High level conclusions

Fuzzers reach 51.79% code coverage.

Fuzzers reach 38.97% of cyclomatic complexity.

Fuzzers reach 37.45% of all functions.

Fuzzer json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc is blocked:

The runtime code coverage of json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc covers 0.909% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_alg_memmem is blocked:

The runtime code coverage of fuzz_alg_memmem covers 28.57% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_binaryfusefilter is blocked:

The runtime code coverage of fuzz_binaryfusefilter covers 21.42% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_gcrypt_cipher is blocked:

The runtime code coverage of fuzz_gcrypt_cipher covers 18.75% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1510 / 4031

Cyclomatic complexity statically reachable by fuzzers

7218 / 18521

Runtime code coverage of functions

2088 / 4031

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_alg_crc32_md5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	1.55%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.77%
lawngreen	50+	126	97.6%
All colors	129	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	108	LLVMFuzzerTestOneInput	call site: 00108
1	118	LLVMFuzzerTestOneInput	call site: 00118

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

14

Reachable functions

42

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_crc32_md5.c	25
ndpilib/ndpi_analyze.c	3
ndpilib/ndpi_main.c	3
ndpilib/third_partyndpi_md5.c	6
ndpilib/ndpi_hash.c	3
ndpilib/third_partyhll/MurmurHash3.c	1
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_alg_shoco

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	23	100.%
All colors	23	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

5

Reachable functions

13

Percentage of reachable functions covered

61.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_shoco.cpp	9
ndpilib/third_partyshoco.c	9
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_alg_bins

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	14.5%
gold	[1:9]	4	2.91%
yellow	[10:29]	1	0.72%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	112	81.7%
All colors	137	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	125	ndpi_cluster_bins	call site: 00125	printf
3	27	ndpi_bin_similarity	call site: 00027	ndpi_get_bin_value
3	121	ndpi_cluster_bins	call site: 00121	ndpi_print_bin
2	112	ndpi_cluster_bins	call site: 00112	ndpi_print_bin
2	115	ndpi_cluster_bins	call site: 00115	printf
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	ndpi_init_bin	call site: 00012
1	40	ndpi_clone_bin	call site: 00040
1	76	ndpi_snprintf	call site: 00076
1	105	ndpi_cluster_bins	call site: 00105	printf

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

23

Reachable functions

45

Percentage of reachable functions covered

48.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_bins.cpp	21
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	20
ndpilib/ndpi_utils.c	5

Fuzzer: fuzz_tls_certificate

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	567	18.7%
gold	[1:9]	1987	65.7%
yellow	[10:29]	47	1.55%
greenyellow	[30:49]	10	0.33%
lawngreen	50+	413	13.6%
All colors	3024	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	2616	processCertificateElements	call site: 02616	strptime
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
32	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
27	2855	ndpi_lru_add_to_cache	call site: 02855	ndpi_set_risk
26	2997	ndpi_free_flow_data	call site: 02997	ndpi_free
25	1313	ndpi_load_categories_dir	call site: 01313	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
17	2962	ndpi_free_flow_data	call site: 02962	ndpi_free
15	2785	ndpi_patricia_search_best2	call site: 02785	fprintf
10	2699	processCertificateElements	call site: 02699	ndpi_set_risk
10	2841	ndpi_handle_risk_exceptions	call site: 02841	ndpi_check_ipv6_exception
9	1585	node_resize_mp	call site: 01585	node_resize_mp

Runtime coverage analysis

Covered functions

462

Functions that are reachable but not covered

155

Reachable functions

597

Percentage of reachable functions covered

74.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_tls_certificate.c	7
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	443
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	49
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	9
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	35
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/third_partystrptime.c	7

Fuzzer: fuzz_ds_ptree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	29.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.53%
lawngreen	50+	131	70.0%
All colors	187	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	69	ndpi_patricia_search_best2	call site: 00069	fprintf
6	110	ndpi_patricia_lookup	call site: 00110	fprintf
6	123	ndpi_patricia_lookup	call site: 00123	fprintf
4	64	ndpi_patricia_search_best2	call site: 00064	fprintf
2	21	ndpi_DeleteEntry	call site: 00021
2	88	ndpi_patricia_search_best2	call site: 00088	fprintf
2	91	ndpi_ptree_insert	call site: 00091	fprintf
2	103	ndpi_New_Prefix2	call site: 00103	ndpi_calloc
2	106	ndpi_patricia_lookup	call site: 00106	fprintf
2	118	ndpi_patricia_lookup	call site: 00118	fprintf
2	130	ndpi_patricia_lookup	call site: 00130	fprintf
2	139	ndpi_patricia_lookup	call site: 00139	fprintf

Runtime coverage analysis

Covered functions

37

Functions that are reachable but not covered

35

Reachable functions

69

Percentage of reachable functions covered

49.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_ptree.cpp	16
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_main.c	24
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	5

Fuzzer: fuzz_ds_patricia

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	24.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.36%
greenyellow	[30:49]	1	0.36%
lawngreen	50+	206	74.6%
All colors	276	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	221	ndpi_patricia_search_best2	call site: 00221	fprintf
9	154	ndpi_patricia_search_exact	call site: 00154	fprintf
6	52	ndpi_patricia_lookup	call site: 00052	fprintf
6	65	ndpi_patricia_lookup	call site: 00065	fprintf
4	30	LLVMFuzzerTestOneInput	call site: 00030	fprintf
3	47	ndpi_patricia_lookup	call site: 00047	fprintf
2	60	ndpi_patricia_lookup	call site: 00060	fprintf
2	72	ndpi_patricia_lookup	call site: 00072	fprintf
2	81	ndpi_patricia_lookup	call site: 00081	fprintf
2	85	ndpi_patricia_lookup	call site: 00085	fprintf
2	96	ndpi_patricia_lookup	call site: 00096	fprintf
2	169	ndpi_patricia_search_exact	call site: 00169	fprintf

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

23

Reachable functions

60

Percentage of reachable functions covered

61.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_patricia.cpp	28
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partyndpi_patricia.c	25
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_main.c	2

Fuzzer: fuzz_filecfg_malicious_ja4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	86	6.54%
gold	[1:9]	13	0.99%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1213	92.3%
All colors	1313	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	80	node_release	call site: 00080	acho_free
4	1248	init_string_based_protocols	call site: 01248	NDPI_LOG_ERR
3	75	ac_automata_walk	call site: 00075
3	86	ac_automata_release	call site: 00086	ac_automata_release
3	1281	ndpi_set_config	call site: 01281
2	94	ndpi_hash_free	call site: 00094	ndpi_hash_free

Runtime coverage analysis

Covered functions

63

Functions that are reachable but not covered

60

Reachable functions

110

Percentage of reachable functions covered

45.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_malicious_ja4.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	62
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	16
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	12
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_filecfg_risk_domains

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	89	6.53%
gold	[1:9]	13	0.95%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1258	92.4%
All colors	1361	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
6	90	ndpi_exit_detection_module	call site: 00090	ndpi_hash_free
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1248	init_string_based_protocols	call site: 01248	NDPI_LOG_ERR
3	1281	ndpi_set_config	call site: 01281
2	86	ac_automata_release	call site: 00086	acho_free
2	106	ndpi_exit_detection_module	call site: 00106	ndpi_free
2	176	ndpi_realloc	call site: 00176	ndpi_free

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

66

Reachable functions

135

Percentage of reachable functions covered

51.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_risk_domains.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	68
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	12
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	33
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4

Fuzzer: fuzz_community_id

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	6.87%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.25%
lawngreen	50+	147	91.8%
All colors	160	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	130	ndpi_base64_encode	call site: 00130	printf
1	13	LLVMFuzzerTestOneInput	call site: 00013
1	120	SHA1Transform	call site: 00120	SHA1Transform
1	140	ndpi_community_id_finalize_and_compute_hash	call site: 00140

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

27

Reachable functions

49

Percentage of reachable functions covered

44.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_community_id.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_community_id.c	20
ndpilib/third_partyndpi_sha1.c	10
ndpilib/ndpi_utils.c	1

Fuzzer: fuzz_filecfg_categories

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	127	8.81%
gold	[1:9]	15	1.04%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1297	90.0%
All colors	1440	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
6	1340	ndpi_patricia_lookup	call site: 01340	fprintf
6	1353	ndpi_patricia_lookup	call site: 01353	fprintf
5	1393	ndpi_encode_domain	call site: 01393	ndpi_hash_find_entry
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	80	node_release	call site: 00080	acho_free
4	1248	init_string_based_protocols	call site: 01248	NDPI_LOG_ERR
4	1319	add_to_ptree	call site: 01319	fprintf
4	1433	ndpi_hash_add_entry	call site: 01433	ndpi_hash_add_entry
3	75	ac_automata_walk	call site: 00075

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

72

Reachable functions

142

Percentage of reachable functions covered

49.3%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_categories.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	74
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	25
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	12
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	3
ndpilib/ndpi_domains.c	3
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_ds_cmsketch

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	18.7%
gold	[1:9]	1	3.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	78.1%
All colors	32	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	15	ndpi_cm_sketch_init	call site: 00015	printf
1	11	ndpi_cm_sketch_init	call site: 00011
1	18	ndpi_cm_sketch_init	call site: 00018
1	21	ndpi_cm_sketch_add	call site: 00021	printf
1	25	ndpi_cm_sketch_count	call site: 00025	printf

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

12

Reachable functions

26

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_cmsketch.cpp	9
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_analyze.c	7
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_ds_libcache

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	4.22%
gold	[1:9]	1	1.40%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	67	94.3%
All colors	71	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	cache_new	call site: 00008
1	11	cache_new	call site: 00011
1	26	cache_add	call site: 00026

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

16

Reachable functions

33

Percentage of reachable functions covered

51.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_libcache.cpp	14
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partylibcache.c	9
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_ds_hash

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.66%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	42	93.3%
All colors	45	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	15	ndpi_hash_add_entry	call site: 00015
1	17	ndpi_hash_add_entry	call site: 00017
1	19	ndpi_hash_add_entry	call site: 00019

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

17

Reachable functions

30

Percentage of reachable functions covered

43.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_hash.cpp	13
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_utils.c	7
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_ds_ahocorasick

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	9.13%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	169	90.8%
All colors	186	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	53	xmemchr	call site: 00053	DETECTNULL
2	181	ac_automata_release	call site: 00181	acho_free
1	10	ac_automata_init	call site: 00010
1	14	ac_automata_init	call site: 00014
1	38	ndpi_strdup	call site: 00038
1	58	xmemchr	call site: 00058
1	89	node_resize_mp	call site: 00089
1	96	LLVMFuzzerTestOneInput	call site: 00096
1	112	ac_automata_walk	call site: 00112
1	124	LLVMFuzzerTestOneInput	call site: 00124	printf
1	129	node_findbs_next	call site: 00129	node_findbs_next
1	131	ac_automata_search	call site: 00131	printf

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

32

Reachable functions

81

Percentage of reachable functions covered

60.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_ahocorasick.cpp	31
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partyahocorasick.c	40
ndpilib/ndpi_main.c	12
ndpilib/ndpi_memory.c	3
ndpi/tests/performance/gcrypt.c	2

Fuzzer: fuzz_ds_bitmap64_fuse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	11.5%
gold	[1:9]	7	5.78%
yellow	[10:29]	1	0.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	99	81.8%
All colors	121	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	65	binary_fuse16_populate	call site: 00065	binary_fuse_rng_splitmix64
3	22	binary_fuse_calculate_segment_length	call site: 00022
3	29	binary_fuse_calculate_size_factor	call site: 00029	binary_fuse_max
1	7	ndpi_bitmap64_fuse_alloc	call site: 00007
1	9	ndpi_bitmap64_fuse_alloc	call site: 00009
1	11	ndpi_bitmap64_fuse_alloc	call site: 00011
1	16	ndpi_bitmap64_fuse_compress	call site: 00016	printf

Runtime coverage analysis

Covered functions

36

Functions that are reachable but not covered

15

Reachable functions

47

Percentage of reachable functions covered

68.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_bitmap64_fuse.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_bitmap64_fuse.c	13
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_party/include/binaryfusefilter.h	19
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_serialization

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	2.45%
gold	[1:9]	1	0.17%
yellow	[10:29]	3	0.52%
greenyellow	[30:49]	4	0.70%
lawngreen	50+	549	96.1%
All colors	571	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	183	ndpi_serialize_binary_uint32	call site: 00183	ndpi_serializer_header_string
3	312	ndpi_serialize_binary_double	call site: 00312	ndpi_serialize_single_string
2	128	ndpi_serialize_uint32_double	call site: 00128	ndpi_serialize_key_uint32
1	13	ndpi_init_serializer_buffer	call site: 00013
1	17	ndpi_term_serializer	call site: 00017
1	23	ndpi_snprintf	call site: 00023
1	36	ndpi_realloc	call site: 00036
1	501	ndpi_deserialize_value_uint64	call site: 00501	ndpi_deserialize_value_uint32
1	525	ndpi_deserialize_value_int64	call site: 00525	ndpi_deserialize_value_int32

Runtime coverage analysis

Covered functions

116

Functions that are reachable but not covered

30

Reachable functions

143

Percentage of reachable functions covered

79.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_serialization.cpp	67
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_serializer.c	86
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_utils.c	5
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_alg_strnstr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	10.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	89.4%
All colors	19	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	4	LLVMFuzzerTestOneInput	call site: 00004

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

7

Reachable functions

12

Percentage of reachable functions covered

41.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_strnstr.cpp	8
ndpi/tests/performance/strnstr.cpp	2
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_alg_bytestream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	7	100.%
All colors	7	100

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

1

Reachable functions

6

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_bytestream.c	4
ndpilib/ndpi_main.c	3

Fuzzer: fuzz_gcrypt_cipher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	37.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	1.88%
greenyellow	[30:49]	25	15.7%
lawngreen	50+	71	44.6%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	91	mbedtls_cipher_update	call site: 00091	mbedtls_gcm_update
18	66	mbedtls_cipher_set_iv	call site: 00066	mbedtls_gcm_starts
8	121	mbedtls_cipher_finish	call site: 00121	mbedtls_cipher_get_iv_size
5	147	LLVMFuzzerTestOneInput	call site: 00147
1	30	LLVMFuzzerTestOneInput	call site: 00030	MBEDTLS_INTERNAL_VALIDATE_RET
1	32	LLVMFuzzerTestOneInput	call site: 00032	MBEDTLS_INTERNAL_VALIDATE_RET
1	34	LLVMFuzzerTestOneInput	call site: 00034	MBEDTLS_INTERNAL_VALIDATE_RET
1	36	LLVMFuzzerTestOneInput	call site: 00036	MBEDTLS_INTERNAL_VALIDATE_RET
1	38	LLVMFuzzerTestOneInput	call site: 00038	MBEDTLS_INTERNAL_VALIDATE_RET
1	40	LLVMFuzzerTestOneInput	call site: 00040	MBEDTLS_INTERNAL_VALIDATE_RET

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

52

Reachable functions

64

Percentage of reachable functions covered

18.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_cipher.cpp	39
ndpilib/third_partygcrypt/cipher.c	19
ndpilib/third_party/include/gcrypt/cipher.h	1
ndpilib/third_partygcrypt/gcm.c	13

Fuzzer: fuzz_process_packet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	522	14.3%
gold	[1:9]	2110	58.0%
yellow	[10:29]	118	3.24%
greenyellow	[30:49]	38	1.04%
lawngreen	50+	847	23.3%
All colors	3635	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
32	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
25	1313	ndpi_load_categories_dir	call site: 01313	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
15	2780	ndpi_patricia_search_best2	call site: 02780	fprintf
14	3192	ndpi_serialize_binary_uint32	call site: 03192	ndpi_serialize_uint32_uint32
14	3291	ndpi_serialize_binary_float	call site: 03291	ndpi_serialize_uint32_float
11	3149	ndpi_serialize_uint32_binary	call site: 03149	ndpi_serialize_key_uint32
10	2704	internal_giveup	call site: 02704	ndpi_fill_protocol_category
10	2887	ndpi_internal_detection_process_packet	call site: 02887	fully_enc_heuristic
9	1585	node_resize_mp	call site: 01585	node_resize_mp
9	3086	ookla_search_into_cache	call site: 03086	ndpi_set_detected_protocol

Runtime coverage analysis

Covered functions

1477

Functions that are reachable but not covered

171

Reachable functions

724

Percentage of reachable functions covered

76.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_process_packet.c	9
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	508
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	97
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	9
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	40
ndpilib/third_partyndpi_sha256.c	8
ndpilib/ndpi_analyze.c	2

Fuzzer: fuzz_ds_domain_classify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	13.3%
gold	[1:9]	8	6.66%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	96	80.0%
All colors	120	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	77	ndpi_encode_domain	call site: 00077	fprintf
2	1	LLVMFuzzerTestOneInput	call site: 00001	set_ndpi_debug_function
2	83	ndpi_domain_classify_add	call site: 00083	ndpi_hash_add_entry
2	108	ndpi_domain_classify_hostname	call site: 00108	ndpi_hash_find_entry
1	5	ndpi_load_domain_suffixes	call site: 00005	ndpi_hash_free
1	8	ndpi_hash_free	call site: 00008
1	11	ndpi_load_domain_suffixes	call site: 00011
1	19	ndpi_hash_add_entry	call site: 00019
1	27	ndpi_load_domain_suffixes	call site: 00027	NDPI_LOG_ERR
1	38	ndpi_domain_classify_alloc	call site: 00038	ndpi_free
1	54	ndpi_get_host_domain_suffix	call site: 00054

Runtime coverage analysis

Covered functions

30

Functions that are reachable but not covered

31

Reachable functions

58

Percentage of reachable functions covered

46.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_domain_classify.cpp	17
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_domains.c	12
ndpilib/ndpi_utils.c	16
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_domain_classify.c	15
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_filecfg_protocols

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	7.55%
gold	[1:9]	13	0.82%
yellow	[10:29]	2	0.12%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1440	91.4%
All colors	1575	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
11	118	ndpi_exit_detection_module	call site: 00118	ndpi_term_address_cache
7	109	ndpi_exit_detection_module	call site: 00109	ndpi_hash_free
7	1449	node_resize_mp	call site: 01449	node_resize_mp
6	1360	ndpi_patricia_lookup	call site: 01360	fprintf
6	1373	ndpi_patricia_lookup	call site: 01373	fprintf
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1248	init_string_based_protocols	call site: 01248	NDPI_LOG_ERR
4	1339	add_to_ptree	call site: 01339	fprintf
4	1499	ndpi_handle_rule	call site: 01499	NDPI_LOG_ERR
3	86	ac_automata_release	call site: 00086	ac_automata_release

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

91

Reachable functions

177

Percentage of reachable functions covered

48.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_protocols.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	102
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	17
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	32
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4

Fuzzer: fuzz_alg_quick_encryption

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	15.3%
gold	[1:9]	2	1.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	82.6%
All colors	104	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	72	InvMixColumns	call site: 00072
2	58	ndpi_quick_decrypt	call site: 00058	ndpi_free
1	10	ndpi_quick_encrypt	call site: 00010
1	42	ndpi_base64_encode	call site: 00042
1	44	ndpi_quick_encrypt	call site: 00044
1	55	ndpi_base64_decode	call site: 00055	ndpi_free

Runtime coverage analysis

Covered functions

32

Functions that are reachable but not covered

17

Reachable functions

46

Percentage of reachable functions covered

63.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_quick_encryption.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_utils.c	13
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyaes.c	16

Fuzzer: fuzz_ndpi_reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	694	15.9%
gold	[1:9]	2063	47.4%
yellow	[10:29]	93	2.14%
greenyellow	[30:49]	30	0.69%
lawngreen	50+	1465	33.7%
All colors	4345	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
44	4300	LLVMFuzzerTestOneInput	call site: 04300	ndpi_report_payload_stats
35	34	ndpi_patricia_destroy	call site: 00034	ndpi_exit_detection_module
35	4252	process_ndpi_collected_info	call site: 04252	dump_flow_fingerprint
32	101	ndpi_domain_classify_free	call site: 00101	ac_automata_release
29	2925	packet_processing	call site: 02925	ndpi_payload_analyzer
25	1276	ndpi_load_protocols_dir	call site: 01276	_wopendir
19	3589	ndpi_serialize_uint32_binary	call site: 03589	ndpi_serializer_header_uint32
15	3231	ndpi_patricia_search_best2	call site: 03231	fprintf
14	3768	ndpi_is_number	call site: 03768	ndpi_serialize_uint32_uint32
13	80	ac_automata_walk	call site: 00080	ac_automata_release
13	3946	ndpi_serialize_binary_float	call site: 03946	ndpi_serialize_uint32_float
10	3756	ndpi_serialize_string_uint32	call site: 03756	ndpi_serializer_header_string

Runtime coverage analysis

Covered functions

1697

Functions that are reachable but not covered

224

Reachable functions

855

Percentage of reachable functions covered

73.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ndpi_reader.c	33
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	515
ndpi/tests/performance/gcrypt.c	3
ndpi/example/reader_util.c	124
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	123
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	12
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_analyze.c	7
ndpilib/ndpi_serializer.c	40
ndpilib/ndpi_classify.c	16
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_ds_tree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	4.87%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	39	95.1%
All colors	41	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	15	LLVMFuzzerTestOneInput	call site: 00015

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

8

Reachable functions

23

Percentage of reachable functions covered

65.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_tree.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_utils.c	4

Fuzzer: fuzz_alg_hw_rsi_outliers_da

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	8.14%
gold	[1:9]	0	0.0%
yellow	[10:29]	4	2.96%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	120	88.8%
All colors	135	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	62	LLVMFuzzerTestOneInput	call site: 00062	printf
3	26	ndpi_hw_init	call site: 00026
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	12	LLVMFuzzerTestOneInput	call site: 00012
1	33	ndpi_hw_init	call site: 00033
1	60	ndpi_hw_add_value	call site: 00060	printf

Runtime coverage analysis

Covered functions

47

Functions that are reachable but not covered

17

Reachable functions

61

Percentage of reachable functions covered

72.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_hw_rsi_outliers_da.cpp	39
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	26

Fuzzer: fuzz_ds_btree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	22	20.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	79.6%
All colors	108	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	39	manhattan_dist	call site: 00039	recursive_build
6	65	query_depth_first	call site: 00065	query_depth_first
5	1	LLVMFuzzerTestOneInput	call site: 00001
1	9	LLVMFuzzerTestOneInput	call site: 00009
1	30	btree_init	call site: 00030
1	86	nheap_get_arrays	call site: 00086

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

23

Reachable functions

51

Percentage of reachable functions covered

54.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_btree.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	4
ndpilib/third_partyball.c	28

Fuzzer: fuzz_dga

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	327	12.2%
gold	[1:9]	1984	74.0%
yellow	[10:29]	48	1.79%
greenyellow	[30:49]	11	0.41%
lawngreen	50+	309	11.5%
All colors	2679	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
32	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
25	1313	ndpi_load_categories_dir	call site: 01313	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
9	1585	node_resize_mp	call site: 01585	node_resize_mp
7	1339	ndpi_load_categories_dir	call site: 01339	readdir_r
6	1400	ndpi_patricia_lookup	call site: 01400	fprintf
6	1413	ndpi_patricia_lookup	call site: 01413	fprintf
5	1393	ndpi_New_Prefix2	call site: 01393	ndpi_free
4	3	ndpi_init_detection_module	call site: 00003	set_ndpi_debug_function
4	17	ndpi_patricia_destroy	call site: 00017	ndpi_Deref_Prefix
4	22	ndpi_DeleteEntry	call site: 00022	ndpi_DeleteEntry

Runtime coverage analysis

Covered functions

428

Functions that are reachable but not covered

133

Reachable functions

539

Percentage of reachable functions covered

75.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_dga.c	7
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	424
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	33
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	4
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	1
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5

Fuzzer: fuzz_filecfg_malicious_sha1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	10.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	33	89.1%
All colors	37	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	6	LLVMFuzzerTestOneInput	call site: 00006	set_ndpi_debug_function
1	22	ndpi_hash_add_entry	call site: 00022
1	24	ndpi_hash_add_entry	call site: 00024

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

18

Reachable functions

32

Percentage of reachable functions covered

43.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_malicious_sha1.c	9
ndpi/fuzz/fuzz_common_code.c	5
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_main.c	7
ndpilib/ndpi_utils.c	7

Fuzzer: fuzz_libinjection

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	69	34.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	133	65.8%
All colors	202	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
69	33	syntax_merge_words	call site: 00033	ndpi_Ref_Prefix

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

10

Reachable functions

42

Percentage of reachable functions covered

76.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_libinjection.c	6
ndpilib/third_partylibinjection_sqli.c	28
ndpilib/third_partyndpi_patricia.c	14
ndpi/tests/performance/gcrypt.c	2
ndpilib/third_partylibinjection_xss.c	10
ndpilib/third_partylibinjection_html5.c	2

Fuzzer: fuzz_gcrypt_light

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	24.7%
gold	[1:9]	3	0.85%
yellow	[10:29]	3	0.85%
greenyellow	[30:49]	5	1.42%
lawngreen	50+	254	72.1%
All colors	352	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	211	mbedtls_aes_crypt_ecb	call site: 00211	mbedtls_internal_aes_encrypt
19	122	mbedtls_aesni_setkey_enc	call site: 00122	MBEDTLS_GET_UINT32_LE
6	38	sha256_write_byte_block	call site: 00038	SIG1
6	258	mbedtls_gcm_starts	call site: 00258	gcm_mult
5	184	mbedtls_gcm_update	call site: 00184
3	171	gcm_mult	call site: 00171	gcm_mask
2	97	mbedtls_aesni_has_support	call site: 00097
2	177	gcm_mask	call site: 00177	gcm_mult
2	203	_gcry_cipher_crypt	call site: 00203	ndpi_malloc
2	267	mbedtls_gcm_update_ad	call site: 00267	gcm_mult
1	16	gcry_md_open	call site: 00016
1	57	gcry_md_close	call site: 00057

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

56

Reachable functions

123

Percentage of reachable functions covered

54.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_light.cpp	31
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partygcrypt_light.c	21
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partygcrypt/digest.c	5
ndpilib/third_partyndpi_sha256.c	6
ndpilib/third_partygcrypt/aes.c	22
ndpilib/third_partygcrypt/gcm.c	23
ndpilib/third_partygcrypt/aesni.c	11
ndpilib/third_partygcrypt/cipher.c	8
ndpilib/third_party/include/gcrypt/cipher.h	1

Fuzzer: fuzz_alg_jitter

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	17.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	19	82.6%
All colors	23	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	ndpi_jitter_init	call site: 00012
1	16	ndpi_jitter_add_value	call site: 00016	printf
1	20	ndpi_jitter_free	call site: 00020

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

11

Reachable functions

23

Percentage of reachable functions covered

52.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_jitter.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	5

Fuzzer: fuzz_alg_ses_des

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	27.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	39	72.2%
All colors	54	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	14	ndpi_ses_init	call site: 00014
3	25	ndpi_ses_fitting	call site: 00025	printf
3	37	ndpi_des_fitting	call site: 00037	printf
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	20	ndpi_normal_cdf_inverse	call site: 00020	printf
1	23	ndpi_ses_add_value	call site: 00023	printf
1	32	ndpi_des_init	call site: 00032	printf
1	35	ndpi_des_add_value	call site: 00035	printf
1	41	LLVMFuzzerTestOneInput	call site: 00041

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

15

Reachable functions

33

Percentage of reachable functions covered

54.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_ses_des.cpp	17
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_analyze.c	11

Fuzzer: fuzz_filecfg_category

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	133	9.25%
gold	[1:9]	15	1.04%
yellow	[10:29]	2	0.13%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1287	89.5%
All colors	1437	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
6	1337	ndpi_patricia_lookup	call site: 01337	fprintf
6	1350	ndpi_patricia_lookup	call site: 01350	fprintf
5	1390	ndpi_encode_domain	call site: 01390	ndpi_hash_find_entry
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	80	node_release	call site: 00080	acho_free
4	1248	init_string_based_protocols	call site: 01248	NDPI_LOG_ERR
4	1316	add_to_ptree	call site: 01316	fprintf
4	1430	ndpi_hash_add_entry	call site: 01430	ndpi_hash_add_entry
3	75	ac_automata_walk	call site: 00075

Runtime coverage analysis

Covered functions

80

Functions that are reachable but not covered

72

Reachable functions

139

Percentage of reachable functions covered

48.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_category.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	72
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	24
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	12
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	3
ndpilib/ndpi_domains.c	3
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_quic_get_crypto_data

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	597	17.7%
gold	[1:9]	1985	58.9%
yellow	[10:29]	60	1.78%
greenyellow	[30:49]	11	0.32%
lawngreen	50+	715	21.2%
All colors	3368	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
32	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
26	2769	ndpi_lru_add_to_cache	call site: 02769	ndpi_set_risk
26	3144	processClientServerHello	call site: 03144	ndpi_cache_find_hostname_ip
25	1313	ndpi_load_categories_dir	call site: 01313	_wopendir
22	3341	ndpi_free_flow_data	call site: 03341	ndpi_free
19	74	ac_automata_walk	call site: 00074	ac_automata_release
17	3306	ndpi_free_flow_data	call site: 03306	ndpi_free
15	2699	ndpi_patricia_search_best2	call site: 02699	fprintf
10	2755	ndpi_handle_risk_exceptions	call site: 02755	ndpi_check_ipv6_exception
9	1585	node_resize_mp	call site: 01585	node_resize_mp
9	2816	proto_stack_update	call site: 02816	ookla_add_to_cache

Runtime coverage analysis

Covered functions

510

Functions that are reachable but not covered

163

Reachable functions

652

Percentage of reachable functions covered

75.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_quic_get_crypto_data.c	10
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	459
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	50
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	20
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	2
ndpilib/ndpi_bitmap.c	4
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	51
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	7
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	41
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	1
ndpi/windowsndpi_define.h	1
ndpilib/third_partyndpi_md5.c	6
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_binaryfusefilter

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	135	84.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	15.0%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	28	LLVMFuzzerTestOneInput	call site: 00028	ndpi_free
48	99	LLVMFuzzerTestOneInput	call site: 00099	ndpi_free
17	10	LLVMFuzzerTestOneInput	call site: 00010	binary_fuse_calculate_size_factor
5	85	LLVMFuzzerTestOneInput	call site: 00085	binary_fuse_mix_split
4	94	LLVMFuzzerTestOneInput	call site: 00094	binary_fuse_calculate_size_factor
4	150	LLVMFuzzerTestOneInput	call site: 00150	binary_fuse_mix_split
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	92	LLVMFuzzerTestOneInput	call site: 00092	ndpi_free
1	156	LLVMFuzzerTestOneInput	call site: 00156	ndpi_free

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

33

Reachable functions

42

Percentage of reachable functions covered

21.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_binaryfusefilter.cpp	13
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_party/include/binaryfusefilter.h	22

Fuzzer: fuzz_ds_address_cache

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	3.22%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.07%
lawngreen	50+	89	95.6%
All colors	93	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	22	ndpi_init_address_cache	call site: 00022
1	26	ndpi_init_address_cache	call site: 00026
1	28	ndpi_init_address_cache	call site: 00028

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

25

Reachable functions

49

Percentage of reachable functions covered

48.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_address_cache.cpp	18
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_cache.c	24
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_alg_memmem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	6.45%
gold	[1:9]	1	3.22%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	28	90.3%
All colors	31	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	19	LLVMFuzzerTestOneInput	call site: 00019

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

10

Reachable functions

14

Percentage of reachable functions covered

28.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_memmem.cpp	9
ndpilib/ndpi_main.c	5

Fuzzer: fuzz_readerutils_workflow

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	858	20.8%
gold	[1:9]	150	3.63%
yellow	[10:29]	20	0.48%
greenyellow	[30:49]	25	0.60%
lawngreen	50+	3069	74.4%
All colors	4122	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
77	2707	packet_processing	call site: 02707	ndpi_classify
61	4008	process_ndpi_collected_info	call site: 04008	dump_flow_fingerprint
30	3799	ndpi_dpi2json	call site: 03799	ndpi_serialize_string_uint32
25	1291	ndpi_load_protocols_dir	call site: 01291	_wopendir
17	3931	ndpi_dpi2json	call site: 03931	ndpi_serialize_string_uint32
15	3013	ndpi_patricia_search_best2	call site: 03013	fprintf
15	3911	ndpi_dpi2json	call site: 03911	ndpi_serialize_string_uint32
14	132	ndpi_exit_detection_module	call site: 00132	ndpi_term_address_cache
14	3550	ndpi_is_number	call site: 03550	ndpi_serialize_uint32_uint32
13	3339	ndpi_detection_giveup	call site: 03339	ndpi_set_detected_protocol
13	3846	ndpi_dpi2json	call site: 03846
12	1455	ndpi_workflow_init	call site: 01455	load_public_lists

Runtime coverage analysis

Covered functions

1389

Functions that are reachable but not covered

210

Reachable functions

822

Percentage of reachable functions covered

74.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_readerutils_workflow.cpp	22
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	486
ndpi/tests/performance/gcrypt.c	3
ndpi/example/reader_util.c	123
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	121
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	17
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/third_partyshoco.c	8
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_analyze.c	7
ndpilib/ndpi_serializer.c	40
ndpilib/ndpi_classify.c	12
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_gcrypt_aes

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	2.32%
gold	[1:9]	8	6.20%
yellow	[10:29]	30	23.2%
greenyellow	[30:49]	9	6.97%
lawngreen	50+	79	61.2%
All colors	129	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	24	mbedtls_aesni_has_support	call site: 00024
1	18	aes_gen_tables	call site: 00018

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

35

Reachable functions

51

Percentage of reachable functions covered

31.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_aes.cpp	13
ndpilib/third_partygcrypt/aes.c	30
ndpilib/third_partygcrypt/aesni.c	12

Fuzzer: fuzz_gcrypt_gcm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	9.58%
gold	[1:9]	3	1.79%
yellow	[10:29]	7	4.19%
greenyellow	[30:49]	4	2.39%
lawngreen	50+	137	82.0%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	70	mbedtls_gcm_update	call site: 00070
2	86	mbedtls_aesni_has_support	call site: 00086
2	115	mbedtls_gcm_update_ad	call site: 00115	gcm_mult
1	37	mbedtls_cipher_setkey	call site: 00037
1	48	mbedtls_cipher_update	call site: 00048	mbedtls_gcm_update
1	59	gcm_mult	call site: 00059	gcm_mask
1	61	gcm_mask	call site: 00061	mbedtls_platform_zeroize
1	64	gcm_mask	call site: 00064	gcm_mult
1	80	gcm_gen_table	call site: 00080
1	124	mbedtls_gcm_finish	call site: 00124	gcm_mult

Runtime coverage analysis

Covered functions

36

Functions that are reachable but not covered

32

Reachable functions

55

Percentage of reachable functions covered

41.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_gcm.cpp	18
ndpilib/third_partygcrypt/gcm.c	24
ndpilib/third_partygcrypt/cipher.c	8
ndpilib/third_party/include/gcrypt/cipher.h	1
ndpilib/third_partygcrypt/aesni.c	8

Fuzzer: fuzz_filecfg_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	6.65%
gold	[1:9]	11	0.84%
yellow	[10:29]	4	0.30%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1205	92.1%
All colors	1307	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
6	90	ndpi_exit_detection_module	call site: 00090	ndpi_hash_free
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	80	node_release	call site: 00080	acho_free
4	1248	init_string_based_protocols	call site: 01248	NDPI_LOG_ERR
3	75	ac_automata_walk	call site: 00075
3	86	ac_automata_release	call site: 00086	ac_automata_release
2	106	ndpi_exit_detection_module	call site: 00106	ndpi_free

Runtime coverage analysis

Covered functions

71

Functions that are reachable but not covered

57

Reachable functions

107

Percentage of reachable functions covered

46.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_config.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	61
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	12
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	12
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_ds_kdtree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	5.15%
gold	[1:9]	2	2.06%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	90	92.7%
All colors	97	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	11	LLVMFuzzerTestOneInput	call site: 00011
1	68	kd_nearest	call site: 00068	kd_res_free
1	74	LLVMFuzzerTestOneInput	call site: 00074	printf
1	88	clear_rec	call site: 00088

Runtime coverage analysis

Covered functions

39

Functions that are reachable but not covered

18

Reachable functions

54

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_kdtree.cpp	18
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_analyze.c	9
ndpilib/third_partykdtree.c	20

Fuzzer: fuzz_alg_hll

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	8.88%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	91.1%
All colors	45	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	hll_init	call site: 00012
1	27	hll_count	call site: 00027
1	42	hll_destroy	call site: 00042

Runtime coverage analysis

Covered functions

26

Functions that are reachable but not covered

13

Reachable functions

36

Percentage of reachable functions covered

63.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_hll.cpp	15
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	5
ndpilib/third_partyhll/hll.c	7
ndpilib/third_partyhll/MurmurHash3.c	1

Fuzzer: fuzz_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	398	9.12%
gold	[1:9]	67	1.53%
yellow	[10:29]	39	0.89%
greenyellow	[30:49]	28	0.64%
lawngreen	50+	3829	87.8%
All colors	4361	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
25	1572	ndpi_load_categories_dir	call site: 01572	_wopendir
20	4275	ndpi_free_flow_data	call site: 04275	ndpi_free
19	4122	ndpi_serialize_uint32_binary	call site: 04122	ndpi_serializer_header_uint32
15	3171	ndpi_patricia_search_best2	call site: 03171	fprintf
12	1609	ndpi_load_categories_dir	call site: 01609	ndpi_load_category_file
11	4061	ndpi_detection_giveup	call site: 04061	ndpi_set_detected_protocol
10	3729	internal_giveup	call site: 03729	ndpi_fill_protocol_category
10	4015	ndpi_reconcile_protocols	call site: 04015	ndpi_set_risk
10	4228	LLVMFuzzerTestOneInput	call site: 04228	ndpi_min
7	51	ndpi_exit_detection_module	call site: 00051	cache_free
7	1442	node_resize_mp	call site: 01442	node_resize_mp
7	1598	ndpi_load_categories_dir	call site: 01598	readdir_r

Runtime coverage analysis

Covered functions

1328

Functions that are reachable but not covered

188

Reachable functions

811

Percentage of reachable functions covered

76.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_config.cpp	139
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_main.c	543
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	68
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	14
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	8
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	5
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/third_partyndpi_sha256.c	8
ndpilib/ndpi_analyze.c	2
ndpilib/ndpi_serializer.c	26
ndpilib/protocols/tcp_udp.c	5
ndpilib/ndpi_classify.c	5
ndpilib/third_partywindows/gettimeofday.c	2

Fuzzer: ndpi/fuzz/fuzz_is_stun.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	635	16.2%
gold	[1:9]	2020	51.6%
yellow	[10:29]	104	2.65%
greenyellow	[30:49]	38	0.97%
lawngreen	50+	1114	28.4%
All colors	3911	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	3587	processCertificateElements	call site: 03587	strptime
25	1313	ndpi_load_categories_dir	call site: 01313	_wopendir
15	2778	ndpi_patricia_search_best2	call site: 02778	fprintf
10	105	ndpi_exit_detection_module	call site: 00105	ndpi_term_address_cache
10	3670	processCertificateElements	call site: 03670	ndpi_set_risk
9	1585	node_resize_mp	call site: 01585	node_resize_mp
9	3273	ndpi_bitmap_isset	call site: 03273	ndpi_set_risk
9	3797	ookla_search_into_cache	call site: 03797	ndpi_set_detected_protocol
7	52	ndpi_lru_free_cache	call site: 00052	ndpi_lru_free_cache
7	1339	ndpi_load_categories_dir	call site: 01339	readdir_r
7	3070	processClientServerHello	call site: 03070	printf
7	3283	processClientServerHello	call site: 03283	printf

Runtime coverage analysis

Covered functions

2204

Functions that are reachable but not covered

148

Reachable functions

719

Percentage of reachable functions covered

79.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_is_stun.c	3
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	458
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	57
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	20
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	2
ndpilib/ndpi_bitmap.c	4
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	108
ndpilib/protocols/rtp.c	5
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	51
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	9
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	8
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	2
ndpilib/third_partyndpi_md5.c	6
ndpi/windowsndpi_define.h	1
ndpilib/third_partyndpi_sha256.c	8
ndpilib/third_partyndpi_sha1.c	10
ndpilib/third_partystrptime.c	7
ndpilib/ndpi_analyze.c	3

Fuzzer: json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	261	97.7%
gold	[1:9]	2	0.74%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	4	1.49%
All colors	267	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
245	0	EP	call site: 00000	json_tokener_parse_ex
12	247	LLVMFuzzerTestOneInput	call site: 00247	json_object_to_json_string_ext
4	262	LLVMFuzzerTestOneInput	call site: 00262	json_tokener_reset

Runtime coverage analysis

Covered functions

2204

Functions that are reachable but not covered

109

Reachable functions

110

Percentage of reachable functions covered

0.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc	8
json-c-json-c-0.17-20230812/json_tokener.c	47
json-c-json-c-0.17-20230812/printbuf.c	3
json-c-json-c-0.17-20230812/json_object.c	48
json-c-json-c-0.17-20230812/linkhash.c	8
json-c-json-c-0.17-20230812/arraylist.c	4
json-c-json-c-0.17-20230812/json_util.c	2
json-c-json-c-0.17-20230812/linkhash.h	1