High level conclusions

Fuzzers reach 51.59% code coverage.

Fuzzers reach 38.79% of cyclomatic complexity.

Fuzzers reach 37.29% of all functions.

Fuzzer json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc is blocked:

The runtime code coverage of json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc covers 0.909% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_alg_memmem is blocked:

The runtime code coverage of fuzz_alg_memmem covers 28.57% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_binaryfusefilter is blocked:

The runtime code coverage of fuzz_binaryfusefilter covers 21.42% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_gcrypt_cipher is blocked:

The runtime code coverage of fuzz_gcrypt_cipher covers 18.75% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1497 / 4014

Cyclomatic complexity statically reachable by fuzzers

7150 / 18430

Runtime code coverage of functions

2071 / 4014

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_ds_patricia

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	24.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.36%
greenyellow	[30:49]	1	0.36%
lawngreen	50+	206	74.6%
All colors	276	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	221	ndpi_patricia_search_best2	call site: 00221	fprintf
9	154	ndpi_patricia_search_exact	call site: 00154	fprintf
6	52	ndpi_patricia_lookup	call site: 00052	fprintf
6	65	ndpi_patricia_lookup	call site: 00065	fprintf
4	30	LLVMFuzzerTestOneInput	call site: 00030	fprintf
3	47	ndpi_patricia_lookup	call site: 00047	fprintf
2	60	ndpi_patricia_lookup	call site: 00060	fprintf
2	72	ndpi_patricia_lookup	call site: 00072	fprintf
2	81	ndpi_patricia_lookup	call site: 00081	fprintf
2	85	ndpi_patricia_lookup	call site: 00085	fprintf
2	96	ndpi_patricia_lookup	call site: 00096	fprintf
2	169	ndpi_patricia_search_exact	call site: 00169	fprintf

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

23

Reachable functions

60

Percentage of reachable functions covered

61.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_patricia.cpp	28
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partyndpi_patricia.c	25
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_main.c	2

Fuzzer: fuzz_alg_bins

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	14.5%
gold	[1:9]	4	2.91%
yellow	[10:29]	1	0.72%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	112	81.7%
All colors	137	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	125	ndpi_cluster_bins	call site: 00125	printf
3	27	ndpi_bin_similarity	call site: 00027	ndpi_get_bin_value
3	121	ndpi_cluster_bins	call site: 00121	ndpi_print_bin
2	112	ndpi_cluster_bins	call site: 00112	ndpi_print_bin
2	115	ndpi_cluster_bins	call site: 00115	printf
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	ndpi_init_bin	call site: 00012
1	40	ndpi_clone_bin	call site: 00040
1	76	ndpi_snprintf	call site: 00076
1	105	ndpi_cluster_bins	call site: 00105	printf

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

23

Reachable functions

45

Percentage of reachable functions covered

48.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_bins.cpp	21
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	20
ndpilib/ndpi_utils.c	5

Fuzzer: fuzz_alg_shoco

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	23	100.%
All colors	23	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

5

Reachable functions

13

Percentage of reachable functions covered

61.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_shoco.cpp	9
ndpilib/third_partyshoco.c	9
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_alg_crc32_md5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	1.55%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.77%
lawngreen	50+	126	97.6%
All colors	129	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	108	LLVMFuzzerTestOneInput	call site: 00108
1	118	LLVMFuzzerTestOneInput	call site: 00118

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

14

Reachable functions

42

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_crc32_md5.c	25
ndpilib/ndpi_analyze.c	3
ndpilib/ndpi_main.c	3
ndpilib/third_partyndpi_md5.c	6
ndpilib/ndpi_hash.c	3
ndpilib/third_partyhll/MurmurHash3.c	1
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_community_id

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	6.87%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.25%
lawngreen	50+	147	91.8%
All colors	160	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	130	ndpi_base64_encode	call site: 00130	printf
1	13	LLVMFuzzerTestOneInput	call site: 00013
1	120	SHA1Transform	call site: 00120	SHA1Transform
1	140	ndpi_community_id_finalize_and_compute_hash	call site: 00140

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

27

Reachable functions

49

Percentage of reachable functions covered

44.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_community_id.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_community_id.c	20
ndpilib/third_partyndpi_sha1.c	10
ndpilib/ndpi_utils.c	1

Fuzzer: fuzz_ds_ptree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	29.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.53%
lawngreen	50+	131	70.0%
All colors	187	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	69	ndpi_patricia_search_best2	call site: 00069	fprintf
6	110	ndpi_patricia_lookup	call site: 00110	fprintf
6	123	ndpi_patricia_lookup	call site: 00123	fprintf
4	64	ndpi_patricia_search_best2	call site: 00064	fprintf
2	21	ndpi_DeleteEntry	call site: 00021
2	88	ndpi_patricia_search_best2	call site: 00088	fprintf
2	91	ndpi_ptree_insert	call site: 00091	fprintf
2	103	ndpi_New_Prefix2	call site: 00103	ndpi_calloc
2	106	ndpi_patricia_lookup	call site: 00106	fprintf
2	118	ndpi_patricia_lookup	call site: 00118	fprintf
2	130	ndpi_patricia_lookup	call site: 00130	fprintf
2	139	ndpi_patricia_lookup	call site: 00139	fprintf

Runtime coverage analysis

Covered functions

37

Functions that are reachable but not covered

35

Reachable functions

69

Percentage of reachable functions covered

49.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_ptree.cpp	16
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_main.c	24
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	5

Fuzzer: fuzz_filecfg_risk_domains

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	82	6.06%
gold	[1:9]	13	0.96%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1255	92.8%
All colors	1351	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
13	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
6	90	ndpi_exit_detection_module	call site: 00090	ndpi_hash_free
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1238	init_string_based_protocols	call site: 01238	NDPI_LOG_ERR
3	1271	ndpi_set_config	call site: 01271
2	86	ac_automata_release	call site: 00086	acho_free
2	106	ndpi_exit_detection_module	call site: 00106	ndpi_free
2	169	ndpi_realloc	call site: 00169	ndpi_free

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

62

Reachable functions

131

Percentage of reachable functions covered

52.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_risk_domains.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	67
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	12
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	33
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4

Fuzzer: fuzz_tls_certificate

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	554	18.4%
gold	[1:9]	1975	65.9%
yellow	[10:29]	47	1.56%
greenyellow	[30:49]	7	0.23%
lawngreen	50+	413	13.7%
All colors	2996	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	2592	processCertificateElements	call site: 02592	strptime
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
27	2831	ndpi_lru_add_to_cache	call site: 02831	ndpi_set_risk
26	2969	ndpi_free_flow_data	call site: 02969	ndpi_free
25	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
25	1303	ndpi_load_categories_dir	call site: 01303	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
16	2935	ndpi_free_flow_data	call site: 02935	ndpi_free
15	2761	ndpi_patricia_search_best2	call site: 02761	fprintf
10	2675	processCertificateElements	call site: 02675	ndpi_set_risk
10	2817	ndpi_handle_risk_exceptions	call site: 02817	ndpi_check_ipv6_exception
9	1575	node_resize_mp	call site: 01575	node_resize_mp

Runtime coverage analysis

Covered functions

459

Functions that are reachable but not covered

151

Reachable functions

590

Percentage of reachable functions covered

74.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_tls_certificate.c	7
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	439
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	47
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	9
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	35
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/third_partystrptime.c	7

Fuzzer: fuzz_ds_cmsketch

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	18.7%
gold	[1:9]	1	3.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	78.1%
All colors	32	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	15	ndpi_cm_sketch_init	call site: 00015	printf
1	11	ndpi_cm_sketch_init	call site: 00011
1	18	ndpi_cm_sketch_init	call site: 00018
1	21	ndpi_cm_sketch_add	call site: 00021	printf
1	25	ndpi_cm_sketch_count	call site: 00025	printf

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

12

Reachable functions

26

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_cmsketch.cpp	9
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_analyze.c	7
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_filecfg_malicious_ja4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	79	6.06%
gold	[1:9]	13	0.99%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1210	92.8%
All colors	1303	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
13	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	80	node_release	call site: 00080	acho_free
4	1238	init_string_based_protocols	call site: 01238	NDPI_LOG_ERR
3	75	ac_automata_walk	call site: 00075
3	86	ac_automata_release	call site: 00086	ac_automata_release
3	1271	ndpi_set_config	call site: 01271
2	94	ndpi_hash_free	call site: 00094	ndpi_hash_free

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

56

Reachable functions

106

Percentage of reachable functions covered

47.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_malicious_ja4.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	61
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	16
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	12
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_ds_ahocorasick

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	9.13%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	169	90.8%
All colors	186	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	53	xmemchr	call site: 00053	DETECTNULL
2	181	ac_automata_release	call site: 00181	acho_free
1	10	ac_automata_init	call site: 00010
1	14	ac_automata_init	call site: 00014
1	38	ndpi_strdup	call site: 00038
1	58	xmemchr	call site: 00058
1	89	node_resize_mp	call site: 00089
1	96	LLVMFuzzerTestOneInput	call site: 00096
1	112	ac_automata_walk	call site: 00112
1	124	LLVMFuzzerTestOneInput	call site: 00124	printf
1	129	node_findbs_next	call site: 00129	node_findbs_next
1	131	ac_automata_search	call site: 00131	printf

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

32

Reachable functions

81

Percentage of reachable functions covered

60.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_ahocorasick.cpp	31
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partyahocorasick.c	40
ndpilib/ndpi_main.c	12
ndpilib/ndpi_memory.c	3
ndpi/tests/performance/gcrypt.c	2

Fuzzer: fuzz_filecfg_categories

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	120	8.39%
gold	[1:9]	15	1.04%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1294	90.4%
All colors	1430	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
13	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
6	1330	ndpi_patricia_lookup	call site: 01330	fprintf
6	1343	ndpi_patricia_lookup	call site: 01343	fprintf
5	1383	ndpi_encode_domain	call site: 01383	ndpi_hash_find_entry
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	80	node_release	call site: 00080	acho_free
4	1238	init_string_based_protocols	call site: 01238	NDPI_LOG_ERR
4	1309	add_to_ptree	call site: 01309	fprintf
4	1423	ndpi_hash_add_entry	call site: 01423	ndpi_hash_add_entry
3	75	ac_automata_walk	call site: 00075

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

68

Reachable functions

138

Percentage of reachable functions covered

50.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_categories.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	73
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	25
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	12
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	3
ndpilib/ndpi_domains.c	3
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_alg_strnstr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	10.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	89.4%
All colors	19	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	4	LLVMFuzzerTestOneInput	call site: 00004

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

7

Reachable functions

12

Percentage of reachable functions covered

41.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_strnstr.cpp	8
ndpi/tests/performance/strnstr.cpp	2
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_ds_hash

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.66%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	42	93.3%
All colors	45	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	15	ndpi_hash_add_entry	call site: 00015
1	17	ndpi_hash_add_entry	call site: 00017
1	19	ndpi_hash_add_entry	call site: 00019

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

17

Reachable functions

30

Percentage of reachable functions covered

43.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_hash.cpp	13
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_utils.c	7
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_ndpi_reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	687	15.9%
gold	[1:9]	2048	47.5%
yellow	[10:29]	94	2.18%
greenyellow	[30:49]	30	0.69%
lawngreen	50+	1444	33.5%
All colors	4303	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
44	4258	LLVMFuzzerTestOneInput	call site: 04258	ndpi_report_payload_stats
35	34	ndpi_patricia_destroy	call site: 00034	ndpi_exit_detection_module
35	4210	process_ndpi_collected_info	call site: 04210	dump_flow_fingerprint
29	2898	packet_processing	call site: 02898	ndpi_payload_analyzer
25	101	ndpi_domain_classify_free	call site: 00101	ac_automata_release
25	1266	ndpi_load_protocols_dir	call site: 01266	_wopendir
19	80	ac_automata_walk	call site: 00080	ac_automata_release
19	3549	ndpi_serialize_uint32_binary	call site: 03549	ndpi_serializer_header_uint32
15	3195	ndpi_patricia_search_best2	call site: 03195	fprintf
14	3727	ndpi_is_number	call site: 03727	ndpi_serialize_uint32_uint32
13	3904	ndpi_serialize_binary_float	call site: 03904	ndpi_serialize_uint32_float
10	3715	ndpi_serialize_string_uint32	call site: 03715	ndpi_serializer_header_string

Runtime coverage analysis

Covered functions

1629

Functions that are reachable but not covered

221

Reachable functions

846

Percentage of reachable functions covered

73.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ndpi_reader.c	33
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	510
ndpi/tests/performance/gcrypt.c	3
ndpi/example/reader_util.c	125
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	118
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	12
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_analyze.c	7
ndpilib/ndpi_serializer.c	40
ndpilib/ndpi_classify.c	16
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_process_packet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	513	14.2%
gold	[1:9]	2103	58.2%
yellow	[10:29]	109	3.02%
greenyellow	[30:49]	31	0.85%
lawngreen	50+	853	23.6%
All colors	3609	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
25	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
25	1303	ndpi_load_categories_dir	call site: 01303	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
15	2747	ndpi_patricia_search_best2	call site: 02747	fprintf
14	3167	ndpi_serialize_binary_uint32	call site: 03167	ndpi_serialize_uint32_uint32
14	3266	ndpi_serialize_binary_float	call site: 03266	ndpi_serialize_uint32_float
11	3124	ndpi_serialize_uint32_binary	call site: 03124	ndpi_serialize_key_uint32
10	2854	ndpi_internal_detection_process_packet	call site: 02854	fully_enc_heuristic
9	1575	node_resize_mp	call site: 01575	node_resize_mp
9	3061	ookla_search_into_cache	call site: 03061	ndpi_set_detected_protocol
9	3186	ndpi_serialize_binary_uint32	call site: 03186	ndpi_serializer_header_string

Runtime coverage analysis

Covered functions

1470

Functions that are reachable but not covered

167

Reachable functions

717

Percentage of reachable functions covered

76.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_process_packet.c	9
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	504
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	97
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	9
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	40
ndpilib/third_partyndpi_sha256.c	8
ndpilib/ndpi_analyze.c	2

Fuzzer: fuzz_serialization

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	2.45%
gold	[1:9]	1	0.17%
yellow	[10:29]	3	0.52%
greenyellow	[30:49]	4	0.70%
lawngreen	50+	549	96.1%
All colors	571	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	183	ndpi_serialize_binary_uint32	call site: 00183	ndpi_serializer_header_string
3	312	ndpi_serialize_binary_double	call site: 00312	ndpi_serialize_single_string
2	128	ndpi_serialize_uint32_double	call site: 00128	ndpi_serialize_key_uint32
1	13	ndpi_init_serializer_buffer	call site: 00013
1	17	ndpi_term_serializer	call site: 00017
1	23	ndpi_snprintf	call site: 00023
1	36	ndpi_realloc	call site: 00036
1	501	ndpi_deserialize_value_uint64	call site: 00501	ndpi_deserialize_value_uint32
1	525	ndpi_deserialize_value_int64	call site: 00525	ndpi_deserialize_value_int32

Runtime coverage analysis

Covered functions

116

Functions that are reachable but not covered

30

Reachable functions

143

Percentage of reachable functions covered

79.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_serialization.cpp	67
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_serializer.c	86
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_utils.c	5
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_ds_libcache

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	4.22%
gold	[1:9]	1	1.40%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	67	94.3%
All colors	71	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	cache_new	call site: 00008
1	11	cache_new	call site: 00011
1	26	cache_add	call site: 00026

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

16

Reachable functions

33

Percentage of reachable functions covered

51.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_libcache.cpp	14
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partylibcache.c	9
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_ds_bitmap64_fuse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	11.5%
gold	[1:9]	7	5.78%
yellow	[10:29]	1	0.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	99	81.8%
All colors	121	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	65	binary_fuse16_populate	call site: 00065	binary_fuse_rng_splitmix64
3	22	binary_fuse_calculate_segment_length	call site: 00022
3	29	binary_fuse_calculate_size_factor	call site: 00029	binary_fuse_max
1	7	ndpi_bitmap64_fuse_alloc	call site: 00007
1	9	ndpi_bitmap64_fuse_alloc	call site: 00009
1	11	ndpi_bitmap64_fuse_alloc	call site: 00011
1	16	ndpi_bitmap64_fuse_compress	call site: 00016	printf

Runtime coverage analysis

Covered functions

36

Functions that are reachable but not covered

15

Reachable functions

47

Percentage of reachable functions covered

68.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_bitmap64_fuse.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_bitmap64_fuse.c	13
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_party/include/binaryfusefilter.h	19
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_filecfg_protocols

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	117	7.57%
gold	[1:9]	13	0.84%
yellow	[10:29]	2	0.12%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1411	91.3%
All colors	1544	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
13	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
7	1439	node_resize_mp	call site: 01439	node_resize_mp
6	90	ndpi_exit_detection_module	call site: 00090	ndpi_hash_free
6	1350	ndpi_patricia_lookup	call site: 01350	fprintf
6	1363	ndpi_patricia_lookup	call site: 01363	fprintf
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1238	init_string_based_protocols	call site: 01238	NDPI_LOG_ERR
4	1329	add_to_ptree	call site: 01329	fprintf
4	1489	ndpi_handle_rule	call site: 01489	NDPI_LOG_ERR
3	86	ac_automata_release	call site: 00086	ac_automata_release

Runtime coverage analysis

Covered functions

96

Functions that are reachable but not covered

85

Reachable functions

168

Percentage of reachable functions covered

49.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_protocols.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	97
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	13
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	32
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4

Fuzzer: fuzz_gcrypt_cipher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	37.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	1.88%
greenyellow	[30:49]	14	8.80%
lawngreen	50+	82	51.5%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	91	mbedtls_cipher_update	call site: 00091	mbedtls_gcm_update
18	66	mbedtls_cipher_set_iv	call site: 00066	mbedtls_gcm_starts
8	121	mbedtls_cipher_finish	call site: 00121	mbedtls_cipher_get_iv_size
5	147	LLVMFuzzerTestOneInput	call site: 00147
1	30	LLVMFuzzerTestOneInput	call site: 00030	MBEDTLS_INTERNAL_VALIDATE_RET
1	32	LLVMFuzzerTestOneInput	call site: 00032	MBEDTLS_INTERNAL_VALIDATE_RET
1	34	LLVMFuzzerTestOneInput	call site: 00034	MBEDTLS_INTERNAL_VALIDATE_RET
1	36	LLVMFuzzerTestOneInput	call site: 00036	MBEDTLS_INTERNAL_VALIDATE_RET
1	38	LLVMFuzzerTestOneInput	call site: 00038	MBEDTLS_INTERNAL_VALIDATE_RET
1	40	LLVMFuzzerTestOneInput	call site: 00040	MBEDTLS_INTERNAL_VALIDATE_RET

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

52

Reachable functions

64

Percentage of reachable functions covered

18.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_cipher.cpp	39
ndpilib/third_partygcrypt/cipher.c	19
ndpilib/third_party/include/gcrypt/cipher.h	1
ndpilib/third_partygcrypt/gcm.c	13

Fuzzer: fuzz_alg_bytestream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	7	100.%
All colors	7	100

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

1

Reachable functions

6

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_bytestream.c	4
ndpilib/ndpi_main.c	3

Fuzzer: fuzz_alg_quick_encryption

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	15.3%
gold	[1:9]	2	1.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	82.6%
All colors	104	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	72	InvMixColumns	call site: 00072
2	58	ndpi_quick_decrypt	call site: 00058	ndpi_free
1	10	ndpi_quick_encrypt	call site: 00010
1	42	ndpi_base64_encode	call site: 00042
1	44	ndpi_quick_encrypt	call site: 00044
1	55	ndpi_base64_decode	call site: 00055	ndpi_free

Runtime coverage analysis

Covered functions

32

Functions that are reachable but not covered

17

Reachable functions

46

Percentage of reachable functions covered

63.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_quick_encryption.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_utils.c	13
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyaes.c	16

Fuzzer: fuzz_ds_domain_classify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	13.3%
gold	[1:9]	8	6.66%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	96	80.0%
All colors	120	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	77	ndpi_encode_domain	call site: 00077	fprintf
2	1	LLVMFuzzerTestOneInput	call site: 00001	set_ndpi_debug_function
2	83	ndpi_domain_classify_add	call site: 00083	ndpi_hash_add_entry
2	108	ndpi_domain_classify_hostname	call site: 00108	ndpi_hash_find_entry
1	5	ndpi_load_domain_suffixes	call site: 00005	ndpi_hash_free
1	8	ndpi_hash_free	call site: 00008
1	11	ndpi_load_domain_suffixes	call site: 00011
1	19	ndpi_hash_add_entry	call site: 00019
1	27	ndpi_load_domain_suffixes	call site: 00027	NDPI_LOG_ERR
1	38	ndpi_domain_classify_alloc	call site: 00038	ndpi_free
1	54	ndpi_get_host_domain_suffix	call site: 00054

Runtime coverage analysis

Covered functions

30

Functions that are reachable but not covered

31

Reachable functions

58

Percentage of reachable functions covered

46.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_domain_classify.cpp	17
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_domains.c	12
ndpilib/ndpi_utils.c	16
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_domain_classify.c	15
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_ds_btree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	22	20.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	79.6%
All colors	108	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	39	manhattan_dist	call site: 00039	recursive_build
6	65	query_depth_first	call site: 00065	query_depth_first
5	1	LLVMFuzzerTestOneInput	call site: 00001
1	9	LLVMFuzzerTestOneInput	call site: 00009
1	30	btree_init	call site: 00030
1	86	nheap_get_arrays	call site: 00086

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

23

Reachable functions

51

Percentage of reachable functions covered

54.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_btree.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	4
ndpilib/third_partyball.c	28

Fuzzer: fuzz_ds_tree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	4.87%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	39	95.1%
All colors	41	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	15	LLVMFuzzerTestOneInput	call site: 00015

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

8

Reachable functions

23

Percentage of reachable functions covered

65.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_tree.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_utils.c	4

Fuzzer: fuzz_alg_hw_rsi_outliers_da

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	8.14%
gold	[1:9]	0	0.0%
yellow	[10:29]	4	2.96%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	120	88.8%
All colors	135	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	62	LLVMFuzzerTestOneInput	call site: 00062	printf
3	26	ndpi_hw_init	call site: 00026
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	12	LLVMFuzzerTestOneInput	call site: 00012
1	33	ndpi_hw_init	call site: 00033
1	60	ndpi_hw_add_value	call site: 00060	printf

Runtime coverage analysis

Covered functions

47

Functions that are reachable but not covered

17

Reachable functions

61

Percentage of reachable functions covered

72.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_hw_rsi_outliers_da.cpp	39
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	26

Fuzzer: fuzz_gcrypt_light

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	24.7%
gold	[1:9]	3	0.85%
yellow	[10:29]	3	0.85%
greenyellow	[30:49]	8	2.27%
lawngreen	50+	251	71.3%
All colors	352	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	211	mbedtls_aes_crypt_ecb	call site: 00211	mbedtls_internal_aes_encrypt
19	122	mbedtls_aesni_setkey_enc	call site: 00122	MBEDTLS_GET_UINT32_LE
6	38	sha256_write_byte_block	call site: 00038	SIG1
6	258	mbedtls_gcm_starts	call site: 00258	gcm_mult
5	184	mbedtls_gcm_update	call site: 00184
3	171	gcm_mult	call site: 00171	gcm_mask
2	97	mbedtls_aesni_has_support	call site: 00097
2	177	gcm_mask	call site: 00177	gcm_mult
2	203	_gcry_cipher_crypt	call site: 00203	ndpi_malloc
2	267	mbedtls_gcm_update_ad	call site: 00267	gcm_mult
1	16	gcry_md_open	call site: 00016
1	57	gcry_md_close	call site: 00057

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

56

Reachable functions

123

Percentage of reachable functions covered

54.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_light.cpp	31
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partygcrypt_light.c	21
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partygcrypt/digest.c	5
ndpilib/third_partyndpi_sha256.c	6
ndpilib/third_partygcrypt/aes.c	22
ndpilib/third_partygcrypt/gcm.c	23
ndpilib/third_partygcrypt/aesni.c	11
ndpilib/third_partygcrypt/cipher.c	8
ndpilib/third_party/include/gcrypt/cipher.h	1

Fuzzer: fuzz_filecfg_malicious_sha1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	10.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	33	89.1%
All colors	37	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	6	LLVMFuzzerTestOneInput	call site: 00006	set_ndpi_debug_function
1	22	ndpi_hash_add_entry	call site: 00022
1	24	ndpi_hash_add_entry	call site: 00024

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

18

Reachable functions

32

Percentage of reachable functions covered

43.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_malicious_sha1.c	9
ndpi/fuzz/fuzz_common_code.c	5
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_main.c	7
ndpilib/ndpi_utils.c	7

Fuzzer: fuzz_dga

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	318	11.9%
gold	[1:9]	1972	74.2%
yellow	[10:29]	48	1.80%
greenyellow	[30:49]	8	0.30%
lawngreen	50+	309	11.6%
All colors	2655	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
25	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
25	1303	ndpi_load_categories_dir	call site: 01303	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
9	1575	node_resize_mp	call site: 01575	node_resize_mp
7	1329	ndpi_load_categories_dir	call site: 01329	readdir_r
6	1390	ndpi_patricia_lookup	call site: 01390	fprintf
6	1403	ndpi_patricia_lookup	call site: 01403	fprintf
5	1383	ndpi_New_Prefix2	call site: 01383	ndpi_free
4	3	ndpi_init_detection_module	call site: 00003	set_ndpi_debug_function
4	17	ndpi_patricia_destroy	call site: 00017	ndpi_Deref_Prefix
4	22	ndpi_DeleteEntry	call site: 00022	ndpi_DeleteEntry

Runtime coverage analysis

Covered functions

425

Functions that are reachable but not covered

129

Reachable functions

532

Percentage of reachable functions covered

75.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_dga.c	7
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	420
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	33
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	4
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	1
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5

Fuzzer: fuzz_readerutils_workflow

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	837	20.5%
gold	[1:9]	121	2.97%
yellow	[10:29]	52	1.27%
greenyellow	[30:49]	8	0.19%
lawngreen	50+	3047	74.9%
All colors	4065	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
77	2683	packet_processing	call site: 02683	ndpi_classify
61	3969	process_ndpi_collected_info	call site: 03969	dump_flow_fingerprint
27	3760	ndpi_dpi2json	call site: 03760	ndpi_serialize_string_uint32
25	1281	ndpi_load_protocols_dir	call site: 01281	_wopendir
17	3892	ndpi_dpi2json	call site: 03892	ndpi_serialize_string_uint32
15	2980	ndpi_patricia_search_best2	call site: 02980	fprintf
15	3872	ndpi_dpi2json	call site: 03872	ndpi_serialize_string_uint32
14	3512	ndpi_is_number	call site: 03512	ndpi_serialize_uint32_uint32
13	3302	ndpi_detection_giveup	call site: 03302	ndpi_set_detected_protocol
12	1445	ndpi_workflow_init	call site: 01445	load_public_lists
11	3689	ndpi_serialize_binary_float	call site: 03689	ndpi_serialize_uint32_float
11	3807	ndpi_dpi2json	call site: 03807

Runtime coverage analysis

Covered functions

1393

Functions that are reachable but not covered

208

Reachable functions

812

Percentage of reachable functions covered

74.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_readerutils_workflow.cpp	19
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	483
ndpi/tests/performance/gcrypt.c	3
ndpi/example/reader_util.c	124
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	116
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	17
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/third_partyshoco.c	8
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_analyze.c	7
ndpilib/ndpi_serializer.c	40
ndpilib/ndpi_classify.c	12
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_alg_jitter

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	17.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	19	82.6%
All colors	23	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	ndpi_jitter_init	call site: 00012
1	16	ndpi_jitter_add_value	call site: 00016	printf
1	20	ndpi_jitter_free	call site: 00020

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

11

Reachable functions

23

Percentage of reachable functions covered

52.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_jitter.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	5

Fuzzer: fuzz_libinjection

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	69	34.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	133	65.8%
All colors	202	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
69	33	syntax_merge_words	call site: 00033	ndpi_Ref_Prefix

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

10

Reachable functions

42

Percentage of reachable functions covered

76.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_libinjection.c	6
ndpilib/third_partylibinjection_sqli.c	28
ndpilib/third_partyndpi_patricia.c	14
ndpi/tests/performance/gcrypt.c	2
ndpilib/third_partylibinjection_xss.c	10
ndpilib/third_partylibinjection_html5.c	2

Fuzzer: fuzz_alg_ses_des

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	27.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	39	72.2%
All colors	54	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	14	ndpi_ses_init	call site: 00014
3	25	ndpi_ses_fitting	call site: 00025	printf
3	37	ndpi_des_fitting	call site: 00037	printf
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	20	ndpi_normal_cdf_inverse	call site: 00020	printf
1	23	ndpi_ses_add_value	call site: 00023	printf
1	32	ndpi_des_init	call site: 00032	printf
1	35	ndpi_des_add_value	call site: 00035	printf
1	41	LLVMFuzzerTestOneInput	call site: 00041

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

15

Reachable functions

33

Percentage of reachable functions covered

54.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_ses_des.cpp	17
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_analyze.c	11

Fuzzer: fuzz_filecfg_category

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	126	8.82%
gold	[1:9]	15	1.05%
yellow	[10:29]	2	0.14%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1284	89.9%
All colors	1427	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
13	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
6	1327	ndpi_patricia_lookup	call site: 01327	fprintf
6	1340	ndpi_patricia_lookup	call site: 01340	fprintf
5	1380	ndpi_encode_domain	call site: 01380	ndpi_hash_find_entry
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	80	node_release	call site: 00080	acho_free
4	1238	init_string_based_protocols	call site: 01238	NDPI_LOG_ERR
4	1306	add_to_ptree	call site: 01306	fprintf
4	1420	ndpi_hash_add_entry	call site: 01420	ndpi_hash_add_entry
3	75	ac_automata_walk	call site: 00075

Runtime coverage analysis

Covered functions

80

Functions that are reachable but not covered

68

Reachable functions

135

Percentage of reachable functions covered

49.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_category.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	71
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	24
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	12
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	3
ndpilib/ndpi_domains.c	3
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_binaryfusefilter

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	135	84.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	15.0%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	28	LLVMFuzzerTestOneInput	call site: 00028	ndpi_free
48	99	LLVMFuzzerTestOneInput	call site: 00099	ndpi_free
17	10	LLVMFuzzerTestOneInput	call site: 00010	binary_fuse_calculate_size_factor
5	85	LLVMFuzzerTestOneInput	call site: 00085	binary_fuse_mix_split
4	94	LLVMFuzzerTestOneInput	call site: 00094	binary_fuse_calculate_size_factor
4	150	LLVMFuzzerTestOneInput	call site: 00150	binary_fuse_mix_split
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	92	LLVMFuzzerTestOneInput	call site: 00092	ndpi_free
1	156	LLVMFuzzerTestOneInput	call site: 00156	ndpi_free

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

33

Reachable functions

42

Percentage of reachable functions covered

21.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_binaryfusefilter.cpp	13
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_party/include/binaryfusefilter.h	22

Fuzzer: fuzz_gcrypt_aes

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	2.32%
gold	[1:9]	5	3.87%
yellow	[10:29]	33	25.5%
greenyellow	[30:49]	1	0.77%
lawngreen	50+	87	67.4%
All colors	129	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	24	mbedtls_aesni_has_support	call site: 00024
1	18	aes_gen_tables	call site: 00018

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

35

Reachable functions

51

Percentage of reachable functions covered

31.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_aes.cpp	13
ndpilib/third_partygcrypt/aes.c	30
ndpilib/third_partygcrypt/aesni.c	12

Fuzzer: fuzz_ds_address_cache

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	3.22%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.07%
lawngreen	50+	89	95.6%
All colors	93	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	22	ndpi_init_address_cache	call site: 00022
1	26	ndpi_init_address_cache	call site: 00026
1	28	ndpi_init_address_cache	call site: 00028

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

25

Reachable functions

49

Percentage of reachable functions covered

48.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_address_cache.cpp	18
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_cache.c	24
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_alg_memmem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	6.45%
gold	[1:9]	1	3.22%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	28	90.3%
All colors	31	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	19	LLVMFuzzerTestOneInput	call site: 00019

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

10

Reachable functions

14

Percentage of reachable functions covered

28.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_memmem.cpp	9
ndpilib/ndpi_main.c	5

Fuzzer: fuzz_quic_get_crypto_data

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	559	16.8%
gold	[1:9]	1973	59.5%
yellow	[10:29]	60	1.81%
greenyellow	[30:49]	11	0.33%
lawngreen	50+	710	21.4%
All colors	3313	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
26	2745	ndpi_lru_add_to_cache	call site: 02745	ndpi_set_risk
25	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
25	1303	ndpi_load_categories_dir	call site: 01303	_wopendir
22	3286	ndpi_free_flow_data	call site: 03286	ndpi_free
19	74	ac_automata_walk	call site: 00074	ac_automata_release
16	3252	ndpi_free_flow_data	call site: 03252	ndpi_free
15	2675	ndpi_patricia_search_best2	call site: 02675	fprintf
10	2731	ndpi_handle_risk_exceptions	call site: 02731	ndpi_check_ipv6_exception
9	1575	node_resize_mp	call site: 01575	node_resize_mp
9	2792	proto_stack_update	call site: 02792	ookla_add_to_cache
7	1329	ndpi_load_categories_dir	call site: 01329	readdir_r

Runtime coverage analysis

Covered functions

507

Functions that are reachable but not covered

153

Reachable functions

639

Percentage of reachable functions covered

76.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_quic_get_crypto_data.c	10
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	455
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	48
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	9
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	50
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	7
ndpilib/protocols/sip.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	41
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	1
ndpi/windowsndpi_define.h	1
ndpilib/third_partyndpi_md5.c	6
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_gcrypt_gcm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	9.58%
gold	[1:9]	3	1.79%
yellow	[10:29]	7	4.19%
greenyellow	[30:49]	4	2.39%
lawngreen	50+	137	82.0%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	70	mbedtls_gcm_update	call site: 00070
2	86	mbedtls_aesni_has_support	call site: 00086
2	115	mbedtls_gcm_update_ad	call site: 00115	gcm_mult
1	37	mbedtls_cipher_setkey	call site: 00037
1	48	mbedtls_cipher_update	call site: 00048	mbedtls_gcm_update
1	59	gcm_mult	call site: 00059	gcm_mask
1	61	gcm_mask	call site: 00061	mbedtls_platform_zeroize
1	64	gcm_mask	call site: 00064	gcm_mult
1	80	gcm_gen_table	call site: 00080
1	124	mbedtls_gcm_finish	call site: 00124	gcm_mult

Runtime coverage analysis

Covered functions

36

Functions that are reachable but not covered

32

Reachable functions

55

Percentage of reachable functions covered

41.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_gcm.cpp	18
ndpilib/third_partygcrypt/gcm.c	24
ndpilib/third_partygcrypt/cipher.c	8
ndpilib/third_party/include/gcrypt/cipher.h	1
ndpilib/third_partygcrypt/aesni.c	8

Fuzzer: fuzz_filecfg_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	80	6.16%
gold	[1:9]	11	0.84%
yellow	[10:29]	4	0.30%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1202	92.6%
All colors	1297	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
13	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
6	90	ndpi_exit_detection_module	call site: 00090	ndpi_hash_free
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	80	node_release	call site: 00080	acho_free
4	1238	init_string_based_protocols	call site: 01238	NDPI_LOG_ERR
3	75	ac_automata_walk	call site: 00075
3	86	ac_automata_release	call site: 00086	ac_automata_release
2	106	ndpi_exit_detection_module	call site: 00106	ndpi_free

Runtime coverage analysis

Covered functions

71

Functions that are reachable but not covered

53

Reachable functions

103

Percentage of reachable functions covered

48.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_config.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	60
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	12
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	12
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_ds_kdtree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	5.15%
gold	[1:9]	2	2.06%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	90	92.7%
All colors	97	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	11	LLVMFuzzerTestOneInput	call site: 00011
1	68	kd_nearest	call site: 00068	kd_res_free
1	74	LLVMFuzzerTestOneInput	call site: 00074	printf
1	88	clear_rec	call site: 00088

Runtime coverage analysis

Covered functions

39

Functions that are reachable but not covered

18

Reachable functions

54

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_kdtree.cpp	18
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_analyze.c	9
ndpilib/third_partykdtree.c	20

Fuzzer: fuzz_alg_hll

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	8.88%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	91.1%
All colors	45	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	hll_init	call site: 00012
1	27	hll_count	call site: 00027
1	42	hll_destroy	call site: 00042

Runtime coverage analysis

Covered functions

26

Functions that are reachable but not covered

13

Reachable functions

36

Percentage of reachable functions covered

63.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_hll.cpp	15
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	5
ndpilib/third_partyhll/hll.c	7
ndpilib/third_partyhll/MurmurHash3.c	1

Fuzzer: fuzz_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	389	8.98%
gold	[1:9]	66	1.52%
yellow	[10:29]	40	0.92%
greenyellow	[30:49]	35	0.80%
lawngreen	50+	3801	87.7%
All colors	4331	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
25	1541	ndpi_load_categories_dir	call site: 01541	_wopendir
20	4245	ndpi_free_flow_data	call site: 04245	ndpi_free
19	4093	ndpi_serialize_uint32_binary	call site: 04093	ndpi_serializer_header_uint32
15	3143	ndpi_patricia_search_best2	call site: 03143	fprintf
12	1578	ndpi_load_categories_dir	call site: 01578	ndpi_load_category_file
11	4032	ndpi_detection_giveup	call site: 04032	ndpi_set_detected_protocol
10	3986	ndpi_reconcile_protocols	call site: 03986	ndpi_set_risk
10	4199	LLVMFuzzerTestOneInput	call site: 04199	ndpi_min
8	3695	internal_giveup	call site: 03695	ndpi_fill_protocol_category
7	51	ndpi_exit_detection_module	call site: 00051	cache_free
7	1432	node_resize_mp	call site: 01432	node_resize_mp
7	1567	ndpi_load_categories_dir	call site: 01567	readdir_r

Runtime coverage analysis

Covered functions

1255

Functions that are reachable but not covered

187

Reachable functions

804

Percentage of reachable functions covered

76.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_config.cpp	139
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_main.c	539
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	68
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	14
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	8
ndpilib/ndpi_memory.c	5
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/third_partyndpi_sha256.c	8
ndpilib/ndpi_analyze.c	2
ndpilib/ndpi_serializer.c	26
ndpilib/protocols/tcp_udp.c	5
ndpilib/ndpi_classify.c	5
ndpilib/third_partywindows/gettimeofday.c	2

Fuzzer: ndpi/fuzz/fuzz_is_stun.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	608	15.8%
gold	[1:9]	2010	52.2%
yellow	[10:29]	97	2.52%
greenyellow	[30:49]	40	1.04%
lawngreen	50+	1091	28.3%
All colors	3846	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	3533	processCertificateElements	call site: 03533	strptime
25	1303	ndpi_load_categories_dir	call site: 01303	_wopendir
15	2754	ndpi_patricia_search_best2	call site: 02754	fprintf
10	3616	processCertificateElements	call site: 03616	ndpi_set_risk
9	1575	node_resize_mp	call site: 01575	node_resize_mp
9	3732	ookla_search_into_cache	call site: 03732	ndpi_set_detected_protocol
8	105	ndpi_exit_detection_module	call site: 00105	ndpi_term_address_cache
7	52	ndpi_lru_free_cache	call site: 00052	ndpi_lru_free_cache
7	1329	ndpi_load_categories_dir	call site: 01329	readdir_r
7	3046	processClientServerHello	call site: 03046	printf
7	3233	processClientServerHello	call site: 03233	printf
7	3249	processClientServerHello	call site: 03249	printf

Runtime coverage analysis

Covered functions

2117

Functions that are reachable but not covered

146

Reachable functions

703

Percentage of reachable functions covered

79.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_is_stun.c	3
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	454
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	51
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	9
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	107
ndpilib/protocols/rtp.c	5
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	51
ndpilib/protocols/sip.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	9
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	8
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	2
ndpilib/third_partyndpi_md5.c	6
ndpi/windowsndpi_define.h	1
ndpilib/third_partyndpi_sha256.c	8
ndpilib/third_partyndpi_sha1.c	10
ndpilib/third_partystrptime.c	7
ndpilib/ndpi_analyze.c	3

Fuzzer: json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	261	97.7%
gold	[1:9]	2	0.74%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	4	1.49%
All colors	267	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
245	0	EP	call site: 00000	json_tokener_parse_ex
12	247	LLVMFuzzerTestOneInput	call site: 00247	json_object_to_json_string_ext
4	262	LLVMFuzzerTestOneInput	call site: 00262	json_tokener_reset

Runtime coverage analysis

Covered functions

2117

Functions that are reachable but not covered

109

Reachable functions

110

Percentage of reachable functions covered

0.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc	8
json-c-json-c-0.17-20230812/json_tokener.c	47
json-c-json-c-0.17-20230812/printbuf.c	3
json-c-json-c-0.17-20230812/json_object.c	48
json-c-json-c-0.17-20230812/linkhash.c	8
json-c-json-c-0.17-20230812/arraylist.c	4
json-c-json-c-0.17-20230812/json_util.c	2
json-c-json-c-0.17-20230812/linkhash.h	1