6
gdal/ogr/ogrfielddefn.cpp	5
gdal/ogr/ograpispy.cpp	18
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	44
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	30
gdal/gcore/gdalmajorobject.cpp	2
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	19
gdal/port/cpl_findfile.cpp	11
MapServerrenderers/agg/include/pixman-combine-float-extract.h	2
gdal/ogr/ogrsf_frmts/osm/osm_parser.cpp	4
gdal/port/cplstringlist.cpp	3
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	8
MapServermapogcsos.c	29
gdal/ogr/ogrsf_frmts/mvt/mvtutils.cpp	5
gdal/port/cpl_json.cpp	45
gdal/ogr/ogrsf_frmts/geojson/libjson/json_object.c	56
gdal/ogr/ogrsf_frmts/geojson/libjson/json_util.c	7
MapServerthird-party/pantor/inja.hpp	1
gdal/port/cpl_vsil_webhdfs.cpp	38
gdal/port/cpl_vsil_curl.cpp	15
gdal/port/cpl_http.cpp	85
gdal/port/cpl_google_cloud.cpp	2
gdal/port/cpl_vsil_curl_class.h	1
gdal/ogr/ogrsf_frmts/geojson/libjson/linkhash.c	12
gdal/ogr/ogrsf_frmts/geojson/libjson/printbuf.c	3
gdal/ogr/ogrsf_frmts/geojson/libjson/arraylist.c	4
gdal/ogr/ogrsf_frmts/geojson/libjson/json_tokener.c	47
gdal/port/cpl_vsi_error.cpp	13
gdal/apps/gdal_translate_lib.cpp	210
MapServerrenderers/agg/include/agg_array.h	3
gdal/apps/commonutils.cpp	7
gdal/apps/argparse/argparse.hpp	55
gdal/apps/gdalargumentparser.cpp	33
gdal/apps/gdaltindex_lib.cpp	15
gdal/ogr/ogrsf_frmts/libkml/ogrlibkmldatasource.cpp	51
MapServermapproject.c	9
gdal/ogr/ogrsf_frmts/libkml/ogrlibkmlstyle.cpp	116
gdal/ogr/ogrfeaturestyle.cpp	15
MapServermapobject.c	5
MapServermapresample.c	1
MapServermapgeos.c	3
gdal/ogr/ogrsf_frmts/libkml/ogrlibkmllayer.cpp	63
gdal/ogr/ogrfeaturedefn.cpp	9
gdal/ogr/ogrspatialreference.cpp	100
gdal/ogr/ogrsf_frmts/libkml/ogrlibkmlfield.cpp	11
gdal/ogr/ogr_spatialref.h	1
gdal/frmts/netcdf/netcdfwriterconfig.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogr_pg.h	1
MapServermapowscommon.c	10
gdal/gcore/gdalrasterband.cpp	51
MapServerflatgeobuf/include/flatbuffers/vector_downward.h	13
gdal/ogr/ogrsf_frmts/gpkg/ogr_geopackage.h	1
gdal/ogr/ogrsf_frmts/generic/ogrsfdriverregistrar.cpp	3
gdal/frmts/libertiff/libertiffdataset.cpp	7
gdal/ogr/ogrgeometrycollection.cpp	10
gdal/ogr/ogr_proj_p.cpp	18
gdal/frmts/mrf/BitMask2D.h	5
MapServermapcontext.c	10
gdal/ogr/ogrsf_frmts/openfilegdb/ogr_openfilegdb.h	15
gdal/frmts/idrisi/IdrisiDataset.cpp	31
gdal/gcore/gdal_priv_templates.hpp	5
gdal/gcore/gdaloverviewdataset.cpp	27
gdal/gcore/gdal_priv.h	2
gdal/frmts/gti/gdaltileindexdataset.cpp	6
gdal/gcore/gdalnodatamaskband.cpp	12
gdal/gcore/gdaldefaultoverviews.cpp	24
gdal/gcore/gdal_misc.cpp	44
gdal/gcore/gdalnodatavaluesmaskband.cpp	7
gdal/ogr/ogrsf_frmts/sqlite/rasterlite2.cpp	1
gdal/gcore/gdalrescaledalphaband.cpp	5
gdal/gcore/gdalallvalidmaskband.cpp	3
gdal/ogr/ogrsf_frmts/generic/ogr_gensql.cpp	2
gdal/frmts/mem/memmultidim.h	2
gdal/ogr/ogrsf_frmts/gpkg/ogrgeopackagedatasource.cpp	72
gdal/gcore/tilematrixset.cpp	42
gdal/frmts/wmts/wmtsdataset.cpp	1
gdal/ogr/ogrsf_frmts/sqlite/ogrsqlitedatasource.cpp	1
gdal/ogr/ogrsf_frmts/generic/ogrlayerarrow.cpp	2
MapServer/tests/unit/test.cpp	3
gdal/ogr/ogr_schema_override.cpp	1
MapServermapoglcontext.cpp	7
gdal/ogr/ogr_srsnode.cpp	2
MapServerflatgeobuf/include/flatbuffers/code_generators.h	2
gdal/frmts/daas/daasdataset.cpp	8
gdal/ogr/ogrsf_frmts/sqlite/ogrsqliteutility.cpp	11
gdal/gcore/gdalpamdataset.cpp	37
gdal/gcore/gdalmultidomainmetadata.cpp	20
MapServermaplayer.c	4
MapServerrenderers/aggclipper.cpp	7
gdal/frmts/gta/gtadataset.cpp	1
gdal/autotest/cpp/test_ogr_wkb.cpp	1
gdal/port/cpl_minixml.h	2
gdal/gcore/gdalcolortable.cpp	5
gdal/frmts/kea/keadataset.cpp	9
gdal/frmts/kea/keaband.cpp	25
gdal/frmts/kea/keadataset.h	1
gdal/frmts/kea/kearat.cpp	6
gdal/ogr/ogrsf_frmts/openfilegdb/filegdbindex.cpp	1
gdal/frmts/wms/wmsdriver.h	1
gdal/frmts/vrt/vrtsourcedrasterband.cpp	36
gdal/frmts/vrt/vrtsources.cpp	32
gdal/port/cpl_hash_set.cpp	8
gdal/frmts/pdf/pdfdataset.cpp	9
gdal/frmts/pdf/pdfobject.cpp	2
gdal/gcore/gdalproxypool.cpp	38
gdal/port/cpl_list.cpp	1
gdal/ogr/ogrsf_frmts/openfilegdb/ogropenfilegdbdatasource.cpp	13
gdal/frmts/mrf/marfa_dataset.cpp	6
gdal/ogr/ogrsf_frmts/gpkg/gdalgeopackagerasterband.cpp	14
gdal/frmts/vrt/vrtmultidim.cpp	4
gdal/frmts/zarr/zarrdriver.cpp	3
gdal/frmts/gtiff/gtiffdataset_write.cpp	193
gdal/frmts/gtiff/gtiffdataset.cpp	64
gdal/frmts/gtiff/libtiff/tif_dir.c	37
gdal/frmts/gtiff/libtiff/tif_dirinfo.c	14
gdal/frmts/gtiff/libtiff/tif_error.c	2
gdal/frmts/gtiff/libtiff/tif_warning.c	2
gdal/frmts/gtiff/libtiff/tif_open.c	33
gdal/frmts/gtiff/libtiff/tif_vsi.c	7
gdal/frmts/gtiff/geotiff.cpp	29
gdal/gcore/gdal_mdreader.cpp	27
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	2
gdal/alg/internal_libqhull/qset_r.c	28
gdal/alg/internal_qhull_headers.h	3
gdal/alg/internal_libqhull/user_r.c	29
gdal/alg/internal_libqhull/usermem_r.c	7
gdal/alg/internal_libqhull/io_r.c	135
gdal/alg/internal_libqhull/geom2_r.c	46
gdal/alg/internal_libqhull/mem_r.c	7
gdal/alg/internal_libqhull/libqhull_r.c	11
gdal/alg/internal_libqhull/geom_r.c	21
gdal/alg/internal_libqhull/poly2_r.c	85
gdal/ogr/ogrsf_frmts/gpkg/ogrgeopackagetablelayer.cpp	7
gdal/alg/internal_libqhull/global_r.c	7
gdal/alg/internal_libqhull/merge_r.c	19
gdal/alg/internal_libqhull/poly_r.c	34
gdal/alg/internal_libqhull/stat_r.c	16
gdal/frmts/gtiff/gtiffdataset_read.cpp	180
gdal/frmts/gtiff/libgeotiff/geo_new.c	9
gdal/frmts/gtiff/libgeotiff/geo_tiffp.c	5
gdal/frmts/gtiff/libgeotiff/geo_print.c	11
gdal/frmts/gtiff/libgeotiff/geo_set.c	8
gdal/frmts/gtiff/libgeotiff/geo_names.c	7
gdal/frmts/gtiff/libgeotiff/geo_free.c	2
gdal/frmts/gtiff/libgeotiff/geo_normalize.c	56
gdal/frmts/gtiff/gt_wkt_srs.cpp	70
gdal/frmts/gtiff/libgeotiff/geo_get.c	7
gdal/ogr/gml2ogrgeometry.cpp	7
MapServermapv8.cpp	11
MapServermappostgis.cpp	2
gdal/frmts/wcs/wcsdataset.cpp	42
gdal/port/cplstring.cpp	4
gdal/frmts/wcs/wcsdataset110.cpp	21
gdal/frmts/tiledb/tiledbdense.cpp	51
gdal/frmts/tiledb/tiledbmultidim.h	3
MapServerrenderers/agg/include/agg_renderer_outline_aa.h	1
MapServermapscript/v8/shape.cpp	12
MapServermapsymbol.c	17
MapServermaphttp.c	41
MapServermapscript/v8/v8_mapscript.h	5
MapServermapscript/v8/point.cpp	10
MapServermapscript/v8/line.cpp	10
gdal/ogr/ogrsf_frmts/pmtiles/vsipmtiles.cpp	29
gdal/ogr/ogrsf_frmts/gpkg/ogrgeopackagedriver.cpp	2
gdal/ogr/ogrsf_frmts/pmtiles/ogrpmtilestileiterator.cpp	23
gdal/ogr/ogrsf_frmts/pmtiles/pmtiles/pmtiles.hpp	10
gdal/ogr/ogrsf_frmts/shape/ogrshape.h	1
gdal/frmts/gtiff/tifvsi.cpp	45
gdal/frmts/gtiff/libtiff/tif_write.c	35
gdal/frmts/gtiff/libtiff/tif_dirread.c	169
gdal/frmts/gtiff/libtiff/tif_aux.c	16
gdal/frmts/gtiff/libtiff/tif_swab.c	1
gdal/ogr/ogrsf_frmts/dwg/ogrdgnv8datasource.cpp	23
MapServermapogcapi.cpp	2
gdal/ogr/ogrsf_frmts/ngw/gdalngwdataset.cpp	11
gdal/gcore/mdreader/reader_landsat.cpp	2
gdal/gcore/gdalexif.cpp	24
gdal/gcore/gdalpamrasterband.cpp	8
gdal/frmts/gxf/gxf_ogcwkt.c	3
gdal/frmts/gtiff/gt_citation.cpp	8
gdal/frmts/gtiff/libgeotiff/geo_write.c	6
gdal/frmts/gtiff/libtiff/tif_tile.c	11
gdal/frmts/gtiff/libtiff/tif_strip.c	14
gdal/frmts/gtiff/libtiff/tif_flush.c	7
gdal/frmts/gtiff/libtiff/tif_dirwrite.c	114
gdal/frmts/gtiff/libtiff/tif_hash_set.c	13
gdal/frmts/gtiff/libtiff/tif_close.c	10
gdal/frmts/gtiff/libtiff/tif_codec.c	1
gdal/frmts/gtiff/libgeotiff/xtiff.c	4
gdal/frmts/gtiff/libtiff/tif_getimage.c	3
gdal/gcore/tiff_common.cpp	7
gdal/frmts/gtiff/gtiffsplitbitmapband.cpp	1
gdal/frmts/gtiff/gtiffsplitband.cpp	1
gdal/frmts/gtiff/gtiffbitmapband.cpp	3
gdal/frmts/gtiff/gtiffrasterband.cpp	6
gdal/frmts/gtiff/gt_overview.cpp	14
gdal/frmts/gtiff/libtiff/tif_compress.c	4
gdal/port/cpl_vsil_gs.cpp	1

Fuzzer: gdal/fuzzers/filename_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2220	88.7%
gold	[1:9]	47	1.87%
yellow	[10:29]	2	0.07%
greenyellow	[30:49]	5	0.19%
lawngreen	50+	227	9.07%
All colors	2501	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
350	1919	CPLReadLineL	call site: 01919	json_tokener_parse_ex
227	164	CPLsnprintf	call site: 00164	CPLGetProcessMemorySize
160	1758	CPLIsDebugEnabled	call site: 01758	CPLReadLineL
133	2367	VSIUnlink	call site: 02367	VSIFileFromMemBuffer
114	566	VSIFOpenEx2L	call site: 00566	CPLvsnprintf
111	1204	CPLParseXMLString	call site: 01204	OGRPGTableLayer::SetMetadataItem
81	961	CPLStrtodDelim	call site: 00961	OGRFeatureFormatDateTimeBuffer
81	1073	CPLParseXMLString	call site: 01073	ReadToken
59	1384	VSIFTellL	call site: 01384	CPLLoadConfigOptionsFromFile
56	1653	VSIMkdirRecursive	call site: 01653	cpl::VSIWebHDFSFSHandler::Mkdir
48	751	CPLSPrintf	call site: 00751	OGRFeature::IsFieldSetAndNotNull
43	1452	VSIGetDirectorySeparator	call site: 01452	CPLLoadConfigOptionsFromFile

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

313

Reachable functions

388

Percentage of reachable functions covered

19.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/filename_fuzzer.cpp	10
gdal/port/cpl_vsil.cpp	83
gdal/port/cpl_vsi_mem.cpp	30
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	34
gdal/port/cpl_conv.cpp	41
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	24
gdal/ogr/ogrct.cpp	2
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	60
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermaputil.c	6
MapServermapio.c	21
MapServermaperror.c	16
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	6
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
MapServermapthread.c	6
MapServermapows.c	5
MapServermaphash.c	8
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	2
gdal/gcore/gdalalgorithm.h	2
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	30
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	18
gdal/port/cpl_findfile.cpp	11
MapServerrenderers/agg/include/pixman-combine-float-extract.h	1
gdal/ogr/ogrsf_frmts/osm/osm_parser.cpp	4
gdal/port/cplstringlist.cpp	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	7
MapServermapogcsos.c	1
gdal/ogr/ogrsf_frmts/mvt/mvtutils.cpp	5
gdal/port/cpl_json.cpp	14
gdal/ogr/ogrsf_frmts/geojson/libjson/json_object.c	52
gdal/ogr/ogrsf_frmts/geojson/libjson/json_util.c	7
MapServerthird-party/pantor/inja.hpp	1
gdal/port/cpl_vsil_webhdfs.cpp	38
gdal/port/cpl_vsil_curl.cpp	15
gdal/port/cpl_http.cpp	41
gdal/port/cpl_google_cloud.cpp	2
gdal/port/cpl_vsil_curl_class.h	1
gdal/ogr/ogrsf_frmts/geojson/libjson/linkhash.c	11
gdal/ogr/ogrsf_frmts/geojson/libjson/printbuf.c	3
gdal/ogr/ogrsf_frmts/geojson/libjson/arraylist.c	4
gdal/ogr/ogrsf_frmts/geojson/libjson/json_tokener.c	47
gdal/port/cpl_vsi_error.cpp	11
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
MapServerrenderers/aggclipper.cpp	6
MapServerrenderers/agg/include/agg_array.h	3
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	2
gdal/port/cpl_vsil_gs.cpp	1

Fuzzer: gdal/fuzzers/spatialite_geom_import_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	37.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	5	62.5%
All colors	8	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	2	LLVMFuzzerTestOneInput	call site: 00002	OGRSQLiteLayer::ImportSpatiaLiteGeometry

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

275

Reachable functions

318

Percentage of reachable functions covered

13.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/spatialite_geom_import_fuzzer.cpp	5
gdal/ogr/ogrsf_frmts/sqlite/ogrsqlitelayer.cpp	1

Fuzzer: gdal/fuzzers/ogr_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2293	89.6%
gold	[1:9]	47	1.83%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.07%
lawngreen	50+	215	8.40%
All colors	2557	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
350	1923	CPLReadLineL	call site: 01923	json_tokener_parse_ex
349	167	CPLsnprintf	call site: 00167	CPLvsnprintf
160	1762	CPLIsDebugEnabled	call site: 01762	CPLReadLineL
120	2436	VSIUnlink	call site: 02436	WSIOCILobFSHandle::GetConnection
111	1144	CPLParseXMLString	call site: 01144	OGRPGTableLayer::SetMetadataItem
81	901	CPLStrtodDelim	call site: 00901	OGRFeatureFormatDateTimeBuffer
81	1013	CPLParseXMLString	call site: 01013	ReadToken
68	2366	initLegend	call site: 02366	OGR_L_GetGeomType
56	1657	VSIMkdirRecursive	call site: 01657	cpl::VSIWebHDFSFSHandler::Mkdir
54	1324	VSIFTellL	call site: 01324	CPLError
51	2312	VSIFileFromMemBuffer	call site: 02312	OGR_DS_GetLayer
48	590	CPLSPrintf	call site: 00590	OGRFeature::IsFieldSetAndNotNull

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

333

Reachable functions

385

Percentage of reachable functions covered

13.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/ogr_fuzzer.cpp	26
gdal/port/cpl_vsil.cpp	68
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsi_mem.cpp	30
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	34
gdal/port/cpl_conv.cpp	41
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	24
gdal/ogr/ogrct.cpp	2
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	60
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
gdal/ogr/ogrfeature.cpp	39
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	6
gdal/gcore/gdalalgorithm.h	2
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	25
MapServermaputil.c	6
MapServermapio.c	21
MapServermaperror.c	16
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	6
MapServermapthread.c	6
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	30
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	26
gdal/port/cpl_findfile.cpp	11
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermapows.c	5
MapServermaphash.c	8
MapServerrenderers/agg/include/pixman-combine-float-extract.h	1
gdal/ogr/ogrsf_frmts/osm/osm_parser.cpp	4
gdal/port/cplstringlist.cpp	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	7
MapServermapogcsos.c	1
gdal/ogr/ogrsf_frmts/mvt/mvtutils.cpp	5
gdal/port/cpl_json.cpp	14
gdal/ogr/ogrsf_frmts/geojson/libjson/json_object.c	52
gdal/ogr/ogrsf_frmts/geojson/libjson/json_util.c	7
MapServerthird-party/pantor/inja.hpp	1
gdal/port/cpl_vsil_webhdfs.cpp	38
gdal/port/cpl_vsil_curl.cpp	15
gdal/port/cpl_http.cpp	41
gdal/port/cpl_google_cloud.cpp	2
gdal/port/cpl_vsil_curl_class.h	1
gdal/ogr/ogrsf_frmts/geojson/libjson/linkhash.c	11
gdal/ogr/ogrsf_frmts/geojson/libjson/printbuf.c	3
gdal/ogr/ogrsf_frmts/geojson/libjson/arraylist.c	4
gdal/ogr/ogrsf_frmts/geojson/libjson/json_tokener.c	47
gdal/port/cpl_vsi_error.cpp	11
gdal/ogr/ogrsf_frmts/generic/ogrsfdriverregistrar.cpp	5
gdal/ogr/ogrsf_frmts/generic/ogrdatasource.cpp	6
gdal/ogr/ogrsf_frmts/generic/ogrlayer.cpp	11
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
MapServerrenderers/aggclipper.cpp	6
MapServerrenderers/agg/include/agg_array.h	3
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	2

Fuzzer: gdal/fuzzers/gdal_algorithm_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2109	89.0%
gold	[1:9]	47	1.98%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.08%
lawngreen	50+	210	8.86%
All colors	2368	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
350	1918	CPLReadLineL	call site: 01918	json_tokener_parse_ex
227	162	CPLsnprintf	call site: 00162	CPLGetProcessMemorySize
160	1757	CPLIsDebugEnabled	call site: 01757	CPLReadLineL
114	564	VSIFOpenEx2L	call site: 00564	CPLvsnprintf
111	1202	CPLParseXMLString	call site: 01202	OGRPGTableLayer::SetMetadataItem
81	959	CPLStrtodDelim	call site: 00959	OGRFeatureFormatDateTimeBuffer
81	1071	CPLParseXMLString	call site: 01071	ReadToken
60	2307	VSIFileFromMemBuffer	call site: 02307	CPLReadLineL
56	1652	VSIMkdirRecursive	call site: 01652	cpl::VSIWebHDFSFSHandler::Mkdir
54	1382	VSIFTellL	call site: 01382	CPLError
48	749	CPLSPrintf	call site: 00749	OGRFeature::IsFieldSetAndNotNull
43	1451	VSIGetDirectorySeparator	call site: 01451	CPLLoadConfigOptionsFromFile

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

304

Reachable functions

358

Percentage of reachable functions covered

15.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/gdal_algorithm_fuzzer.cpp	23
gdal/port/cpl_vsi_mem.cpp	30
gdal/port/cpl_vsil.cpp	68
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	34
gdal/port/cpl_conv.cpp	41
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	24
gdal/ogr/ogrct.cpp	2
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	60
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermaputil.c	6
MapServermapio.c	21
MapServermaperror.c	16
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	6
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
MapServermapthread.c	6
MapServermapows.c	5
MapServermaphash.c	8
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	2
gdal/gcore/gdalalgorithm.h	4
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	30
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	22
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	18
gdal/port/cpl_findfile.cpp	11
MapServerrenderers/agg/include/pixman-combine-float-extract.h	1
gdal/ogr/ogrsf_frmts/osm/osm_parser.cpp	4
gdal/port/cplstringlist.cpp	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	7
MapServermapogcsos.c	1
gdal/ogr/ogrsf_frmts/mvt/mvtutils.cpp	5
gdal/port/cpl_json.cpp	14
gdal/ogr/ogrsf_frmts/geojson/libjson/json_object.c	52
gdal/ogr/ogrsf_frmts/geojson/libjson/json_util.c	7
MapServerthird-party/pantor/inja.hpp	1
gdal/port/cpl_vsil_webhdfs.cpp	38
gdal/port/cpl_vsil_curl.cpp	15
gdal/port/cpl_http.cpp	41
gdal/port/cpl_google_cloud.cpp	2
gdal/port/cpl_vsil_curl_class.h	1
gdal/ogr/ogrsf_frmts/geojson/libjson/linkhash.c	11
gdal/ogr/ogrsf_frmts/geojson/libjson/printbuf.c	3
gdal/ogr/ogrsf_frmts/geojson/libjson/arraylist.c	4
gdal/ogr/ogrsf_frmts/geojson/libjson/json_tokener.c	47
gdal/port/cpl_vsi_error.cpp	11
gdal/ogr/ogrsf_frmts/parquet/ogrparquetdatasetlayer.cpp	1
gdal/gcore/gdalalgorithmregistry.cpp	3
MapServerflatgeobuf/include/flatbuffers/array.h	4
gdal/gcore/gdalalgorithm.cpp	3
gdal/ogr/ogrsf_frmts/gpkg/ogr_geopackage.h	1
gdal/port/cpl_vsil_gs.cpp	1

Fuzzer: gdal/fuzzers/gdal_vector_translate_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	21434	95.3%
gold	[1:9]	88	0.39%
yellow	[10:29]	29	0.12%
greenyellow	[30:49]	23	0.10%
lawngreen	50+	911	4.05%
All colors	22485	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3278	7279	CSLAddNameValue	call site: 07279	LayerTranslator::Translate
1629	18143	initLegend	call site: 18143	msInterpolationDataset
1406	21078	CPLAtoGIntBig	call site: 21078	OpenFileGDB::FileGDBTable::Sync
1289	4982	OGR_GT_SetM	call site: 04982	OGRGeometry::MakeValid
1229	3744	initLegend	call site: 03744	GDALVectorTranslate
1106	19839	OGR_G_GetPoints	call site: 19839	OpenFileGDB::FileGDBOGRGeometryConverterImpl::GetAsGeometry
801	16467	msFreeMap	call site: 16467	msPostGISLayerGetShapeCount
782	13317	msInitQuery	call site: 13317	msDrawRasterLayerLow
657	15249	msGetPath	call site: 15249	msResampleGDALToMap
617	17523	msMapComputeGeotransform	call site: 17523	LayerTranslator::Translate
489	12770	OGR_G_DestroyGeometry	call site: 12770	msRasterLabelLayerWhichShapes
420	3058	InvGeoTransform	call site: 03058	OGRLIBKMLDataSource::AddLayer

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

1565

Reachable functions

1676

Percentage of reachable functions covered

6.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/gdal_vector_translate_fuzzer.cpp	20
gdal/port/cpl_vsi_mem.cpp	30
gdal/port/cpl_vsil.cpp	90
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsil_gzip.cpp	19
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	53
gdal/port/cpl_conv.cpp	50
gdal/port/cpl_multiproc.cpp	5
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	29
gdal/ogr/ogrct.cpp	78
gdal/port/vsipreload.cpp	30
MapServerthird-party/nlohmann/json.hpp	87
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	21
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	6
MapServermaprasterlabel.cpp	77
MapServermaputil.c	54
MapServermapio.c	23
MapServermaperror.c	25
MapServermapdebug.c	10
MapServermaptime.c	13
MapServermapstring.cpp	38
MapServermapfile.c	92
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	4
MapServermapthread.c	7
MapServermapows.c	29
MapServermaphash.c	10
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/ogr/ogrfeature.cpp	57
gdal/ogr/ogr_feature.h	15
gdal/ogr/ogr_api.cpp	26
gdal/ogr/ogrgeometry.cpp	99
gdal/gcore/gdalalgorithm.h	6
gdal/ogr/ogrfielddefn.cpp	9
gdal/ogr/ograpispy.cpp	56
gdal/ogr/ogrutils.cpp	16
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	6
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	44
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	5
gdal/gcore/gdaldataset.cpp	28
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	25
gdal/port/cpl_findfile.cpp	11
MapServerrenderers/agg/include/pixman-combine-float-extract.h	2
gdal/ogr/ogrsf_frmts/osm/osm_parser.cpp	4
gdal/port/cplstringlist.cpp	4
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	8
MapServermapogcsos.c	29
gdal/ogr/ogrsf_frmts/mvt/mvtutils.cpp	5
gdal/port/cpl_json.cpp	30
gdal/ogr/ogrsf_frmts/geojson/libjson/json_object.c	60
gdal/ogr/ogrsf_frmts/geojson/libjson/json_util.c	7
MapServerthird-party/pantor/inja.hpp	8
gdal/port/cpl_vsil_webhdfs.cpp	38
gdal/port/cpl_vsil_curl.cpp	15
gdal/port/cpl_http.cpp	85
gdal/port/cpl_google_cloud.cpp	2
gdal/port/cpl_vsil_curl_class.h	1
gdal/ogr/ogrsf_frmts/geojson/libjson/linkhash.c	12
gdal/ogr/ogrsf_frmts/geojson/libjson/printbuf.c	3
gdal/ogr/ogrsf_frmts/geojson/libjson/arraylist.c	4
gdal/ogr/ogrsf_frmts/geojson/libjson/json_tokener.c	47
gdal/port/cpl_vsi_error.cpp	11
gdal/apps/ogr2ogr_lib.cpp	410
gdal/apps/argparse/argparse.hpp	55
gdal/apps/commonutils.cpp	5
MapServerrenderers/aggclipper.cpp	7
gdal/apps/gdalargumentparser.cpp	33
gdal/apps/gdaltindex_lib.cpp	15
gdal/ogr/ogrsf_frmts/libkml/ogrlibkmldatasource.cpp	51
MapServermapproject.c	104
gdal/ogr/ogrsf_frmts/libkml/ogrlibkmlstyle.cpp	116
gdal/ogr/ogrfeaturestyle.cpp	15
MapServermapobject.c	26
MapServermapresample.c	64
MapServermapgeos.c	84
gdal/ogr/ogrsf_frmts/libkml/ogrlibkmllayer.cpp	63
gdal/ogr/ogrfeaturedefn.cpp	9
gdal/ogr/ogrspatialreference.cpp	153
gdal/ogr/ogrsf_frmts/libkml/ogrlibkmlfield.cpp	11
gdal/ogr/ogr_spatialref.h	1
gdal/frmts/netcdf/netcdfwriterconfig.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogr_pg.h	1
MapServermapowscommon.c	10
gdal/gcore/gdalrasterband.cpp	5
MapServerrenderers/agg/include/agg_array.h	3
MapServermapscript/v8/line.cpp	23
MapServermapprimitive.c	31
MapServermappostgis.cpp	86
gdal/ogr/ogr_proj_p.cpp	18
gdal/ogr/ogrcurvepolygon.cpp	17
gdal/ogr/ogrcurve.cpp	18
gdal/ogr/ogrgeometryfactory.cpp	228
gdal/ogr/ogrpolygon.cpp	21
MapServerflatgeobuf/include/flatbuffers/vector_downward.h	13
gdal/ogr/ogrgeometrycollection.cpp	76
gdal/frmts/idrisi/IdrisiDataset.cpp	1
gdal/apps/gdal_grid_lib.cpp	16
MapServermapwfs.cpp	31
gdal/ogr/ogr_schema_override.cpp	1
gdal/ogr/ogr_geometry.h	2
gdal/ogr/ogrlinestring.cpp	31
gdal/ogr/ogrpoint.cpp	10
gdal/ogr/ogrcurvecollection.cpp	7
gdal/ogr/ogrsurface.cpp	3
gdal/ogr/ogrcircularstring.cpp	5
gdal/ogr/ogrsf_frmts/dwg/ogrdgnv8layer.cpp	37
gdal/ogr/ogrtriangle.cpp	2
gdal/ogr/ogrtriangulatedsurface.cpp	5
gdal/ogr/ogrmultipolygon.cpp	2
gdal/ogr/ogrmultilinestring.cpp	2
gdal/ogr/ogrmultisurface.cpp	3
gdal/ogr/ogrpolyhedralsurface.cpp	2
gdal/port/cpl_error.h	1
gdal/ogr/ogrmulticurve.cpp	3
gdal/gcore/gdaldriver.cpp	26
gdal/port/cplstring.cpp	10
gdal/ogr/ogrsf_frmts/generic/ogrsfdriverregistrar.cpp	5
gdal/port/cpl_recode.cpp	3
gdal/port/cpl_recode_stub.cpp	20
gdal/port/cpl_character_sets.c	1
gdal/port/cpl_recode_iconv.cpp	12
gdal/gcore/gdal_misc.cpp	4
gdal/ogr/ogrsf_frmts/pmtiles/ogrpmtilesdriver.cpp	5
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	12
gdal/ogr/ogrsf_frmts/ngw/ogrngwdriver.cpp	39
gdal/ogr/ogrsf_frmts/ngw/ngw_api.cpp	25
gdal/ogr/ogrsf_frmts/openfilegdb/ogropenfilegdbdatasource.cpp	27
gdal/ogr/ogrsf_frmts/gpkg/ogr_geopackage.h	1
gdal/ogr/ogrsf_frmts/sqlite/ogrsqlitedatasource.cpp	1
MapServermapbits.c	1
MapServermapimagemap.c	17
MapServermapoutput.c	26
gdal/apps/gnmanalyse.cpp	7
gdal/ogr/ogr_wkb.cpp	27
gdal/ogr/ogrgeomfielddefn.cpp	4
gdal/ogr/ogrgeomcoordinateprecision.cpp	6
gdal/ogr/gml2ogrgeometry.cpp	1
gdal/ogr/ogr_srsnode.cpp	8
MapServerflatgeobuf/include/flatbuffers/code_generators.h	2
MapServermaporaclespatial.c	7
gdal/autotest/cpp/test_ogr_wkb.cpp	1
gdal/ogr/ogrsf_frmts/generic/ogr_gensql.cpp	2
gdal/ogr/ogrsf_frmts/generic/ogrlayerarrow.h	3
MapServerflatgeobuf/include/flatbuffers/reflection_generated.h	19
gdal/gcore/gdaljp2structure.cpp	6
gdal/ogr/ogrfeaturequery.cpp	12
gdal/alg/internal_libqhull/qset_r.c	28
gdal/alg/internal_qhull_headers.h	3
gdal/alg/internal_libqhull/user_r.c	29
gdal/alg/internal_libqhull/usermem_r.c	7
gdal/alg/internal_libqhull/io_r.c	135
gdal/alg/internal_libqhull/geom2_r.c	46
gdal/alg/internal_libqhull/mem_r.c	7
gdal/alg/internal_libqhull/libqhull_r.c	11
gdal/alg/internal_libqhull/geom_r.c	21
gdal/alg/internal_libqhull/poly2_r.c	85
gdal/ogr/ogrsf_frmts/gpkg/ogrgeopackagetablelayer.cpp	7
gdal/ogr/ogrsf_frmts/sqlite/ogrsqliteutility.cpp	9
gdal/alg/internal_libqhull/global_r.c	7
gdal/alg/internal_libqhull/merge_r.c	19
gdal/alg/internal_libqhull/poly_r.c	34
gdal/alg/internal_libqhull/stat_r.c	16
gdal/ogr/ogrsf_frmts/generic/ogrlayerarrow.cpp	3
gdal/ogr/ogrsf_frmts/generic/ogrlayer.cpp	9
gdal/ogr/ogrsf_frmts/wfs/ogrwfslayer.cpp	17
gdal/frmts/mem/memmultidim.h	2
gdal/ogr/ogr_core.h	14
MapServermapcontext.c	7
MapServerrenderers/aggagg_bezier_arc.cpp	5
MapServermapogcfilter.cpp	2
MapServermaplayer.c	105
MapServermapcluster.c	12
MapServermapcopy.c	51
MapServermapshape.c	37
MapServermapogr.cpp	48
MapServermapflatgeobuf.c	1
MapServermaprasterquery.c	64
MapServermapwfslayer.c	1
MapServermapgraticule.c	1
MapServermappluginlayer.c	18
MapServermapcpl.c	5
MapServermapunion.cpp	2
MapServermapuvraster.cpp	1
MapServermapcontour.c	1
MapServermapxbase.c	21
MapServermaptree.c	2
MapServermapwfs20.c	17
MapServermapwfs11.cpp	17
MapServermapsearch.c	13
MapServermapquery.c	49
MapServermapscale.c	3
MapServermapraster.c	77
MapServerstrptime.c	9
MapServermappool.c	14
gdal/frmts/mrf/BitMask2D.h	5
MapServermapcrypto.c	19
MapServermapgdal.cpp	6
MapServermapsymbol.c	24
MapServermapparser.c	70
MapServermapgraph.cpp	15
MapServermapsmoothing.c	16
MapServermapv8.cpp	71
gdal/frmts/wcs/wcsdataset.cpp	42
gdal/port/cpl_minixml.h	2
gdal/frmts/wcs/wcsdataset110.cpp	21
gdal/frmts/tiledb/tiledbdense.cpp	51
gdal/frmts/tiledb/tiledbmultidim.h	3
MapServerrenderers/agg/include/agg_renderer_outline_aa.h	1
MapServermapscript/v8/shape.cpp	15
gdal/ogr/ogrsf_frmts/cad/libopencad/cadheader.cpp	2
MapServer/tests/unit/test.cpp	3
MapServerflatgeobuf/include/flatbuffers/array.h	4
gdal/ogr/ogrsf_frmts/geojson/ogrgeojsonutils.cpp	11
gdal/gcore/gdalopeninfo.cpp	1
MapServermapgeomtransform.c	10
MapServermaphttp.c	41
MapServermapscript/v8/v8_mapscript.h	5
MapServermapscript/v8/point.cpp	12
MapServerinterpolation.c	35
MapServerkerneldensity.c	7
MapServeridw.c	4
MapServermapdrawgdal.c	103
MapServermapdraw.c	5
MapServermapagg.cpp	4
MapServermapcairo.c	7
MapServermapogl.cpp	1
MapServermapkml.cpp	1
gdal/port/cpl_userfaultfd.cpp	4
MapServermapjoin.c	9
MapServermappostgresql.c	4
MapServermaplabel.c	5
gdal/port/cpl_time.cpp	6
gdal/ogr/ogrsf_frmts/ili/ili2reader.cpp	11
MapServerflatgeobuf/feature_generated.h	5
gdal/ogr/ogrsf_frmts/pgeo/ogrpgeodatasource.cpp	13
gdal/gcore/gdalrelationship.cpp	3
gdal/port/cpl_port.h	2
gdal/ogr/ogrsf_frmts/openfilegdb/ogropenfilegdbdatasource_write.cpp	65
gdal/ogr/ogrsf_frmts/arrow_common/vsiarrowfilesystem.hpp	1
gdal/ogr/ogrsf_frmts/openfilegdb/filegdbtable.cpp	132
gdal/ogr/ogrsf_frmts/openfilegdb/filegdbtable_write.cpp	117
gdal/ogr/ogrsf_frmts/openfilegdb/filegdbindex_write.cpp	93
gdal/frmts/grib/gribcreatecopy.cpp	7
gdal/ogr/ogrsf_frmts/openfilegdb/filegdbtable.h	3
gdal/ogr/ogrsf_frmts/osm/gpb.h	1
gdal/ogr/ogrpgeogeometry.cpp	94
gdal/frmts/zlib/inflate.c	25
gdal/frmts/zlib/crc32.c	8
gdal/frmts/zlib/adler32.c	4
gdal/frmts/zlib/infback.c	1
gdal/ogr/ogrlinearring.cpp	3
gdal/ogr/ogrsf_frmts/openfilegdb/filegdbtable_write_fields.cpp	15
gdal/ogr/ogrsf_frmts/sqlite/ogrsqlitevfs.cpp	1
gdal/ogr/ogrsf_frmts/openfilegdb/filegdbtable_freelist.cpp	3
gdal/ogr/ogrsf_frmts/shape/shp_vsi.c	1
gdal/ogr/ogrsf_frmts/openfilegdb/ogropenfilegdblayer_write.cpp	19
gdal/ogr/ogrsf_frmts/openfilegdb/ogropenfilegdblayer.cpp	88
gdal/frmts/sigdem/sigdemdataset.cpp	6
gdal/ogr/ogr_fromepsg.cpp	12
gdal/port/cpl_quad_tree.cpp	5
MapServerrenderers/aggagg_svg_path_tokenizer.cpp	7
MapServerrenderers/agg/include/agg_svg_path_tokenizer.h	1
gdal/ogr/ogrsf_frmts/openfilegdb/filegdb_relationship.h	20
MapServermapmssql2008.c	34
gdal/ogr/ogrsf_frmts/dwg/ogrdgnv8datasource.cpp	9
gdal/port/cpl_vsil_gs.cpp	1

Fuzzer: mapfuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1627	77.6%
gold	[1:9]	46	2.19%
yellow	[10:29]	4	0.19%
greenyellow	[30:49]	2	0.09%
lawngreen	50+	417	19.8%
All colors	2096	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
219	1	LLVMFuzzerTestOneInput	call site: 00001	VSIFfopenHelper
146	363	CPLTestBool	call site: 00363	VSICTime
119	1968	VSIUnlink	call site: 01968	WSIOCILobFSHandle::GetConnection
111	1137	CPLParseXMLString	call site: 01137	OGRPGTableLayer::SetMetadataItem
81	894	CPLStrtodDelim	call site: 00894	OGRFeatureFormatDateTimeBuffer
81	1006	CPLParseXMLString	call site: 01006	ReadToken
54	1317	VSIFTellL	call site: 01317	CPLError
48	583	CPLSPrintf	call site: 00583	OGRFeature::IsFieldSetAndNotNull
45	1810	msJoinClose	call site: 01810	msDBFClose
43	1386	VSIGetDirectorySeparator	call site: 01386	CPLLoadConfigOptionsFromFile
42	636	OGR_GT_IsCurve	call site: 00636	OGR_Fld_GetSubType
39	1088	VSIStrdup	call site: 01088	ReadToken

Runtime coverage analysis

Covered functions

3122

Functions that are reachable but not covered

244

Reachable functions

335

Percentage of reachable functions covered

27.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
MapServer/fuzzers/mapfuzzer.c	9
gdal/port/vsipreload.cpp	21
MapServerthird-party/nlohmann/json.hpp	58
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/port/cpl_vsil.cpp	52
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsi_mem.cpp	2
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	24
gdal/port/cpl_conv.cpp	38
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	24
gdal/ogr/ogrct.cpp	2
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	2
gdal/gcore/gdalalgorithm.h	2
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
MapServermaputil.c	17
MapServermapio.c	21
MapServermaperror.c	20
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	50
MapServermapthread.c	6
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	30
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	10
gdal/port/cpl_findfile.cpp	11
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	7
MapServermapows.c	5
MapServermaphash.c	9
MapServermapobject.c	20
MapServermapproject.c	9
MapServermaplabel.c	5
MapServermapprimitive.c	4
MapServermapgeos.c	3
MapServermapsymbol.c	8
MapServermaplayer.c	13
MapServermapjoin.c	9
MapServermapxbase.c	8
MapServermappostgresql.c	4
MapServermapimagemap.c	1
MapServermapoutput.c	7
gdal/port/cpl_userfaultfd.cpp	4
MapServermapquery.c	3
MapServermapv8.cpp	8
MapServermapscript/v8/shape.cpp	2
MapServermapscript/v8/point.cpp	2
MapServermapscript/v8/line.cpp	2
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
MapServerrenderers/aggclipper.cpp	6
MapServerrenderers/agg/include/agg_array.h	3
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	2

Fuzzer: gdal/fuzzers/osr_set_from_user_input_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	89.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	10.5%
All colors	19	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	1	LLVMFuzzerTestOneInput	call site: 00001

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

14

Reachable functions

15

Percentage of reachable functions covered

6.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/osr_set_from_user_input_fuzzer.cpp	11
gdal/ogr/ogrspatialreference.cpp	2

Fuzzer: gdal/fuzzers/gdal_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2292	89.7%
gold	[1:9]	47	1.84%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.07%
lawngreen	50+	212	8.30%
All colors	2553	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
350	1923	CPLReadLineL	call site: 01923	json_tokener_parse_ex
349	167	CPLsnprintf	call site: 00167	CPLvsnprintf
160	1762	CPLIsDebugEnabled	call site: 01762	CPLReadLineL
120	2432	VSIUnlink	call site: 02432	WSIOCILobFSHandle::GetConnection
118	2312	VSIFileFromMemBuffer	call site: 02312	OGRSFDriverRegistrar::GetDriver
111	1144	CPLParseXMLString	call site: 01144	OGRPGTableLayer::SetMetadataItem
81	901	CPLStrtodDelim	call site: 00901	OGRFeatureFormatDateTimeBuffer
81	1013	CPLParseXMLString	call site: 01013	ReadToken
56	1657	VSIMkdirRecursive	call site: 01657	cpl::VSIWebHDFSFSHandler::Mkdir
54	1324	VSIFTellL	call site: 01324	CPLError
48	590	CPLSPrintf	call site: 00590	OGRFeature::IsFieldSetAndNotNull
43	1393	VSIGetDirectorySeparator	call site: 01393	CPLLoadConfigOptionsFromFile

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

371

Reachable functions

443

Percentage of reachable functions covered

16.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/gdal_fuzzer.cpp	55
gdal/port/cpl_vsil.cpp	68
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsi_mem.cpp	30
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/port/cpl_string.cpp	34
gdal/port/cpl_conv.cpp	41
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_error.cpp	44
gdal/port/cpl_vsisimple.cpp	24
gdal/ogr/ogrct.cpp	2
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	63
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	2
gdal/gcore/gdalalgorithm.h	3
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
MapServermaputil.c	6
MapServermapio.c	21
MapServermaperror.c	16
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	6
MapServermapthread.c	6
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	30
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	18
gdal/port/cpl_findfile.cpp	11
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermapows.c	5
MapServermaphash.c	8
MapServerrenderers/agg/include/pixman-combine-float-extract.h	1
gdal/ogr/ogrsf_frmts/osm/osm_parser.cpp	4
gdal/port/cplstringlist.cpp	2
gdal/ogr/ogrsf_frmts/parquet/ogrparquetlayer.cpp	7
MapServermapogcsos.c	1
gdal/ogr/ogrsf_frmts/mvt/mvtutils.cpp	5
gdal/port/cpl_json.cpp	14
gdal/ogr/ogrsf_frmts/geojson/libjson/json_object.c	52
gdal/ogr/ogrsf_frmts/geojson/libjson/json_util.c	7
MapServerthird-party/pantor/inja.hpp	1
gdal/port/cpl_vsil_webhdfs.cpp	38
gdal/port/cpl_vsil_curl.cpp	15
gdal/port/cpl_http.cpp	41
gdal/port/cpl_google_cloud.cpp	2
gdal/port/cpl_vsil_curl_class.h	1
gdal/ogr/ogrsf_frmts/geojson/libjson/linkhash.c	11
gdal/ogr/ogrsf_frmts/geojson/libjson/printbuf.c	3
gdal/ogr/ogrsf_frmts/geojson/libjson/arraylist.c	4
gdal/ogr/ogrsf_frmts/geojson/libjson/json_tokener.c	47
gdal/port/cpl_vsi_error.cpp	11
gdal/ogr/ogrsf_frmts/generic/ogrsfdriverregistrar.cpp	3
gdal/frmts/mem/memmultidim.h	1
gdal/frmts/zarr/zarrdriver.cpp	9
gdal/frmts/georaster/cpl_vsil_ocilob.cpp	17
gdal/frmts/georaster/oci_wrapper.cpp	30
MapServerrenderers/aggclipper.cpp	6
MapServerrenderers/agg/include/agg_array.h	3
gdal/ogr/ogrsf_frmts/hana/ogrhanadatasource.cpp	2

Fuzzer: gdal/fuzzers/wkt_import_fuzzer.cpp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1565	87.5%
gold	[1:9]	48	2.68%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	175	9.78%
All colors	1788	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
172	413	CPLsnprintf	call site: 00413	CPLGetProcessMemorySize
151	723	OGR_GT_IsCurve	call site: 00723	OGR_Fld_GetSubType
118	1663	CPLError	call site: 01663	OGRGeometryCollection::getLinearGeometry
111	1232	CPLParseXMLString	call site: 01232	OGRPGTableLayer::SetMetadataItem
81	952	CPLStrtodDelim	call site: 00952	OGRFeatureFormatDateTimeBuffer
81	1065	CPLParseXMLString	call site: 01065	ReadToken
66	156	msIO_vfprintf	call site: 00156	getVSILFILE
54	1412	VSIFTellL	call site: 01412	CPLError
47	273	msSmallRealloc	call site: 00273	OGRGeometryCollection::importFromWkt
39	645	VSIInstallCachedFileHandler	call site: 00645	OGRPGTableLayer::SetMetadataItem
38	232	msIO_fprintf	call site: 00232	msGEOSShape2Geometry_simplepolygon
36	1481	VSIGetDirectorySeparator	call site: 01481	CPLLoadConfigOptionsFromFile

Runtime coverage analysis

Covered functions

3168

Functions that are reachable but not covered

14

Reachable functions

17

Percentage of reachable functions covered

17.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
gdal/fuzzers/wkt_import_fuzzer.cpp	7
gdal/ogr/ogrgeometryfactory.cpp	32
gdal/ogr/ogrpolygon.cpp	4
MapServermapscript/v8/line.cpp	12
MapServermapgeos.c	23
gdal/frmts/openjpeg/opjdatasetbase.h	5
MapServermapregex.c	2
MapServermapprimitive.c	4
MapServermaputil.c	7
MapServermapio.c	21
MapServermaperror.c	16
MapServermapdebug.c	10
MapServermaptime.c	1
MapServermapstring.cpp	6
MapServermapfile.c	6
MapServermapthread.c	6
gdal/port/vsipreload.cpp	19
MapServerthird-party/nlohmann/json.hpp	59
gdal/port/cpl_vsil.cpp	51
MapServermappostgis.cpp	2
gdal/ogr/ogr_proj_p.cpp	1
MapServerflatgeobuf/include/flatbuffers/vector_downward.h	2
gdal/ogr/ogrgeometrycollection.cpp	33
gdal/port/cpl_error.cpp	44
gdal/port/cpl_multiproc.cpp	2
gdal/port/cpl_vsisimple.cpp	24
gdal/port/cpl_string.cpp	24
gdal/ogr/ogrct.cpp	2
gdal/port/cpl_conv.cpp	38
gdal/ogr/ogrsf_frmts/cad/libopencad/dwg/r2000.cpp	1
gdal/port/cpl_string.h	7
gdal/frmts/tiledb/tiledbheaders.h	2
gdal/port/cpl_vsil_win32.cpp	2
gdal/port/cpl_vsil_subfile.cpp	2
gdal/port/cpl_vsi_mem.cpp	2
gdal/port/cpl_vsil_gzip.cpp	3
gdal/port/cpl_vsil_stdin.cpp	2
gdal/port/cpl_vsil_hdfs.cpp	2
gdal/port/cpl_vsil_stdout.cpp	3
gdal/port/cpl_vsil_sparsefile.cpp	2
gdal/port/cpl_vsil_tar.cpp	2
gdal/port/cpl_vsil_cache.cpp	2
gdal/port/cpl_vsil_crypt.cpp	8
gdal/frmts/gtiff/gtiffrasterband_write.cpp	1
gdal/ogr/ogrsf_frmts/pg/ogrpgtablelayer.cpp	32
gdal/ogr/ogrfeature.cpp	38
gdal/ogr/ogr_feature.h	6
gdal/ogr/ogr_api.cpp	12
gdal/ogr/ogrgeometry.cpp	8
gdal/gcore/gdalalgorithm.h	2
gdal/ogr/ogrfielddefn.cpp	2
gdal/ogr/ograpispy.cpp	18
MapServerflatgeobuf/include/flatbuffers/detached_buffer.h	2
gdal/ogr/ogrutils.cpp	11
gdal/port/cpl_strtod.cpp	11
gdal/port/cpl_float.h	4
gdal/third_party/fast_float/parse_number.h	15
gdal/third_party/fast_float/float_common.h	1
gdal/gcore/gdalsse_priv.h	1
gdal/gcore/sse2neon.h	3
gdal/frmts/pcidsk/sdk/core/pcidskexception.cpp	6
gdal/frmts/pcidsk/sdk/core/pcidskbuffer.cpp	2
gdal/port/cpl_minixml.cpp	30
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.cpp	8
gdal/ogr/ogrsf_frmts/pg/ogrpgutility.h	1
gdal/ogr/ogrsf_frmts/wfs/ogrwfsdatasource.cpp	3
gdal/gcore/gdaldataset.cpp	21
gdal/gcore/gdalmajorobject.cpp	1
gdal/gcore/gdaldrivermanager.cpp	8
gdal/frmts/fits/fitsdataset.cpp	9
gdal/ogr/ogrsf_frmts/avc/avc_rawbin.cpp	4
gdal/port/cpl_path.cpp	10
gdal/port/cpl_findfile.cpp	11
gdal/ogr/ogrsf_frmts/parquet/ogrparquetwriterlayer.cpp	11
MapServerflatgeobuf/header_generated.h	1
MapServermaprasterlabel.cpp	5
MapServermapows.c	5
MapServermaphash.c	8
MapServerrenderers/agg/include/pixman-combine-float-extract.h	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

887 / 40676

Cyclomatic complexity statically reachable by fuzzers

7185 / 237447

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

MapServer/fuzzers/configfuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['msDebug', 'VSIStrdup', 'LLVMFuzzerTestOneInput', 'CPLsnprintf', 'VSIUnlink', 'CPLSPrintf', 'VSIGetDirectorySeparator', 'CSLAddStringMayFail', 'CPLRealloc', 'VSIInstallZipFileHandler']

gdal/fuzzers/gml_geom_import_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['msSmallMalloc', 'OGR_GT_SetM', 'CPLError', 'msFreeShape', 'CPLsnprintf', 'CPLParseXMLString', 'msIO_fprintf', 'CPLStrtodDelim', 'VSIFTellL']

MapServer/fuzzers/shapefuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['msDebug', 'VSIMkdirRecursive', 'VSICalloc', 'VSIUnlink', 'VSIFCloseL', 'VSIFileFromMemBuffer', 'VSIFTellL', 'VSIFReadL', 'VSIStatExL', 'VSIInstallCachedFileHandler']

gdal/fuzzers/get_jpeg2000_structure_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['CPLReadLineL', 'CPLsnprintf', 'CPLIsDebugEnabled', 'CPLParseXMLString', 'VSIUnlink', 'msIO_fprintf', 'CPLStrtodDelim', 'initLegend', 'VSIMkdirRecursive']

gdal/fuzzers/gdal_translate_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['msAddImageSymbol', 'VSIUnlink', 'CPLAtoGIntBig', 'VSIIngestFile', 'initLegend', 'VSIFileFromMemBuffer', 'InvGeoTransform', 'CPLReadLineL', 'CPLParseXMLFile', 'CPLsnprintf']

gdal/fuzzers/filename_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['CPLReadLineL', 'CPLsnprintf', 'CPLIsDebugEnabled', 'VSIUnlink', 'VSIFOpenEx2L', 'CPLParseXMLString', 'CPLStrtodDelim', 'VSIFTellL', 'VSIMkdirRecursive']

gdal/fuzzers/spatialite_geom_import_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

gdal/fuzzers/ogr_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['CPLReadLineL', 'CPLsnprintf', 'CPLIsDebugEnabled', 'VSIUnlink', 'CPLParseXMLString', 'CPLStrtodDelim', 'initLegend', 'VSIMkdirRecursive', 'VSIFTellL']

gdal/fuzzers/gdal_algorithm_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['CPLReadLineL', 'CPLsnprintf', 'CPLIsDebugEnabled', 'VSIFOpenEx2L', 'CPLParseXMLString', 'CPLStrtodDelim', 'VSIFileFromMemBuffer', 'VSIMkdirRecursive', 'VSIFTellL']

gdal/fuzzers/gdal_vector_translate_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['CSLAddNameValue', 'initLegend', 'CPLAtoGIntBig', 'OGR_GT_SetM', 'OGR_G_GetPoints', 'msFreeMap', 'msInitQuery', 'msGetPath', 'msMapComputeGeotransform']

MapServer/fuzzers/mapfuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'CPLTestBool', 'VSIUnlink', 'CPLParseXMLString', 'CPLStrtodDelim', 'VSIFTellL', 'CPLSPrintf', 'msJoinClose', 'VSIGetDirectorySeparator']

gdal/fuzzers/osr_set_from_user_input_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

gdal/fuzzers/gdal_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['CPLReadLineL', 'CPLsnprintf', 'CPLIsDebugEnabled', 'VSIUnlink', 'VSIFileFromMemBuffer', 'CPLParseXMLString', 'CPLStrtodDelim', 'VSIMkdirRecursive', 'VSIFTellL']

gdal/fuzzers/wkt_import_fuzzer.cpp

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['CPLsnprintf', 'OGR_GT_IsCurve', 'CPLError', 'CPLParseXMLString', 'CPLStrtodDelim', 'msIO_vfprintf', 'VSIFTellL', 'msSmallRealloc', 'VSIInstallCachedFileHandler']