Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues
Project coverage
Per-fuzzer coverage

Table of contents

Project overview: nginx
High level conclusions
Reachability and coverage overview
Fuzzers overview
Project functions overview
Fuzzer details
Fuzzer: http_request_fuzzer
Call tree
Fuzz blockers
Runtime coverage analysis
Files reached
Analyses and suggestions
Optimal target analysis
Remaining optimal interesting functions
All functions overview
Runtime coverage analysis
Complex functions with low coverage
Files and Directories in report
Files in report
Directories in report
Metadata section
Function call coverage
Function in each files in report
Report generation date: 2023-06-07

Project overview: nginx

High level conclusions

Reachability and coverage overview

Functions statically reachable by fuzzers
14.0%
239 / 1681
Cyclomatic complexity statically reachable by fuzzers
12.0%
2147 / 17248
Runtime code coverage of functions
31.0%
519 / 1681

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
http_request_fuzzer nginxfuzz/http_request_fuzzer.cc 325 1558 29 56 5847 2277 http_request_fuzzer.cc

Project functions overview

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Fuzzer details

Fuzzer: http_request_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 652 67.9%
gold [1:9] 194 20.2%
yellow [10:29] 84 8.75%
greenyellow [30:49] 12 1.25%
lawngreen 50+ 17 1.77%
All colors 959 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
4855 4855 4 :

['ngx_http_file_cache_valid', 'ngx_http_upstream_cache_send', 'ngx_http_upstream_finalize_request', 'ngx_http_file_cache_update_header']

4855 4855 ngx_http_upstream_test_next call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:2598
3550 5067 11 :

['ngx_http_internal_redirect', 'ngx_http_map_uri_to_path', 'ngx_http_named_location', 'ngx_http_finalize_request', 'ngx_http_set_exten', 'ngx_http_set_disable_symlinks', 'ngx_pnalloc', 'strncmp', 'ngx_open_cached_file', 'ngx_log_error_core', 'ngx_http_split_args']

3550 5067 ngx_http_try_files_handler call site: 00000 /src/nginx/src/http/modules/ngx_http_try_files_module.c:95
3201 3201 1 :

['ngx_http_upstream_next']

3201 3201 ngx_http_upstream_connect call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:1574
3201 3201 1 :

['ngx_http_upstream_next']

3201 3201 ngx_http_upstream_process_header call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:2493
3201 3201 1 :

['ngx_http_upstream_next']

3201 3201 ngx_http_upstream_send_request call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:2103
3018 3183 3 :

['ngx_hash_find', 'ngx_http_upstream_copy_header_line', 'ngx_http_upstream_finalize_request']

3018 3183 ngx_http_upstream_process_headers call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:2897
2889 2889 4 :

['ngx_http_test_if_modified', 'ngx_http_filter_finalize_request', 'ngx_http_test_if_unmodified', 'ngx_http_test_if_match']

2889 2889 ngx_http_not_modified_header_filter call site: 00000 /src/nginx/src/http/modules/ngx_http_not_modified_filter_module.c:57
2674 2674 2 :

['ngx_http_named_location', 'ngx_http_internal_redirect']

2674 2674 ngx_http_post_action call site: 00683 /src/nginx/src/http/ngx_http_request.c:3594
2514 2514 2 :

['ngx_http_upstream_cache_send', 'ngx_http_upstream_cache']

17893 34616 ngx_http_upstream_init_request call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:571
1638 1638 2 :

['ngx_connection_error', 'ngx_http_upstream_finalize_request']

1638 1638 ngx_http_upstream_process_non_buffered_upstream call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:3675
1638 1638 2 :

['ngx_connection_error', 'ngx_http_upstream_finalize_request']

1638 1638 ngx_http_upstream_process_non_buffered_downstream call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:3651
1573 1573 1 :

['ngx_http_upstream_upgrade']

1810 1810 ngx_http_upstream_send_response call site: 00000 /src/nginx/src/http/ngx_http_upstream.c:3031

Runtime coverage analysis

Covered functions
526
Functions that are reachable but not covered
143
Reachable functions
325
Percentage of reachable functions covered
56.0%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
nginxfuzz/http_request_fuzzer.cc 10
nginxfuzz/genfiles/http_request_proto.pb.h 5
nginxfuzz/genfiles/http_request_proto.pb.cc 4
LPM/external.protobuf/include/google/protobuf/message.h 2
LPM/external.protobuf/include/google/protobuf/message_lite.h 2
LPM/external.protobuf/include/google/protobuf/metadata_lite.h 3
LPM/external.protobuf/include/google/protobuf/generated_message_util.h 1
LPM/external.protobuf/include/google/protobuf/arenastring.h 4
nginxos/unix/ngx_errno.c 2
nginxcore/ngx_log.c 7
nginxcore/ngx_string.c 17
nginxos/unix/ngx_files.h 1
nginxcore/ngx_times.c 4
nginxos/unix/ngx_time.c 2
nginxcore/ngx_regex.c 4
nginxcore/ngx_palloc.c 9
nginxos/unix/ngx_alloc.c 2
nginxos/unix/ngx_posix_init.c 2
nginxos/unix/ngx_linux_init.c 2
nginxos/unix/ngx_setproctitle.c 1
nginxcore/ngx_cpuinfo.c 2
nginxcore/ngx_crc32.c 1
nginxcore/ngx_module.c 3
nginxcore/ngx_cycle.c 7
nginxcore/ngx_array.h 1
nginxcore/ngx_list.h 1
nginxcore/ngx_array.c 2
nginxcore/ngx_conf_file.c 8
nginxcore/ngx_crc32.h 1
nginxcore/ngx_buf.c 2
nginxcore/ngx_rbtree.c 5
nginxos/unix/ngx_files.c 2
nginxcore/ngx_file.c 3
nginxcore/ngx_list.c 1
nginxos/unix/ngx_shmem.c 2
nginxcore/ngx_shmtx.c 1
nginxcore/ngx_slab.c 1
nginxcore/ngx_inet.c 3
nginxcore/ngx_connection.c 10
nginxos/unix/ngx_socket.c 2
nginxevent/ngx_event_timer.h 2
nginxcore/ngx_rbtree.h 1
nginxevent/ngx_event_timer.c 1
nginxhttp/ngx_http_request.c 38
nginxevent/ngx_event.c 3
nginxcore/ngx_proxy_protocol.c 4
nginxhttp/v2/ngx_http_v2.c 15
nginxhttp/v2/ngx_http_v2.h 1
nginxhttp/ngx_http_parse.c 5
nginxhttp/ngx_http_core_module.c 8
nginxhttp/ngx_http_special_response.c 4
nginxhttp/ngx_http_script.c 2
nginxcore/ngx_string.h 1
nginxhttp/ngx_http_request_body.c 6
nginxcore/ngx_hash.c 5
nginxhttp/ngx_http_variables.c 1

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name Functions filename Arg count Args Function depth hitcount instr count bb count cyclomatic complexity Reachable functions Incoming references total cyclomatic complexity Unreached complexity
ngx_http_grpc_merge_loc_conf /src/nginx/src/http/modules/ngx_http_grpc_module.c 3 ['struct.ngx_conf_s.556 *', 'char *', 'char *'] 25 0 718 108 39 478 0 5304 3840
fuzz_without_main /src/nginx/src/core/nginx.c 2 ['int ', 'char **'] 9 0 489 81 34 238 0 1657 641
ngx_http_proxy_merge_loc_conf /src/nginx/src/http/modules/ngx_http_proxy_module.c 3 ['struct.ngx_conf_s.556 *', 'char *', 'char *'] 25 0 2821 409 144 473 0 5247 557
ngx_http_v2_header_filter /src/nginx/src/http/v2/ngx_http_v2_filter_module.c 1 ['struct.ngx_http_request_s.3179 *'] 24 0 1840 214 74 188 1 1888 475
ngx_http_fastcgi_merge_loc_conf /src/nginx/src/http/modules/ngx_http_fastcgi_module.c 3 ['struct.ngx_conf_s.556 *', 'char *', 'char *'] 25 0 2352 345 121 462 0 5188 474
ngx_http_geo_block /src/nginx/src/http/modules/ngx_http_geo_module.c 3 ['struct.ngx_conf_s.556 *', 'struct.ngx_command_s.557 *', 'char *'] 6 0 603 68 29 108 0 914 415
ngx_http_block /src/nginx/src/http/ngx_http.c 3 ['struct.ngx_conf_s *', 'struct.ngx_command_s *', 'char *'] 12 0 734 91 37 210 0 2108 350
ngx_http_v2_state_headers /src/nginx/src/http/v2/ngx_http_v2.c 3 ['struct.ngx_http_v2_connection_s.4273 *', 'char *', 'char *'] 29 0 864 91 36 187 1 1773 313
ngx_http_uwsgi_merge_loc_conf /src/nginx/src/http/modules/ngx_http_uwsgi_module.c 3 ['struct.ngx_conf_s.556 *', 'char *', 'char *'] 25 0 2328 342 120 459 0 5018 284
ngx_http_scgi_merge_loc_conf /src/nginx/src/http/modules/ngx_http_scgi_module.c 3 ['struct.ngx_conf_s.556 *', 'char *', 'char *'] 25 0 2215 324 114 459 0 5007 262

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers
47.0%
784 / 1681
Cyclomatic complexity statically reachable by fuzzers
56.0%
9622 / 17248

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name Functions filename Args Function call depth Reached by Fuzzers Fuzzers runtime hit Func lines hit % I Count BB Count Cyclomatic complexity Functions reached Reached by functions Accumulated cyclomatic complexity Undiscovered complexity

Runtime coverage analysis

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name Function total lines Lines covered at runtime percentage covered Reached by fuzzers
ngx_conf_open_file 47 20 42.55% ['http_request_fuzzer']
ngx_open_listening_sockets 153 56 36.60% ['http_request_fuzzer']
ngx_configure_listening_sockets 50 18 36.0% ['http_request_fuzzer']
ngx_close_connection 61 27 44.26% ['http_request_fuzzer']
ngx_drain_connections 36 9 25.0% ['http_request_fuzzer']
ngx_init_cycle 610 182 29.83% ['http_request_fuzzer']
ngx_add_path 57 25 43.85% []
ngx_create_paths 49 25 51.02% ['http_request_fuzzer']
ngx_hash_add_key 186 39 20.96% []
ngx_parse_inet_url 141 52 36.87% []
ngx_log_set_log 52 24 46.15% []
ngx_log_set_levels 47 23 48.93% []
ngx_count_modules 39 21 53.84% []
ngx_output_chain 124 46 37.09% []
ngx_chain_writer 115 46 40.0% []
ngx_parse_offset 39 20 51.28% []
ngx_parse_time 143 60 41.95% []
ngx_parse_http_time 179 46 25.69% []
ngx_rbtree_insert 50 12 24.0% ['http_request_fuzzer']
ngx_rbtree_delete 118 18 15.25% ['http_request_fuzzer']
ngx_regex_compile 90 37 41.11% []
ngx_resolver_create 134 54 40.29% []
ngx_vslprintf 232 93 40.08% ['http_request_fuzzer']
ngx_sprintf_str 39 15 38.46% ['http_request_fuzzer']
ngx_handle_read_event 43 12 27.90% ['http_request_fuzzer']
ngx_handle_write_event 51 11 21.56% ['http_request_fuzzer']
ngx_event_connect_peer 180 58 32.22% []
ngx_http_access_handler 42 17 40.47% []
ngx_http_auth_basic_handler 142 20 14.08% []
ngx_http_browser_merge_conf 52 27 51.92% []
ngx_http_charset_postconfiguration 56 21 37.5% []
ngx_http_charset_header_filter 63 12 19.04% []
ngx_http_destination_charset 49 16 32.65% []
ngx_http_charset_body_filter 73 9 12.32% []
ngx_http_charset_merge_loc_conf 46 20 43.47% []
ngx_http_chunked_body_filter 90 10 11.11% []
ngx_http_fastcgi_init_params 153 19 12.41% []
ngx_http_gzip_header_filter 49 14 28.57% []
ngx_http_gzip_body_filter 100 9 9.0% []
ngx_http_headers_filter 63 13 20.63% []
ngx_http_trailers_filter 60 15 25.0% []
ngx_http_limit_conn_handler 92 18 19.56% []
ngx_http_limit_req_handler 97 21 21.64% []
ngx_http_log_init 32 15 46.87% []
ngx_http_log_handler 99 16 16.16% []
ngx_http_log_merge_loc_conf 41 20 48.78% []
ngx_http_log_set_log 223 21 9.417% []
ngx_http_map 158 67 42.40% []
ngx_http_mirror_handler 32 9 28.12% []
ngx_http_not_modified_header_filter 43 7 16.27% []
ngx_http_proxy_eval 68 37 54.41% []
ngx_http_proxy_create_request 264 136 51.51% []
ngx_http_proxy_non_buffered_chunked_filter 65 24 36.92% []
ngx_http_proxy_non_buffered_copy_filter 45 21 46.66% []
ngx_http_proxy_pass 81 30 37.03% []
ngx_http_proxy_cache 40 11 27.50% []
ngx_http_range_header_filter 87 14 16.09% []
ngx_http_referer_merge_conf 118 22 18.64% []
ngx_http_rewrite_handler 37 15 40.54% []
ngx_http_scgi_init_params 153 19 12.41% []
ngx_http_ssi_header_filter 54 10 18.51% []
ngx_http_ssi_body_filter 390 21 5.384% []
ngx_http_try_files_handler 147 16 10.88% []
ngx_http_uwsgi_init_params 153 19 12.41% []
ngx_http_merge_types 45 21 46.66% []
ngx_http_init_locations 91 41 45.05% []
ngx_http_create_locations_list 42 8 19.04% []
ngx_http_init_phases 51 27 52.94% []
ngx_http_server_names 111 52 46.84% []
ngx_http_core_find_config_phase 70 27 38.57% []
ngx_http_core_access_phase 47 12 25.53% []
ngx_http_core_content_phase 33 9 27.27% []
ngx_http_core_location 135 52 38.51% []
ngx_http_core_listen 179 34 18.99% []
ngx_http_header_filter 333 172 51.65% []
ngx_http_parse_request_line 563 263 46.71% ['http_request_fuzzer']
ngx_http_parse_complex_uri 266 77 28.94% ['http_request_fuzzer']
ngx_http_postpone_filter 54 13 24.07% []
ngx_http_init_connection 105 49 46.66% ['http_request_fuzzer']
ngx_http_process_request_header 74 31 41.89% ['http_request_fuzzer']
ngx_http_finalize_request 136 43 31.61% ['http_request_fuzzer']
ngx_http_wait_request_handler 92 34 36.95% ['http_request_fuzzer']
ngx_http_process_host 35 17 48.57% []
ngx_http_lingering_close_handler 42 23 54.76% ['http_request_fuzzer']
ngx_http_read_client_request_body 124 62 50.0% []
ngx_http_discard_request_body 50 26 52.0% ['http_request_fuzzer']
ngx_http_request_body_save_filter 75 32 42.66% []
ngx_http_do_read_client_request_body 122 60 49.18% []
ngx_http_script_compile 103 48 46.60% []
ngx_http_special_response_handler 82 29 35.36% ['http_request_fuzzer']
ngx_http_upstream_add 85 23 27.05% []
ngx_http_upstream_hide_headers_hash 86 39 45.34% []
ngx_http_upstream_process_transfer_encoding 32 14 43.75% []
ngx_http_upstream_server 105 38 36.19% []
ngx_http_upstream_init_request 197 72 36.54% []
ngx_http_upstream_process_headers 115 42 36.52% []
ngx_http_upstream_set_local 35 8 22.85% []
ngx_http_upstream_process_header 107 49 45.79% []
ngx_http_upstream_test_next 100 16 16.0% []
ngx_http_upstream_intercept_errors 68 11 16.17% []
ngx_http_upstream_send_response 233 42 18.02% []
ngx_http_upstream_send_request 82 31 37.80% []
ngx_http_upstream_send_request_body 81 19 23.45% []
ngx_http_upstream_init_round_robin 172 63 36.62% []
ngx_http_upstream_get_round_robin_peer 56 26 46.42% []
ngx_http_map_find 39 18 46.15% []
ngx_http_regex_exec 42 18 42.85% ['http_request_fuzzer']
ngx_http_variable_headers_internal 44 11 25.0% []
ngx_http_write_filter 239 69 28.87% []
ngx_http_v2_header_filter 380 29 7.631% []

Files and Directories in report

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file Reached by Covered by
[] []
/src/nginx/src/core/ngx_crypt.c [] []
/src/nginx/src/http/modules/ngx_http_not_modified_filter_module.c [] []
/src/nginx/src/http/modules/ngx_http_referer_module.c [] []
/src/nginx/src/http/ngx_http_huff_decode.c [] []
/src/LPM/external.protobuf/include/google/protobuf/has_bits.h [] []
/src/nginx/src/core/ngx_log.h [] []
/src/nginx/src/http/v2/ngx_http_v2_table.c [] []
/src/nginx/src/core/ngx_parse_time.c [] []
/src/nginx/src/os/unix/ngx_dlopen.c [] []
/src/nginx/src/event/ngx_event.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_rwlock.c [] []
/src/nginx/src/http/v2/ngx_http_v2_module.c [] []
/src/LPM/external.protobuf/include/google/protobuf/wire_format_lite.h [] []
/src/nginx/src/os/unix/ngx_time.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_ssi_filter_module.c [] []
/src/nginx/src/http/ngx_http_upstream_round_robin.c [] []
/src/nginx/src/http/modules/ngx_http_upstream_random_module.c [] []
/src/nginx/src/http/modules/ngx_http_access_module.c [] []
/src/LPM/external.protobuf/include/absl/log/internal/nullstream.h [] []
/src/nginx/src/core/ngx_open_file_cache.c [] []
/src/nginx/src/http/modules/ngx_http_static_module.c [] []
/src/nginx/src/core/ngx_string.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/ngx_http_huff_encode.c [] []
/src/nginx/src/os/unix/ngx_udp_sendmsg_chain.c [] []
/src/nginx/src/core/ngx_file.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_times.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_limit_conn_module.c [] []
/src/nginx/src/os/unix/ngx_udp_recv.c [] []
/src/nginx/src/os/unix/ngx_files.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_scgi_module.c [] []
/src/nginx/src/http/ngx_http_special_response.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_upstream_zone_module.c [] []
/src/nginx/src/fuzz/genfiles/http_request_proto.pb.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/os/unix/ngx_socket.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/ngx_http_variables.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_shmtx.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/ngx_http_upstream.c [] []
/src/nginx/src/http/v2/ngx_http_v2_filter_module.c [] []
/src/nginx/src/http/modules/ngx_http_memcached_module.c [] []
/src/nginx/src/os/unix/ngx_linux_sendfile_chain.c [] []
/src/nginx/src/event/ngx_event_pipe.c [] []
/src/nginx/src/core/ngx_resolver.c [] []
/src/nginx/src/http/modules/ngx_http_gzip_filter_module.c [] []
/src/LPM/external.protobuf/include/google/protobuf/message.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/event/ngx_event_accept.c [] []
/src/nginx/src/http/modules/ngx_http_charset_filter_module.c [] []
/src/nginx/src/core/ngx_spinlock.c [] []
/src/LPM/external.protobuf/include/google/protobuf/parse_context.h [] []
/src/LPM/external.protobuf/include/absl/numeric/bits.h [] []
/src/nginx/src/event/ngx_event_timer.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_geo_module.c [] []
/src/nginx/src/core/ngx_cpuinfo.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_auth_basic_module.c [] []
/src/nginx/src/core/nginx.c [] []
/src/nginx/src/core/ngx_rbtree.h ['http_request_fuzzer'] []
/src/nginx/src/core/ngx_list.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/os/unix/ngx_files.h ['http_request_fuzzer'] []
/src/nginx/src/os/unix/ngx_user.c [] []
/src/nginx/src/event/ngx_event_connect.c [] []
/src/nginx/src/core/ngx_module.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/ngx_http_script.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_headers_filter_module.c [] []
/src/nginx/src/core/ngx_log.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_sha1.c [] []
/src/nginx/src/os/unix/ngx_send.c [] []
/src/nginx/src/fuzz/http_request_fuzzer.cc ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_buf.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/ngx_http_copy_filter_module.c [] []
/src/nginx/src/http/modules/ngx_http_mirror_module.c [] []
/src/nginx/src/os/unix/ngx_writev_chain.c [] []
/src/nginx/src/http/ngx_http_parse.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_try_files_module.c [] []
/src/nginx/src/os/unix/ngx_udp_send.c [] []
/src/nginx/src/http/modules/ngx_http_proxy_module.c [] []
/src/nginx/src/event/ngx_event_posted.c [] []
/src/nginx/src/http/ngx_http_file_cache.c [] []
/src/nginx/src/http/modules/ngx_http_uwsgi_module.c [] []
/src/nginx/src/http/ngx_http_postpone_filter_module.c [] []
/src/LPM/external.protobuf/include/google/protobuf/arena.h [] []
/src/nginx/src/http/modules/ngx_http_empty_gif_module.c [] []
/src/nginx/src/os/unix/ngx_shmem.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_murmurhash.c [] []
/src/nginx/src/http/modules/ngx_http_map_module.c [] []
/src/nginx/src/os/unix/ngx_linux_init.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_upstream_ip_hash_module.c [] []
/src/nginx/src/core/ngx_output_chain.c [] []
/src/nginx/src/http/v2/ngx_http_v2.c ['http_request_fuzzer'] []
/src/nginx/src/http/modules/ngx_http_range_filter_module.c [] []
/src/nginx/src/http/v2/ngx_http_v2.h ['http_request_fuzzer'] []
/src/nginx/src/http/v2/ngx_http_v2_encode.c [] []
/src/nginx/src/http/modules/ngx_http_upstream_keepalive_module.c [] []
/src/nginx/src/http/modules/ngx_http_split_clients_module.c [] []
/src/nginx/src/core/ngx_inet.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/ngx_http_request_body.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/event/ngx_event_udp.c [] []
/src/nginx/src/core/ngx_crc32.h ['http_request_fuzzer'] []
/src/nginx/src/event/ngx_event_timer.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_parse.c [] []
/src/nginx/src/http/modules/ngx_http_grpc_module.c [] []
/src/nginx/src/http/ngx_http.c [] []
/src/LPM/external.protobuf/include/google/protobuf/message_lite.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/os/unix/ngx_setproctitle.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_rbtree.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/fuzz/wrappers.c [] []
/src/nginx/src/http/ngx_http_core_module.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_conf_file.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_userid_filter_module.c [] []
/src/nginx/src/os/unix/ngx_alloc.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_string.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/LPM/external.protobuf/include/google/protobuf/metadata_lite.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_index_module.c [] []
/src/nginx/src/os/unix/ngx_errno.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_palloc.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_hash.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/ngx_http_request.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_limit_req_module.c [] []
/src/nginx/src/core/ngx_queue.c [] []
/src/nginx/src/http/modules/ngx_http_browser_module.c [] []
/src/LPM/external.protobuf/include/google/protobuf/io/coded_stream.h [] []
/src/LPM/external.protobuf/include/google/protobuf/generated_message_util.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_array.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_proxy_protocol.c ['http_request_fuzzer'] []
/src/nginx/src/core/ngx_crc32.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_rewrite_module.c [] []
/src/nginx/src/core/ngx_bpf.c [] []
/src/nginx/src/os/unix/ngx_process.c [] []
/src/nginx/src/http/modules/ngx_http_fastcgi_module.c [] []
/src/nginx/src/http/modules/ngx_http_upstream_least_conn_module.c [] []
/src/nginx/src/http/ngx_http_write_filter_module.c [] []
/src/nginx/src/core/ngx_list.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_chunked_filter_module.c [] []
/src/nginx/src/fuzz/genfiles/http_request_proto.pb.cc ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_autoindex_module.c [] []
/src/nginx/src/event/modules/ngx_epoll_module.c [] []
/src/nginx/src/core/ngx_md5.c [] []
/src/nginx/src/core/ngx_regex.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/modules/ngx_http_log_module.c [] []
/src/nginx/src/os/unix/ngx_recv.c [] []
/src/nginx/src/core/ngx_connection.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/LPM/external.protobuf/include/google/protobuf/arenastring.h ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_cycle.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/core/ngx_array.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/os/unix/ngx_readv_chain.c [] []
/src/nginx/src/os/unix/ngx_process_cycle.c [] []
/src/LPM/external.protobuf/include/google/protobuf/arena_align.h [] []
/src/nginx/src/os/unix/ngx_daemon.c [] []
/src/nginx/src/http/modules/ngx_http_upstream_hash_module.c [] []
/src/nginx/src/core/ngx_syslog.c [] []
/src/nginx/src/os/unix/ngx_setaffinity.c [] []
/src/nginx/src/os/unix/ngx_posix_init.c ['http_request_fuzzer'] ['http_request_fuzzer']
/src/nginx/src/http/ngx_http_header_filter_module.c [] []
/src/nginx/src/core/ngx_radix_tree.c [] []
/src/nginx/src/core/ngx_slab.c ['http_request_fuzzer'] []
/src/nginx/src/os/unix/ngx_channel.c [] []
/src/LPM/external.protobuf/include/google/protobuf/wire_format.h [] []

Directories in report

Directory
/src/nginx/src/os/unix/
/src/LPM/external.protobuf/include/google/protobuf/io/
/src/LPM/external.protobuf/include/absl/log/internal/
/src/nginx/src/http/modules/
/src/LPM/external.protobuf/include/google/protobuf/
/src/nginx/src/http/v2/
/src/nginx/src/event/
/src/nginx/src/fuzz/genfiles/
/src/nginx/src/event/modules/
/src/nginx/src/fuzz/
/src/nginx/src/http/
/src/LPM/external.protobuf/include/absl/numeric/
/src/nginx/src/core/

Metadata section

This sections shows the raw data that is used to produce this report. This is mainly used for further processing and developer debugging.

Fuzzer Calltree file Program data file Coverage file
http_request_fuzzer fuzzerLogFile-0-p0PmSY2XvK.data fuzzerLogFile-0-p0PmSY2XvK.data.yaml http_request_fuzzer.covreport