High level conclusions

Fuzzers reach 51.97% code coverage.

Fuzzers reach 38.78% of cyclomatic complexity.

Fuzzers reach 37.47% of all functions.

Fuzzer json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc is blocked:

The runtime code coverage of json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc covers 0.909% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_alg_memmem is blocked:

The runtime code coverage of fuzz_alg_memmem covers 28.57% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_binaryfusefilter is blocked:

The runtime code coverage of fuzz_binaryfusefilter covers 21.42% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_gcrypt_cipher is blocked:

The runtime code coverage of fuzz_gcrypt_cipher covers 18.75% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1538 / 4104

Cyclomatic complexity statically reachable by fuzzers

7248 / 18687

Runtime code coverage of functions

2133 / 4104

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_alg_bins

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	14.5%
gold	[1:9]	4	2.91%
yellow	[10:29]	1	0.72%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	112	81.7%
All colors	137	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	125	ndpi_cluster_bins	call site: 00125	printf
3	27	ndpi_bin_similarity	call site: 00027	ndpi_get_bin_value
3	121	ndpi_cluster_bins	call site: 00121	ndpi_print_bin
2	112	ndpi_cluster_bins	call site: 00112	ndpi_print_bin
2	115	ndpi_cluster_bins	call site: 00115	printf
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	ndpi_init_bin	call site: 00012
1	40	ndpi_clone_bin	call site: 00040
1	76	ndpi_snprintf	call site: 00076
1	105	ndpi_cluster_bins	call site: 00105	printf

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

23

Reachable functions

45

Percentage of reachable functions covered

48.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_bins.cpp	21
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	20
ndpilib/ndpi_utils.c	5

Fuzzer: fuzz_ds_patricia

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	24.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.36%
greenyellow	[30:49]	1	0.36%
lawngreen	50+	206	74.6%
All colors	276	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	221	ndpi_patricia_search_best2	call site: 00221	fprintf
9	154	ndpi_patricia_search_exact	call site: 00154	fprintf
6	52	ndpi_patricia_lookup	call site: 00052	fprintf
6	65	ndpi_patricia_lookup	call site: 00065	fprintf
4	30	LLVMFuzzerTestOneInput	call site: 00030	fprintf
3	47	ndpi_patricia_lookup	call site: 00047	fprintf
2	60	ndpi_patricia_lookup	call site: 00060	fprintf
2	72	ndpi_patricia_lookup	call site: 00072	fprintf
2	81	ndpi_patricia_lookup	call site: 00081	fprintf
2	85	ndpi_patricia_lookup	call site: 00085	fprintf
2	96	ndpi_patricia_lookup	call site: 00096	fprintf
2	169	ndpi_patricia_search_exact	call site: 00169	fprintf

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

23

Reachable functions

60

Percentage of reachable functions covered

61.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_patricia.cpp	28
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partyndpi_patricia.c	25
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_main.c	2

Fuzzer: fuzz_alg_shoco

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	23	100.%
All colors	23	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

5

Reachable functions

13

Percentage of reachable functions covered

61.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_shoco.cpp	9
ndpilib/third_partyshoco.c	9
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_ds_ptree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	29.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.53%
lawngreen	50+	131	70.0%
All colors	187	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	69	ndpi_patricia_search_best2	call site: 00069	fprintf
6	110	ndpi_patricia_lookup	call site: 00110	fprintf
6	123	ndpi_patricia_lookup	call site: 00123	fprintf
4	64	ndpi_patricia_search_best2	call site: 00064	fprintf
2	21	ndpi_DeleteEntry	call site: 00021
2	88	ndpi_patricia_search_best2	call site: 00088	fprintf
2	91	ndpi_ptree_insert	call site: 00091	fprintf
2	103	ndpi_New_Prefix2	call site: 00103	ndpi_calloc
2	106	ndpi_patricia_lookup	call site: 00106	fprintf
2	118	ndpi_patricia_lookup	call site: 00118	fprintf
2	130	ndpi_patricia_lookup	call site: 00130	fprintf
2	139	ndpi_patricia_lookup	call site: 00139	fprintf

Runtime coverage analysis

Covered functions

37

Functions that are reachable but not covered

35

Reachable functions

69

Percentage of reachable functions covered

49.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_ptree.cpp	16
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_main.c	24
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	5

Fuzzer: fuzz_ds_bitmap

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	23	25.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	68	74.7%
All colors	91	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	43	ndpi_bitmap_serialize	call site: 00043
1	6	LLVMFuzzerTestOneInput	call site: 00006
1	11	LLVMFuzzerTestOneInput	call site: 00011
1	17	LLVMFuzzerTestOneInput	call site: 00017
1	21	LLVMFuzzerTestOneInput	call site: 00021
1	26	LLVMFuzzerTestOneInput	call site: 00026
1	31	LLVMFuzzerTestOneInput	call site: 00031
1	34	LLVMFuzzerTestOneInput	call site: 00034
1	37	LLVMFuzzerTestOneInput	call site: 00037
1	40	LLVMFuzzerTestOneInput	call site: 00040
1	47	LLVMFuzzerTestOneInput	call site: 00047
1	50	LLVMFuzzerTestOneInput	call site: 00050

Runtime coverage analysis

Covered functions

309

Functions that are reachable but not covered

24

Reachable functions

77

Percentage of reachable functions covered

68.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_bitmap.cpp	25
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_bitmap.c	43
ndpi/tests/performance/gcrypt.c	2

Fuzzer: fuzz_alg_crc32_md5

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	1.55%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.77%
lawngreen	50+	126	97.6%
All colors	129	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	108	LLVMFuzzerTestOneInput	call site: 00108
1	118	LLVMFuzzerTestOneInput	call site: 00118

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

14

Reachable functions

42

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_crc32_md5.c	25
ndpilib/ndpi_analyze.c	3
ndpilib/ndpi_main.c	3
ndpilib/third_partyndpi_md5.c	6
ndpilib/ndpi_hash.c	3
ndpilib/third_partyhll/MurmurHash3.c	1
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_community_id

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	6.87%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.62%
lawngreen	50+	148	92.5%
All colors	160	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	130	ndpi_base64_encode	call site: 00130	printf
1	13	LLVMFuzzerTestOneInput	call site: 00013
1	120	SHA1Transform	call site: 00120	SHA1Transform
1	140	ndpi_community_id_finalize_and_compute_hash	call site: 00140

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

27

Reachable functions

49

Percentage of reachable functions covered

44.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_community_id.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_community_id.c	20
ndpilib/third_partyndpi_sha1.c	10
ndpilib/ndpi_utils.c	1

Fuzzer: fuzz_tls_certificate

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	572	18.8%
gold	[1:9]	2001	65.8%
yellow	[10:29]	45	1.48%
greenyellow	[30:49]	14	0.46%
lawngreen	50+	407	13.3%
All colors	3039	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	2626	processCertificateElements	call site: 02626	strptime
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
32	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
27	2867	ndpi_lru_add_to_cache	call site: 02867	ndpi_set_risk
26	3012	ndpi_free_flow_data	call site: 03012	ndpi_free
25	1393	ndpi_load_categories_dir	call site: 01393	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
17	2977	ndpi_free_flow_data	call site: 02977	ndpi_free
15	2797	ndpi_patricia_search_best2	call site: 02797	fprintf
10	2709	processCertificateElements	call site: 02709	ndpi_set_risk
9	2906	proto_stack_update	call site: 02906	ookla_add_to_cache
7	1327	node_resize_mp	call site: 01327	node_resize_mp

Runtime coverage analysis

Covered functions

466

Functions that are reachable but not covered

154

Reachable functions

600

Percentage of reachable functions covered

74.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_tls_certificate.c	7
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	445
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	49
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	9
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	36
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/third_partystrptime.c	7

Fuzzer: fuzz_ds_cmsketch

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	18.7%
gold	[1:9]	1	3.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	78.1%
All colors	32	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	15	ndpi_cm_sketch_init	call site: 00015	printf
1	11	ndpi_cm_sketch_init	call site: 00011
1	18	ndpi_cm_sketch_init	call site: 00018
1	21	ndpi_cm_sketch_add	call site: 00021	printf
1	25	ndpi_cm_sketch_count	call site: 00025	printf

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

12

Reachable functions

26

Percentage of reachable functions covered

53.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_cmsketch.cpp	9
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_analyze.c	7
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_filecfg_categories

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	9.27%
gold	[1:9]	15	0.98%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1362	89.6%
All colors	1520	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
7	1331	node_resize_mp	call site: 01331	node_resize_mp
6	1420	ndpi_patricia_lookup	call site: 01420	fprintf
6	1433	ndpi_patricia_lookup	call site: 01433	fprintf
5	1362	ndpi_set_config	call site: 01362	ndpi_str_endswith
5	1473	ndpi_encode_domain	call site: 01473	ndpi_hash_find_entry
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1254	init_string_based_protocols	call site: 01254	NDPI_LOG_ERR
4	1399	add_to_ptree	call site: 01399	fprintf
4	1513	ndpi_hash_add_entry	call site: 01513	ndpi_hash_add_entry

Runtime coverage analysis

Covered functions

105

Functions that are reachable but not covered

82

Reachable functions

175

Percentage of reachable functions covered

53.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_categories.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	88
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	25
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	32
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	3
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_filecfg_risk_domains

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	95	6.84%
gold	[1:9]	13	0.93%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1279	92.1%
All colors	1388	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
6	90	ndpi_exit_detection_module	call site: 00090	ndpi_hash_free
5	1360	ndpi_set_config	call site: 01360	ndpi_str_endswith
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1254	init_string_based_protocols	call site: 01254	NDPI_LOG_ERR
2	86	ac_automata_release	call site: 00086	acho_free
2	106	ndpi_exit_detection_module	call site: 00106	ndpi_free
2	176	ndpi_realloc	call site: 00176	ndpi_free

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

66

Reachable functions

142

Percentage of reachable functions covered

53.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_risk_domains.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	75
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	12
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	33
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4

Fuzzer: fuzz_ds_ahocorasick

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	18	9.67%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	168	90.3%
All colors	186	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	53	xmemchr	call site: 00053	DETECTNULL
2	181	ac_automata_release	call site: 00181	acho_free
1	10	ac_automata_init	call site: 00010
1	14	ac_automata_init	call site: 00014
1	17	LLVMFuzzerTestOneInput	call site: 00017	ac_automata_init
1	38	ndpi_strdup	call site: 00038
1	58	xmemchr	call site: 00058
1	89	node_resize_mp	call site: 00089
1	96	LLVMFuzzerTestOneInput	call site: 00096
1	112	ac_automata_walk	call site: 00112
1	124	LLVMFuzzerTestOneInput	call site: 00124	printf
1	129	node_findbs_next	call site: 00129	node_findbs_next

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

32

Reachable functions

81

Percentage of reachable functions covered

60.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_ahocorasick.cpp	31
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partyahocorasick.c	40
ndpilib/ndpi_main.c	12
ndpilib/ndpi_memory.c	3
ndpi/tests/performance/gcrypt.c	2

Fuzzer: fuzz_alg_strnstr

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	10.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	89.4%
All colors	19	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	4	LLVMFuzzerTestOneInput	call site: 00004

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

7

Reachable functions

12

Percentage of reachable functions covered

41.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_strnstr.cpp	8
ndpi/tests/performance/strnstr.cpp	2
ndpilib/ndpi_utils.c	2

Fuzzer: fuzz_ds_bitmap64_fuse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	13.2%
gold	[1:9]	7	5.78%
yellow	[10:29]	1	0.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	97	80.1%
All colors	121	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	65	binary_fuse16_populate	call site: 00065	binary_fuse_rng_splitmix64
3	22	binary_fuse_calculate_segment_length	call site: 00022
3	29	binary_fuse_calculate_size_factor	call site: 00029	binary_fuse_max
1	7	ndpi_bitmap64_fuse_alloc	call site: 00007
1	9	ndpi_bitmap64_fuse_alloc	call site: 00009
1	11	ndpi_bitmap64_fuse_alloc	call site: 00011
1	16	ndpi_bitmap64_fuse_compress	call site: 00016	printf
1	38	binary_fuse_rng_splitmix64	call site: 00038	UINT64_C
1	60	binary_fuse_murmur64	call site: 00060	UINT64_C

Runtime coverage analysis

Covered functions

36

Functions that are reachable but not covered

15

Reachable functions

47

Percentage of reachable functions covered

68.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_bitmap64_fuse.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_bitmap64_fuse.c	13
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_party/include/binaryfusefilter.h	19
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_filecfg_malicious_ja4

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	100	7.17%
gold	[1:9]	13	0.93%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1279	91.8%
All colors	1393	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
7	1331	node_resize_mp	call site: 01331	node_resize_mp
5	1360	ndpi_set_config	call site: 01360	ndpi_str_endswith
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1254	init_string_based_protocols	call site: 01254	NDPI_LOG_ERR
3	86	ac_automata_release	call site: 00086	ac_automata_release
2	94	ndpi_hash_free	call site: 00094	ndpi_hash_free
2	106	ndpi_exit_detection_module	call site: 00106	ndpi_free

Runtime coverage analysis

Covered functions

86

Functions that are reachable but not covered

70

Reachable functions

143

Percentage of reachable functions covered

51.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_malicious_ja4.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	76
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	16
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	32
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4

Fuzzer: fuzz_ds_hash

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	6.66%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	42	93.3%
All colors	45	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	15	ndpi_hash_add_entry	call site: 00015
1	17	ndpi_hash_add_entry	call site: 00017
1	19	ndpi_hash_add_entry	call site: 00019

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

17

Reachable functions

30

Percentage of reachable functions covered

43.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_hash.cpp	13
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_utils.c	7
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_process_packet

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	525	14.3%
gold	[1:9]	2130	58.4%
yellow	[10:29]	117	3.20%
greenyellow	[30:49]	36	0.98%
lawngreen	50+	839	23.0%
All colors	3647	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
32	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
25	1393	ndpi_load_categories_dir	call site: 01393	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
15	2796	ndpi_patricia_search_best2	call site: 02796	fprintf
14	3205	ndpi_serialize_binary_uint32	call site: 03205	ndpi_serialize_uint32_uint32
14	3303	ndpi_serialize_binary_float	call site: 03303	ndpi_serialize_uint32_float
11	2714	internal_giveup	call site: 02714	ndpi_fill_protocol_category_and_breed
11	3162	ndpi_serialize_uint32_binary	call site: 03162	ndpi_serialize_key_uint32
10	2900	ndpi_internal_detection_process_packet	call site: 02900	fully_enc_heuristic
9	3099	ookla_search_into_cache	call site: 03099	ndpi_set_detected_protocol
9	3224	ndpi_serialize_binary_uint32	call site: 03224	ndpi_serializer_header_string

Runtime coverage analysis

Covered functions

1486

Functions that are reachable but not covered

171

Reachable functions

727

Percentage of reachable functions covered

76.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_process_packet.c	9
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	511
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	96
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	9
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	40
ndpilib/third_partyndpi_sha256.c	8
ndpilib/ndpi_analyze.c	2

Fuzzer: fuzz_ds_libcache

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	4.22%
gold	[1:9]	1	1.40%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	67	94.3%
All colors	71	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	cache_new	call site: 00008
1	11	cache_new	call site: 00011
1	26	cache_add	call site: 00026

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

16

Reachable functions

33

Percentage of reachable functions covered

51.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_libcache.cpp	14
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partylibcache.c	9
ndpi/tests/performance/gcrypt.c	3

Fuzzer: fuzz_serialization

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	19	3.32%
gold	[1:9]	1	0.17%
yellow	[10:29]	4	0.70%
greenyellow	[30:49]	3	0.52%
lawngreen	50+	544	95.2%
All colors	571	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	183	ndpi_serialize_binary_uint32	call site: 00183	ndpi_serializer_header_string
3	312	ndpi_serialize_binary_double	call site: 00312	ndpi_serialize_single_string
2	128	ndpi_serialize_uint32_double	call site: 00128	ndpi_serialize_key_uint32
1	13	ndpi_init_serializer_buffer	call site: 00013
1	17	ndpi_term_serializer	call site: 00017
1	23	ndpi_snprintf	call site: 00023
1	36	ndpi_realloc	call site: 00036
1	471	ndpi_deserialize_key_string	call site: 00471
1	481	ndpi_deserialize_key_uint32	call site: 00481
1	483	ndpi_deserialize_key_uint32	call site: 00483
1	501	ndpi_deserialize_value_uint64	call site: 00501	ndpi_deserialize_value_uint32
1	514	ndpi_deserialize_value_int32	call site: 00514

Runtime coverage analysis

Covered functions

116

Functions that are reachable but not covered

30

Reachable functions

143

Percentage of reachable functions covered

79.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_serialization.cpp	67
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_serializer.c	86
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_utils.c	5
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_ndpi_reader_pl7m_64k

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	699	16.0%
gold	[1:9]	2064	47.3%
yellow	[10:29]	89	2.04%
greenyellow	[30:49]	32	0.73%
lawngreen	50+	1475	33.8%
All colors	4359	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
44	4314	LLVMFuzzerTestOneInput	call site: 04314	ndpi_report_payload_stats
35	34	ndpi_patricia_destroy	call site: 00034	ndpi_exit_detection_module
35	4266	process_ndpi_collected_info	call site: 04266	dump_flow_fingerprint
29	2936	packet_processing	call site: 02936	ndpi_payload_analyzer
25	1356	ndpi_load_protocols_dir	call site: 01356	_wopendir
21	101	ndpi_domain_classify_free	call site: 00101	ac_automata_release
19	3604	ndpi_serialize_uint32_binary	call site: 03604	ndpi_serializer_header_uint32
15	3248	ndpi_patricia_search_best2	call site: 03248	fprintf
14	3783	ndpi_is_number	call site: 03783	ndpi_serialize_uint32_uint32
13	80	ac_automata_walk	call site: 00080	ac_automata_release
13	3960	ndpi_serialize_binary_float	call site: 03960	ndpi_serialize_uint32_float
10	3771	ndpi_serialize_string_uint32	call site: 03771	ndpi_serializer_header_string

Runtime coverage analysis

Covered functions

1726

Functions that are reachable but not covered

223

Reachable functions

858

Percentage of reachable functions covered

74.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ndpi_reader_pl7m_64k.c	33
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	518
ndpi/tests/performance/gcrypt.c	3
ndpi/example/reader_util.c	124
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	123
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	12
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_analyze.c	7
ndpilib/ndpi_serializer.c	40
ndpilib/ndpi_classify.c	16
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_gcrypt_cipher

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	60	37.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.62%
greenyellow	[30:49]	27	16.9%
lawngreen	50+	71	44.6%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	91	mbedtls_cipher_update	call site: 00091	mbedtls_gcm_update
18	66	mbedtls_cipher_set_iv	call site: 00066	mbedtls_gcm_starts
8	121	mbedtls_cipher_finish	call site: 00121	mbedtls_cipher_get_iv_size
5	147	LLVMFuzzerTestOneInput	call site: 00147
1	30	LLVMFuzzerTestOneInput	call site: 00030	MBEDTLS_INTERNAL_VALIDATE_RET
1	32	LLVMFuzzerTestOneInput	call site: 00032	MBEDTLS_INTERNAL_VALIDATE_RET
1	34	LLVMFuzzerTestOneInput	call site: 00034	MBEDTLS_INTERNAL_VALIDATE_RET
1	36	LLVMFuzzerTestOneInput	call site: 00036	MBEDTLS_INTERNAL_VALIDATE_RET
1	38	LLVMFuzzerTestOneInput	call site: 00038	MBEDTLS_INTERNAL_VALIDATE_RET
1	40	LLVMFuzzerTestOneInput	call site: 00040	MBEDTLS_INTERNAL_VALIDATE_RET

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

52

Reachable functions

64

Percentage of reachable functions covered

18.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_cipher.cpp	39
ndpilib/third_partygcrypt/cipher.c	19
ndpilib/third_party/include/gcrypt/cipher.h	1
ndpilib/third_partygcrypt/gcm.c	13

Fuzzer: fuzz_filecfg_protocols

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	125	7.81%
gold	[1:9]	13	0.81%
yellow	[10:29]	2	0.12%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1459	91.1%
All colors	1600	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
11	118	ndpi_exit_detection_module	call site: 00118	ndpi_term_address_cache
7	109	ndpi_exit_detection_module	call site: 00109	ndpi_hash_free
7	1331	node_resize_mp	call site: 01331	node_resize_mp
6	1437	ndpi_patricia_lookup	call site: 01437	fprintf
6	1450	ndpi_patricia_lookup	call site: 01450	fprintf
5	1360	ndpi_set_config	call site: 01360	ndpi_str_endswith
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1254	init_string_based_protocols	call site: 01254	NDPI_LOG_ERR
4	1416	add_to_ptree	call site: 01416	fprintf
4	1535	ndpi_handle_rule	call site: 01535	NDPI_LOG_ERR

Runtime coverage analysis

Covered functions

105

Functions that are reachable but not covered

91

Reachable functions

183

Percentage of reachable functions covered

50.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_protocols.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	108
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	17
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	32
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4

Fuzzer: fuzz_alg_bytestream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	14.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	6	85.7%
All colors	7	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	5	ntohs_ndpi_bytestream_to_number	call site: 00005

Runtime coverage analysis

Covered functions

5

Functions that are reachable but not covered

1

Reachable functions

6

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_bytestream.c	4
ndpilib/ndpi_main.c	3

Fuzzer: fuzz_ndpi_reader

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	698	16.0%
gold	[1:9]	2076	47.6%
yellow	[10:29]	94	2.15%
greenyellow	[30:49]	29	0.66%
lawngreen	50+	1462	33.5%
All colors	4359	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
44	4314	LLVMFuzzerTestOneInput	call site: 04314	ndpi_report_payload_stats
35	34	ndpi_patricia_destroy	call site: 00034	ndpi_exit_detection_module
35	4266	process_ndpi_collected_info	call site: 04266	dump_flow_fingerprint
32	101	ndpi_domain_classify_free	call site: 00101	ac_automata_release
29	2936	packet_processing	call site: 02936	ndpi_payload_analyzer
25	1356	ndpi_load_protocols_dir	call site: 01356	_wopendir
19	3604	ndpi_serialize_uint32_binary	call site: 03604	ndpi_serializer_header_uint32
15	3248	ndpi_patricia_search_best2	call site: 03248	fprintf
14	3783	ndpi_is_number	call site: 03783	ndpi_serialize_uint32_uint32
13	80	ac_automata_walk	call site: 00080	ac_automata_release
13	3960	ndpi_serialize_binary_float	call site: 03960	ndpi_serialize_uint32_float
10	3771	ndpi_serialize_string_uint32	call site: 03771	ndpi_serializer_header_string

Runtime coverage analysis

Covered functions

1725

Functions that are reachable but not covered

224

Reachable functions

858

Percentage of reachable functions covered

73.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ndpi_reader.c	33
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	518
ndpi/tests/performance/gcrypt.c	3
ndpi/example/reader_util.c	124
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	123
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	12
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_analyze.c	7
ndpilib/ndpi_serializer.c	40
ndpilib/ndpi_classify.c	16
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_ds_filter

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9	18.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	82.0%
All colors	50	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	36	ndpi_bitmap_serialize	call site: 00036
1	7	ndpi_filter_alloc	call site: 00007
1	13	ndpi_filter_add	call site: 00013
1	24	ndpi_filter_contains	call site: 00024
1	33	ndpi_filter_size	call site: 00033
1	40	ndpi_filter_size	call site: 00040
1	43	ndpi_filter_cardinality	call site: 00043
1	47	ndpi_filter_free	call site: 00047

Runtime coverage analysis

Covered functions

152

Functions that are reachable but not covered

13

Reachable functions

45

Percentage of reachable functions covered

71.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_filter.cpp	13
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_filter.c	10
ndpilib/ndpi_bitmap.c	15
ndpi/tests/performance/gcrypt.c	2

Fuzzer: fuzz_ds_tree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	4.87%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	39	95.1%
All colors	41	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	15	LLVMFuzzerTestOneInput	call site: 00015

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

8

Reachable functions

23

Percentage of reachable functions covered

65.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_tree.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_utils.c	4

Fuzzer: fuzz_alg_hw_rsi_outliers_da

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	8.14%
gold	[1:9]	0	0.0%
yellow	[10:29]	4	2.96%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	120	88.8%
All colors	135	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	62	LLVMFuzzerTestOneInput	call site: 00062	printf
3	26	ndpi_hw_init	call site: 00026
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	12	LLVMFuzzerTestOneInput	call site: 00012
1	33	ndpi_hw_init	call site: 00033
1	60	ndpi_hw_add_value	call site: 00060	printf

Runtime coverage analysis

Covered functions

47

Functions that are reachable but not covered

17

Reachable functions

61

Percentage of reachable functions covered

72.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_hw_rsi_outliers_da.cpp	39
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	26

Fuzzer: fuzz_alg_quick_encryption

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	15.3%
gold	[1:9]	2	1.92%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	82.6%
All colors	104	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	72	InvMixColumns	call site: 00072
2	58	ndpi_quick_decrypt	call site: 00058	ndpi_free
1	10	ndpi_quick_encrypt	call site: 00010
1	42	ndpi_base64_encode	call site: 00042
1	44	ndpi_quick_encrypt	call site: 00044
1	55	ndpi_base64_decode	call site: 00055	ndpi_free

Runtime coverage analysis

Covered functions

32

Functions that are reachable but not covered

17

Reachable functions

46

Percentage of reachable functions covered

63.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_quick_encryption.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_utils.c	13
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyaes.c	16

Fuzzer: fuzz_ds_domain_classify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	16	13.3%
gold	[1:9]	8	6.66%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	96	80.0%
All colors	120	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	77	ndpi_encode_domain	call site: 00077	fprintf
2	1	LLVMFuzzerTestOneInput	call site: 00001	set_ndpi_debug_function
2	83	ndpi_domain_classify_add	call site: 00083	ndpi_hash_add_entry
2	108	ndpi_domain_classify_hostname	call site: 00108	ndpi_hash_find_entry
1	5	ndpi_load_domain_suffixes	call site: 00005	ndpi_hash_free
1	8	ndpi_hash_free	call site: 00008
1	11	ndpi_load_domain_suffixes	call site: 00011
1	19	ndpi_hash_add_entry	call site: 00019
1	27	ndpi_load_domain_suffixes	call site: 00027	NDPI_LOG_ERR
1	38	ndpi_domain_classify_alloc	call site: 00038	ndpi_free
1	54	ndpi_get_host_domain_suffix	call site: 00054

Runtime coverage analysis

Covered functions

30

Functions that are reachable but not covered

31

Reachable functions

58

Percentage of reachable functions covered

46.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_domain_classify.cpp	17
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_domains.c	12
ndpilib/ndpi_utils.c	16
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_domain_classify.c	15
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_ds_btree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	22	20.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	79.6%
All colors	108	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	39	manhattan_dist	call site: 00039	recursive_build
6	65	query_depth_first	call site: 00065	query_depth_first
5	1	LLVMFuzzerTestOneInput	call site: 00001
1	9	LLVMFuzzerTestOneInput	call site: 00009
1	30	btree_init	call site: 00030
1	86	nheap_get_arrays	call site: 00086

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

23

Reachable functions

51

Percentage of reachable functions covered

54.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_btree.cpp	12
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	4
ndpilib/third_partyball.c	28

Fuzzer: fuzz_filecfg_malicious_sha1

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	10.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	33	89.1%
All colors	37	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	6	LLVMFuzzerTestOneInput	call site: 00006	set_ndpi_debug_function
1	22	ndpi_hash_add_entry	call site: 00022
1	24	ndpi_hash_add_entry	call site: 00024

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

18

Reachable functions

32

Percentage of reachable functions covered

43.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_malicious_sha1.c	9
ndpi/fuzz/fuzz_common_code.c	5
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_main.c	7
ndpilib/ndpi_utils.c	7

Fuzzer: fuzz_gcrypt_light

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	24.7%
gold	[1:9]	3	0.85%
yellow	[10:29]	3	0.85%
greenyellow	[30:49]	6	1.70%
lawngreen	50+	253	71.8%
All colors	352	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	211	mbedtls_aes_crypt_ecb	call site: 00211	mbedtls_internal_aes_encrypt
19	122	mbedtls_aesni_setkey_enc	call site: 00122	MBEDTLS_GET_UINT32_LE
6	38	sha256_write_byte_block	call site: 00038	SIG1
6	258	mbedtls_gcm_starts	call site: 00258	gcm_mult
5	184	mbedtls_gcm_update	call site: 00184
3	171	gcm_mult	call site: 00171	gcm_mask
2	97	mbedtls_aesni_has_support	call site: 00097
2	177	gcm_mask	call site: 00177	gcm_mult
2	203	_gcry_cipher_crypt	call site: 00203	ndpi_malloc
2	267	mbedtls_gcm_update_ad	call site: 00267	gcm_mult
1	16	gcry_md_open	call site: 00016
1	57	gcry_md_close	call site: 00057

Runtime coverage analysis

Covered functions

73

Functions that are reachable but not covered

56

Reachable functions

123

Percentage of reachable functions covered

54.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_light.cpp	31
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/third_partygcrypt_light.c	21
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partygcrypt/digest.c	5
ndpilib/third_partyndpi_sha256.c	6
ndpilib/third_partygcrypt/aes.c	22
ndpilib/third_partygcrypt/gcm.c	23
ndpilib/third_partygcrypt/aesni.c	11
ndpilib/third_partygcrypt/cipher.c	8
ndpilib/third_party/include/gcrypt/cipher.h	1

Fuzzer: fuzz_dga

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	331	12.3%
gold	[1:9]	1997	74.2%
yellow	[10:29]	48	1.78%
greenyellow	[30:49]	12	0.44%
lawngreen	50+	301	11.1%
All colors	2689	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
32	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
25	1393	ndpi_load_categories_dir	call site: 01393	_wopendir
19	74	ac_automata_walk	call site: 00074	ac_automata_release
7	1327	node_resize_mp	call site: 01327	node_resize_mp
7	1419	ndpi_load_categories_dir	call site: 01419	readdir_r
6	1480	ndpi_patricia_lookup	call site: 01480	fprintf
6	1493	ndpi_patricia_lookup	call site: 01493	fprintf
5	1358	ndpi_set_config	call site: 01358	ndpi_str_endswith
5	1473	ndpi_New_Prefix2	call site: 01473	ndpi_free
4	3	ndpi_init_detection_module	call site: 00003	set_ndpi_debug_function
4	17	ndpi_patricia_destroy	call site: 00017	ndpi_Deref_Prefix

Runtime coverage analysis

Covered functions

430

Functions that are reachable but not covered

133

Reachable functions

541

Percentage of reachable functions covered

75.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_dga.c	7
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	426
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	33
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	4
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	1
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5

Fuzzer: fuzz_alg_jitter

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	17.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	19	82.6%
All colors	23	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	ndpi_jitter_init	call site: 00012
1	16	ndpi_jitter_add_value	call site: 00016	printf
1	20	ndpi_jitter_free	call site: 00020

Runtime coverage analysis

Covered functions

15

Functions that are reachable but not covered

11

Reachable functions

23

Percentage of reachable functions covered

52.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_jitter.cpp	10
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	5

Fuzzer: fuzz_alg_ses_des

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	15	27.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	39	72.2%
All colors	54	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	14	ndpi_ses_init	call site: 00014
3	25	ndpi_ses_fitting	call site: 00025	printf
3	37	ndpi_des_fitting	call site: 00037	printf
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	20	ndpi_normal_cdf_inverse	call site: 00020	printf
1	23	ndpi_ses_add_value	call site: 00023	printf
1	32	ndpi_des_init	call site: 00032	printf
1	35	ndpi_des_add_value	call site: 00035	printf
1	41	LLVMFuzzerTestOneInput	call site: 00041

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

15

Reachable functions

33

Percentage of reachable functions covered

54.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_ses_des.cpp	17
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_analyze.c	11

Fuzzer: fuzz_libinjection

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	69	34.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	133	65.8%
All colors	202	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
69	33	syntax_merge_words	call site: 00033	ndpi_Ref_Prefix

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

10

Reachable functions

42

Percentage of reachable functions covered

76.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_libinjection.c	6
ndpilib/third_partylibinjection_sqli.c	28
ndpilib/third_partyndpi_patricia.c	14
ndpi/tests/performance/gcrypt.c	2
ndpilib/third_partylibinjection_xss.c	10
ndpilib/third_partylibinjection_html5.c	2

Fuzzer: fuzz_filecfg_category

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	147	9.69%
gold	[1:9]	15	0.98%
yellow	[10:29]	1	0.06%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1353	89.1%
All colors	1517	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
7	1331	node_resize_mp	call site: 01331	node_resize_mp
6	1417	ndpi_patricia_lookup	call site: 01417	fprintf
6	1430	ndpi_patricia_lookup	call site: 01430	fprintf
5	1360	ndpi_set_config	call site: 01360	ndpi_str_endswith
5	1470	ndpi_encode_domain	call site: 01470	ndpi_hash_find_entry
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1254	init_string_based_protocols	call site: 01254	NDPI_LOG_ERR
4	1396	add_to_ptree	call site: 01396	fprintf
4	1510	ndpi_hash_add_entry	call site: 01510	ndpi_hash_add_entry

Runtime coverage analysis

Covered functions

103

Functions that are reachable but not covered

82

Reachable functions

172

Percentage of reachable functions covered

52.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_category.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	86
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	16
ndpilib/ndpi_utils.c	24
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	32
ndpilib/ndpi_domain_classify.c	7
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	3
ndpilib/third_partyshoco.c	8

Fuzzer: fuzz_binaryfusefilter

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	135	84.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	15.0%
All colors	159	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	28	LLVMFuzzerTestOneInput	call site: 00028	ndpi_free
48	99	LLVMFuzzerTestOneInput	call site: 00099	ndpi_free
17	10	LLVMFuzzerTestOneInput	call site: 00010	binary_fuse_calculate_size_factor
5	85	LLVMFuzzerTestOneInput	call site: 00085	binary_fuse_mix_split
4	94	LLVMFuzzerTestOneInput	call site: 00094	binary_fuse_calculate_size_factor
4	150	LLVMFuzzerTestOneInput	call site: 00150	binary_fuse_mix_split
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	92	LLVMFuzzerTestOneInput	call site: 00092	ndpi_free
1	156	LLVMFuzzerTestOneInput	call site: 00156	ndpi_free

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

33

Reachable functions

42

Percentage of reachable functions covered

21.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_binaryfusefilter.cpp	13
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_party/include/binaryfusefilter.h	22

Fuzzer: fuzz_ds_address_cache

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	3.22%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.07%
lawngreen	50+	89	95.6%
All colors	93	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	22	ndpi_init_address_cache	call site: 00022
1	26	ndpi_init_address_cache	call site: 00026
1	28	ndpi_init_address_cache	call site: 00028

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

25

Reachable functions

49

Percentage of reachable functions covered

48.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_address_cache.cpp	18
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_cache.c	24
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_memory.c	3

Fuzzer: fuzz_alg_memmem

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2	6.45%
gold	[1:9]	1	3.22%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	12.9%
lawngreen	50+	24	77.4%
All colors	31	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	19	LLVMFuzzerTestOneInput	call site: 00019

Runtime coverage analysis

Covered functions

4

Functions that are reachable but not covered

10

Reachable functions

14

Percentage of reachable functions covered

28.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_memmem.cpp	9
ndpilib/ndpi_main.c	5

Fuzzer: fuzz_gcrypt_aes

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3	2.32%
gold	[1:9]	5	3.87%
yellow	[10:29]	33	25.5%
greenyellow	[30:49]	9	6.97%
lawngreen	50+	79	61.2%
All colors	129	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	24	mbedtls_aesni_has_support	call site: 00024
1	18	aes_gen_tables	call site: 00018

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

35

Reachable functions

51

Percentage of reachable functions covered

31.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_aes.cpp	13
ndpilib/third_partygcrypt/aes.c	30
ndpilib/third_partygcrypt/aesni.c	12

Fuzzer: fuzz_quic_get_crypto_data

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	609	17.9%
gold	[1:9]	1999	59.0%
yellow	[10:29]	63	1.86%
greenyellow	[30:49]	13	0.38%
lawngreen	50+	703	20.7%
All colors	3387	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	28	ndpi_patricia_destroy	call site: 00028	ndpi_exit_detection_module
32	95	ndpi_domain_classify_free	call site: 00095	ac_automata_release
26	2782	ndpi_lru_add_to_cache	call site: 02782	ndpi_set_risk
26	3157	processClientServerHello	call site: 03157	ndpi_cache_find_hostname_ip
25	1393	ndpi_load_categories_dir	call site: 01393	_wopendir
22	3360	ndpi_free_flow_data	call site: 03360	ndpi_free
19	74	ac_automata_walk	call site: 00074	ac_automata_release
17	3325	ndpi_free_flow_data	call site: 03325	ndpi_free
15	2712	ndpi_patricia_search_best2	call site: 02712	fprintf
10	2768	ndpi_handle_risk_exceptions	call site: 02768	ndpi_check_ipv6_exception
9	2829	proto_stack_update	call site: 02829	ookla_add_to_cache
7	1327	node_resize_mp	call site: 01327	node_resize_mp

Runtime coverage analysis

Covered functions

512

Functions that are reachable but not covered

163

Reachable functions

654

Percentage of reachable functions covered

75.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_quic_get_crypto_data.c	10
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	461
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	50
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	20
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	2
ndpilib/ndpi_bitmap.c	4
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	51
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	7
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	41
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	1
ndpi/windowsndpi_define.h	1
ndpilib/third_partyndpi_md5.c	6
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_gcrypt_gcm

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	10.1%
gold	[1:9]	5	2.99%
yellow	[10:29]	4	2.39%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	141	84.4%
All colors	167	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	70	mbedtls_gcm_update	call site: 00070
2	58	gcm_mult	call site: 00058	gcm_mask
2	86	mbedtls_aesni_has_support	call site: 00086
2	115	mbedtls_gcm_update_ad	call site: 00115	gcm_mult
1	37	mbedtls_cipher_setkey	call site: 00037
1	48	mbedtls_cipher_update	call site: 00048	mbedtls_gcm_update
1	61	gcm_mask	call site: 00061	mbedtls_platform_zeroize
1	64	gcm_mask	call site: 00064	gcm_mult
1	80	gcm_gen_table	call site: 00080
1	124	mbedtls_gcm_finish	call site: 00124	gcm_mult

Runtime coverage analysis

Covered functions

36

Functions that are reachable but not covered

32

Reachable functions

55

Percentage of reachable functions covered

41.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_gcrypt_gcm.cpp	18
ndpilib/third_partygcrypt/gcm.c	24
ndpilib/third_partygcrypt/cipher.c	8
ndpilib/third_party/include/gcrypt/cipher.h	1
ndpilib/third_partygcrypt/aesni.c	8

Fuzzer: fuzz_readerutils_workflow

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	869	21.0%
gold	[1:9]	146	3.53%
yellow	[10:29]	34	0.82%
greenyellow	[30:49]	30	0.72%
lawngreen	50+	3056	73.9%
All colors	4135	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
77	2717	packet_processing	call site: 02717	ndpi_classify
61	4021	process_ndpi_collected_info	call site: 04021	dump_flow_fingerprint
38	3804	ndpi_dpi2json	call site: 03804	ndpi_serialize_string_uint32
25	1371	ndpi_load_protocols_dir	call site: 01371	_wopendir
17	3944	ndpi_dpi2json	call site: 03944	ndpi_serialize_string_uint32
15	3029	ndpi_patricia_search_best2	call site: 03029	fprintf
15	3924	ndpi_dpi2json	call site: 03924	ndpi_serialize_string_uint32
14	132	ndpi_exit_detection_module	call site: 00132	ndpi_term_address_cache
14	3564	ndpi_is_number	call site: 03564	ndpi_serialize_uint32_uint32
13	3353	ndpi_detection_giveup	call site: 03353	ndpi_set_detected_protocol
13	3859	ndpi_dpi2json	call site: 03859
12	1535	ndpi_workflow_init	call site: 01535	load_public_lists

Runtime coverage analysis

Covered functions

1372

Functions that are reachable but not covered

211

Reachable functions

825

Percentage of reachable functions covered

74.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_readerutils_workflow.cpp	22
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	489
ndpi/tests/performance/gcrypt.c	3
ndpi/example/reader_util.c	123
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	121
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	17
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/third_partyshoco.c	8
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_analyze.c	7
ndpilib/ndpi_serializer.c	40
ndpilib/ndpi_classify.c	12
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_filecfg_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	99	7.13%
gold	[1:9]	13	0.93%
yellow	[10:29]	2	0.14%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1273	91.7%
All colors	1387	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	109	ndpi_exit_detection_module	call site: 00109	ndpi_term_address_cache
17	46	ndpi_exit_detection_module	call site: 00046	cache_free
7	1331	node_resize_mp	call site: 01331	node_resize_mp
6	90	ndpi_exit_detection_module	call site: 00090	ndpi_hash_free
4	7	ndpi_init_detection_module	call site: 00007	set_ndpi_debug_function
4	21	ndpi_patricia_destroy	call site: 00021	ndpi_Deref_Prefix
4	26	ndpi_DeleteEntry	call site: 00026	ndpi_DeleteEntry
4	67	ndpi_exit_detection_module	call site: 00067	ndpi_tdestroy_recurse
4	1254	init_string_based_protocols	call site: 01254	NDPI_LOG_ERR
3	86	ac_automata_release	call site: 00086	ac_automata_release
2	106	ndpi_exit_detection_module	call site: 00106	ndpi_free
2	176	ndpi_realloc	call site: 00176	ndpi_free

Runtime coverage analysis

Covered functions

94

Functions that are reachable but not covered

67

Reachable functions

140

Percentage of reachable functions covered

52.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_filecfg_config.c	8
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	75
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	7
ndpilib/ndpi_utils.c	12
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	2
ndpilib/third_partyahocorasick.c	32
ndpilib/ndpi_domain_classify.c	4
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4

Fuzzer: fuzz_ds_kdtree

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	5.15%
gold	[1:9]	2	2.06%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	90	92.7%
All colors	97	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	8	LLVMFuzzerTestOneInput	call site: 00008
1	11	LLVMFuzzerTestOneInput	call site: 00011
1	68	kd_nearest	call site: 00068	kd_res_free
1	74	LLVMFuzzerTestOneInput	call site: 00074	printf
1	88	clear_rec	call site: 00088

Runtime coverage analysis

Covered functions

39

Functions that are reachable but not covered

18

Reachable functions

54

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ds_kdtree.cpp	18
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	2
ndpilib/ndpi_analyze.c	9
ndpilib/third_partykdtree.c	20

Fuzzer: fuzz_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	399	9.10%
gold	[1:9]	69	1.57%
yellow	[10:29]	51	1.16%
greenyellow	[30:49]	32	0.73%
lawngreen	50+	3831	87.4%
All colors	4382	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
25	1597	ndpi_load_categories_dir	call site: 01597	_wopendir
20	4296	ndpi_free_flow_data	call site: 04296	ndpi_free
19	4143	ndpi_serialize_uint32_binary	call site: 04143	ndpi_serializer_header_uint32
15	3189	ndpi_patricia_search_best2	call site: 03189	fprintf
12	1634	ndpi_load_categories_dir	call site: 01634	ndpi_load_category_file
11	4082	ndpi_detection_giveup	call site: 04082	ndpi_set_detected_protocol
10	3747	internal_giveup	call site: 03747	ndpi_fill_protocol_category_and_breed
10	4036	ndpi_reconcile_protocols	call site: 04036	ndpi_set_risk
10	4249	LLVMFuzzerTestOneInput	call site: 04249	ndpi_min
7	51	ndpi_exit_detection_module	call site: 00051	cache_free
7	1336	node_resize_mp	call site: 01336	node_resize_mp
7	1623	ndpi_load_categories_dir	call site: 01623	readdir_r

Runtime coverage analysis

Covered functions

1357

Functions that are reachable but not covered

188

Reachable functions

814

Percentage of reachable functions covered

76.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_config.cpp	139
ndpi/fuzz/fuzz_common_code.c	4
ndpilib/ndpi_main.c	546
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	68
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	14
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	8
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	5
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	1
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/third_partyndpi_sha256.c	8
ndpilib/ndpi_analyze.c	2
ndpilib/ndpi_serializer.c	26
ndpilib/protocols/tcp_udp.c	5
ndpilib/ndpi_classify.c	5
ndpilib/third_partywindows/gettimeofday.c	2

Fuzzer: fuzz_ndpi_reader_pl7m

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	702	16.1%
gold	[1:9]	2076	47.6%
yellow	[10:29]	79	1.81%
greenyellow	[30:49]	41	0.94%
lawngreen	50+	1461	33.5%
All colors	4359	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
44	4314	LLVMFuzzerTestOneInput	call site: 04314	ndpi_report_payload_stats
35	34	ndpi_patricia_destroy	call site: 00034	ndpi_exit_detection_module
35	4266	process_ndpi_collected_info	call site: 04266	dump_flow_fingerprint
29	2936	packet_processing	call site: 02936	ndpi_payload_analyzer
25	1356	ndpi_load_protocols_dir	call site: 01356	_wopendir
21	101	ndpi_domain_classify_free	call site: 00101	ac_automata_release
19	3604	ndpi_serialize_uint32_binary	call site: 03604	ndpi_serializer_header_uint32
15	3248	ndpi_patricia_search_best2	call site: 03248	fprintf
14	3783	ndpi_is_number	call site: 03783	ndpi_serialize_uint32_uint32
13	80	ac_automata_walk	call site: 00080	ac_automata_release
13	3960	ndpi_serialize_binary_float	call site: 03960	ndpi_serialize_uint32_float
10	3771	ndpi_serialize_string_uint32	call site: 03771	ndpi_serializer_header_string

Runtime coverage analysis

Covered functions

1725

Functions that are reachable but not covered

223

Reachable functions

858

Percentage of reachable functions covered

74.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_ndpi_reader_pl7m.c	33
ndpi/fuzz/fuzz_common_code.c	5
ndpilib/ndpi_main.c	518
ndpi/tests/performance/gcrypt.c	3
ndpi/example/reader_util.c	124
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	123
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	12
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	1
ndpilib/ndpi_bitmap.c	2
ndpilib/ndpi_memory.c	4
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/ndpi_domains.c	17
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	1
ndpilib/protocols/rtp.c	1
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	1
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	2
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	2
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	5
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	4
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	7
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_analyze.c	7
ndpilib/ndpi_serializer.c	40
ndpilib/ndpi_classify.c	16
ndpilib/third_partyndpi_sha256.c	8

Fuzzer: fuzz_alg_hll

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	8.88%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	91.1%
All colors	45	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	7	LLVMFuzzerTestOneInput	call site: 00007
1	12	hll_init	call site: 00012
1	27	hll_count	call site: 00027
1	42	hll_destroy	call site: 00042

Runtime coverage analysis

Covered functions

26

Functions that are reachable but not covered

13

Reachable functions

36

Percentage of reachable functions covered

63.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_alg_hll.cpp	15
ndpi/fuzz/fuzz_common_code.c	4
ndpi/tests/performance/gcrypt.c	3
ndpilib/ndpi_analyze.c	5
ndpilib/third_partyhll/hll.c	7
ndpilib/third_partyhll/MurmurHash3.c	1

Fuzzer: ndpi/fuzz/fuzz_is_stun.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	647	16.4%
gold	[1:9]	2043	51.8%
yellow	[10:29]	103	2.61%
greenyellow	[30:49]	40	1.01%
lawngreen	50+	1105	28.0%
All colors	3938	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	3610	processCertificateElements	call site: 03610	strptime
25	1393	ndpi_load_categories_dir	call site: 01393	_wopendir
15	2789	ndpi_patricia_search_best2	call site: 02789	fprintf
11	3823	ookla_search_into_cache	call site: 03823	ndpi_set_detected_protocol
10	105	ndpi_exit_detection_module	call site: 00105	ndpi_term_address_cache
10	3693	processCertificateElements	call site: 03693	ndpi_set_risk
9	3289	ndpi_bitmap_isset	call site: 03289	ndpi_set_risk
7	52	ndpi_lru_free_cache	call site: 00052	ndpi_lru_free_cache
7	1327	node_resize_mp	call site: 01327	node_resize_mp
7	1419	ndpi_load_categories_dir	call site: 01419	readdir_r
7	3084	processClientServerHello	call site: 03084	printf
7	3299	processClientServerHello	call site: 03299	printf

Runtime coverage analysis

Covered functions

2445

Functions that are reachable but not covered

147

Reachable functions

723

Percentage of reachable functions covered

79.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
ndpi/fuzz/fuzz_is_stun.c	3
ndpi/fuzz/fuzz_common_code.c	11
ndpilib/ndpi_main.c	460
ndpi/tests/performance/gcrypt.c	3
ndpilib/third_partyndpi_patricia.c	20
ndpilib/ndpi_utils.c	58
ndpilib/third_partylibcache.c	1
ndpilib/ndpi_cache.c	20
ndpilib/third_partyahocorasick.c	39
ndpilib/ndpi_domain_classify.c	11
ndpilib/ndpi_geoip.c	2
ndpilib/ndpi_filter.c	2
ndpilib/ndpi_bitmap.c	4
ndpilib/ndpi_memory.c	4
ndpilib/ndpi_domains.c	17
ndpilib/third_party/include/windows/dirent.h	19
ndpilib/third_partyshoco.c	8
ndpilib/protocols/http.c	1
ndpilib/protocols/blizzard.c	1
ndpilib/protocols/tls.c	109
ndpilib/protocols/rtp.c	5
ndpilib/protocols/rtsp.c	1
ndpilib/protocols/rdp.c	1
ndpilib/protocols/stun.c	52
ndpilib/protocols/sip.c	1
ndpilib/protocols/mudfish.c	1
ndpilib/protocols/imo.c	1
ndpilib/protocols/teredo.c	1
ndpilib/protocols/edonkey.c	1
ndpilib/protocols/gnutella.c	1
ndpilib/protocols/nats.c	1
ndpilib/protocols/socks45.c	1
ndpilib/protocols/irc.c	1
ndpilib/protocols/jabber.c	1
ndpilib/protocols/mail_pop.c	1
ndpilib/protocols/mail_imap.c	1
ndpilib/protocols/mail_smtp.c	1
ndpilib/protocols/usenet.c	1
ndpilib/protocols/dns.c	1
ndpilib/protocols/vmware.c	1
ndpilib/protocols/non_tcp_udp.c	1
ndpilib/protocols/iax.c	1
ndpilib/protocols/mgcp.c	1
ndpilib/protocols/zattoo.c	1
ndpilib/protocols/qq.c	1
ndpilib/protocols/ssh.c	1
ndpilib/protocols/vnc.c	1
ndpilib/protocols/vxlan.c	1
ndpilib/protocols/teamviewer.c	1
ndpilib/protocols/dhcp.c	1
ndpilib/protocols/steam.c	1
ndpilib/protocols/xbox.c	1
ndpilib/protocols/smb.c	1
ndpilib/protocols/mining.c	1
ndpilib/protocols/telnet.c	1
ndpilib/protocols/ntp.c	1
ndpilib/protocols/nfs.c	1
ndpilib/protocols/ssdp.c	1
ndpilib/protocols/postgres.c	1
ndpilib/protocols/mysql.c	1
ndpilib/protocols/bgp.c	1
ndpilib/protocols/snmp_proto.c	1
ndpilib/protocols/icecast.c	1
ndpilib/protocols/kerberos.c	1
ndpilib/protocols/syslog.c	1
ndpilib/protocols/netbios.c	1
ndpilib/protocols/ipp.c	1
ndpilib/protocols/ldap.c	1
ndpilib/protocols/xdmcp.c	1
ndpilib/protocols/tftp.c	1
ndpilib/protocols/mssql_tds.c	1
ndpilib/protocols/pptp.c	1
ndpilib/protocols/dhcpv6.c	1
ndpilib/protocols/afp.c	1
ndpilib/protocols/checkmk.c	1
ndpilib/protocols/cpha.c	1
ndpilib/protocols/nexon.c	1
ndpilib/protocols/dofus.c	1
ndpilib/protocols/crossfire.c	1
ndpilib/protocols/guildwars2.c	1
ndpilib/protocols/armagetron.c	1
ndpilib/protocols/dropbox.c	1
ndpilib/protocols/sonos.c	1
ndpilib/protocols/spotify.c	1
ndpilib/protocols/radius_proto.c	1
ndpilib/protocols/citrix.c	1
ndpilib/protocols/hcl_notes.c	1
ndpilib/protocols/gtp.c	1
ndpilib/protocols/hsrp.c	1
ndpilib/protocols/dcerpc.c	1
ndpilib/protocols/netflow.c	1
ndpilib/protocols/sflow.c	1
ndpilib/protocols/h323.c	1
ndpilib/protocols/openvpn.c	1
ndpilib/protocols/noe.c	1
ndpilib/protocols/ciscovpn.c	1
ndpilib/protocols/teamspeak.c	1
ndpilib/protocols/skinny.c	1
ndpilib/protocols/rsync.c	1
ndpilib/protocols/whoisdas.c	1
ndpilib/protocols/oracle.c	1
ndpilib/protocols/corba.c	1
ndpilib/protocols/rtmp.c	1
ndpilib/protocols/ftp_control.c	1
ndpilib/protocols/ftp_data.c	1
ndpilib/protocols/megaco.c	1
ndpilib/protocols/resp.c	1
ndpilib/protocols/zeromq.c	1
ndpilib/protocols/telegram.c	1
ndpilib/protocols/quic.c	9
ndpilib/protocols/diameter.c	1
ndpilib/protocols/apple_push.c	1
ndpilib/protocols/eaq.c	1
ndpilib/protocols/kakaotalk_voice.c	1
ndpilib/protocols/mikrotik.c	1
ndpilib/protocols/mpegts.c	1
ndpilib/protocols/ubntac2.c	1
ndpilib/protocols/coap.c	1
ndpilib/protocols/mqtt.c	1
ndpilib/protocols/someip.c	1
ndpilib/protocols/rx.c	1
ndpilib/protocols/git.c	1
ndpilib/protocols/drda.c	1
ndpilib/protocols/bjnp.c	1
ndpilib/protocols/smpp.c	1
ndpilib/protocols/tinc.c	1
ndpilib/protocols/fix.c	1
ndpilib/protocols/nintendo.c	1
ndpilib/protocols/modbus.c	1
ndpilib/protocols/capwap.c	1
ndpilib/protocols/zabbix.c	1
ndpilib/protocols/viber.c	1
ndpilib/protocols/bittorrent.c	1
ndpilib/protocols/whatsapp.c	1
ndpilib/protocols/ookla.c	8
ndpilib/protocols/amqp.c	1
ndpilib/protocols/steam_datagram_relay.c	1
ndpilib/protocols/lisp.c	1
ndpilib/protocols/ajp.c	1
ndpilib/protocols/memcached.c	1
ndpilib/protocols/nest_log_sink.c	1
ndpilib/protocols/wireguard.c	1
ndpilib/protocols/amazon_video.c	1
ndpilib/protocols/s7comm.c	1
ndpilib/protocols/iec60870-5-104.c	1
ndpilib/protocols/dnp3.c	1
ndpilib/protocols/websocket.c	1
ndpilib/protocols/soap.c	1
ndpilib/protocols/dnscrypt.c	1
ndpilib/protocols/mongodb.c	1
ndpilib/protocols/among_us.c	1
ndpilib/protocols/hpvirtgrp.c	1
ndpilib/protocols/genshin_impact.c	1
ndpilib/protocols/z3950.c	1
ndpilib/protocols/avast_securedns.c	1
ndpilib/protocols/cassandra.c	1
ndpilib/protocols/ethernet_ip.c	1
ndpilib/protocols/wsd.c	1
ndpilib/protocols/tocaboca.c	1
ndpilib/protocols/sd_rtn.c	1
ndpilib/protocols/raknet.c	1
ndpilib/protocols/xiaomi.c	1
ndpilib/protocols/mpegdash.c	1
ndpilib/protocols/rsh.c	1
ndpilib/protocols/ipsec.c	1
ndpilib/protocols/collectd.c	1
ndpilib/protocols/i3d.c	1
ndpilib/protocols/riotgames.c	1
ndpilib/protocols/ultrasurf.c	1
ndpilib/protocols/threema.c	1
ndpilib/protocols/alicloud.c	1
ndpilib/protocols/avast.c	1
ndpilib/protocols/softether.c	1
ndpilib/protocols/activision.c	1
ndpilib/protocols/discord.c	1
ndpilib/protocols/tivoconnect.c	1
ndpilib/protocols/kismet.c	1
ndpilib/protocols/fastcgi.c	1
ndpilib/protocols/natpmp.c	1
ndpilib/protocols/syncthing.c	1
ndpilib/protocols/crynet.c	1
ndpilib/protocols/line.c	1
ndpilib/protocols/munin.c	1
ndpilib/protocols/elastic_search.c	1
ndpilib/protocols/tuya_lp.c	1
ndpilib/protocols/tplink_shp.c	1
ndpilib/protocols/merakicloud.c	1
ndpilib/protocols/tailscale.c	1
ndpilib/protocols/source_engine.c	1
ndpilib/protocols/bacnet.c	1
ndpilib/protocols/oicq.c	1
ndpilib/protocols/hots.c	1
ndpilib/protocols/epicgames.c	1
ndpilib/protocols/bitcoin.c	1
ndpilib/protocols/thrift.c	1
ndpilib/protocols/slp.c	1
ndpilib/protocols/http2.c	1
ndpilib/protocols/haproxy.c	1
ndpilib/protocols/rmcp.c	1
ndpilib/protocols/can.c	1
ndpilib/protocols/protobuf.c	1
ndpilib/protocols/ethereum.c	1
ndpilib/protocols/ptpv2.c	1
ndpilib/protocols/hart-ip.c	1
ndpilib/protocols/rtps.c	1
ndpilib/protocols/opc-ua.c	1
ndpilib/protocols/fins.c	1
ndpilib/protocols/ethersio.c	1
ndpilib/protocols/beckhoff_ads.c	1
ndpilib/protocols/iso9506-1-mms.c	1
ndpilib/protocols/ieee-c37118.c	1
ndpilib/protocols/ethersbus.c	1
ndpilib/protocols/monero.c	1
ndpilib/protocols/profinet_io.c	1
ndpilib/protocols/hislip.c	1
ndpilib/protocols/uftp.c	1
ndpilib/protocols/openflow.c	1
ndpilib/protocols/json-rpc.c	1
ndpilib/protocols/kafka.c	1
ndpilib/protocols/nomachine.c	1
ndpilib/protocols/iec62056.c	1
ndpilib/protocols/hl7.c	1
ndpilib/protocols/dicom.c	1
ndpilib/protocols/ceph.c	1
ndpilib/protocols/roughtime.c	1
ndpilib/protocols/kcp.c	1
ndpilib/protocols/mumble.c	1
ndpilib/protocols/zoom.c	1
ndpilib/protocols/yojimbo.c	1
ndpilib/protocols/stomp.c	1
ndpilib/protocols/radmin.c	1
ndpilib/protocols/raft.c	1
ndpilib/protocols/cip.c	1
ndpilib/protocols/gearman.c	1
ndpilib/protocols/tencent_games.c	1
ndpilib/protocols/gaijin_entertainment.c	1
ndpilib/protocols/c1222.c	1
ndpilib/protocols/dlep.c	1
ndpilib/protocols/bfd.c	1
ndpilib/protocols/netease_games.c	1
ndpilib/protocols/path_of_exile.c	1
ndpilib/protocols/pfcp.c	1
ndpilib/protocols/flute.c	1
ndpilib/protocols/lol_wild_rift.c	1
ndpilib/protocols/teso.c	1
ndpilib/protocols/ldp.c	1
ndpilib/protocols/knxnet_ip.c	1
ndpilib/protocols/bfcp.c	1
ndpilib/protocols/iqiyi.c	1
ndpilib/protocols/egd.c	1
ndpilib/protocols/cod_mobile.c	1
ndpilib/protocols/zug.c	1
ndpilib/protocols/jrmi.c	1
ndpilib/protocols/ripe_atlas.c	1
ndpilib/protocols/cloudflare_warp.c	1
ndpilib/protocols/nano.c	1
ndpilib/protocols/openwire.c	1
ndpilib/protocols/cnp-ip.c	1
ndpilib/protocols/atg.c	1
ndpilib/protocols/trdp.c	1
ndpilib/protocols/lustre.c	1
ndpilib/protocols/dingtalk.c	1
ndpilib/protocols/paltalk.c	1
ndpilib/protocols/lagofast.c	1
ndpilib/protocols/gearup_booster.c	1
ndpilib/protocols/msdo.c	1
ndpilib/protocols/melsec.c	1
ndpilib/protocols/hamachi.c	1
ndpilib/protocols/glbp.c	1
ndpilib/protocols/easyweather.c	1
ndpilib/protocols/tristation.c	1
ndpilib/protocols/samsung_sdp.c	1
ndpilib/ndpi_fingerprint.c	5
ndpilib/ndpi_serializer.c	2
ndpilib/third_partyndpi_md5.c	6
ndpi/windowsndpi_define.h	1
ndpilib/third_partyndpi_sha256.c	8
ndpilib/third_partyndpi_sha1.c	10
ndpilib/third_partystrptime.c	7
ndpilib/ndpi_analyze.c	3

Fuzzer: json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	261	97.7%
gold	[1:9]	2	0.74%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	4	1.49%
All colors	267	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
245	0	EP	call site: 00000	json_tokener_parse_ex
12	247	LLVMFuzzerTestOneInput	call site: 00247	json_object_to_json_string_ext
4	262	LLVMFuzzerTestOneInput	call site: 00262	json_tokener_reset

Runtime coverage analysis

Covered functions

2445

Functions that are reachable but not covered

109

Reachable functions

110

Percentage of reachable functions covered

0.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
json-c-json-c-0.17-20230812/fuzz/tokener_parse_ex_fuzzer.cc	8
json-c-json-c-0.17-20230812/json_tokener.c	47
json-c-json-c-0.17-20230812/printbuf.c	3
json-c-json-c-0.17-20230812/json_object.c	48
json-c-json-c-0.17-20230812/linkhash.c	8
json-c-json-c-0.17-20230812/arraylist.c	4
json-c-json-c-0.17-20230812/json_util.c	2
json-c-json-c-0.17-20230812/linkhash.h	1