High level conclusions

Fuzzers reach 62.20% code coverage.

Fuzzers reach 63.78% of cyclomatic complexity.

Fuzzers reach 66.09% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

2025 / 3064

Cyclomatic complexity statically reachable by fuzzers

9251 / 14503

Runtime code coverage of functions

1906 / 3064

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_json_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	23.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	76.9%
All colors	52	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
60	60	1 : View List ['addMultiArrayContentJSON']	60	138	Variant_encodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:1117
41	41	2 : View List ['UA_String_clear.5471', 'UA_ExpandedNodeId_print']	41	41	ExpandedNodeId_encodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:819
36	36	2 : View List ['UA_String_clear.5471', 'UA_NodeId_print']	36	36	NodeId_encodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:774
12	27	3 : View List ['writeJsonArrStart', 'writeJsonArrElm', 'writeJsonArrEnd']	12	27	Variant_encodeJsonWrapExtensionObject	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:1031
8	8	1 : View List ['arrayOrder']	8	8	variantOrder	call site: 00000	/src/open62541/src/ua_types.c:1708
6	102	6 : View List ['writeJsonObjStart', 'writeJsonKey', 'String_encodeJson', 'writeJsonObjEnd', 'UA_StatusCode_name', 'UA_STRING.5487']	6	116	StatusCode_encodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:950
4	4	1 : View List ['UA_Variant_isScalar']	20	20	variantOrder	call site: 00000	/src/open62541/src/ua_types.c:1686
2	2	1 : View List ['memcmp']	2	2	stringOrder	call site: 00000	/src/open62541/src/ua_types.c:1581
0	57	1 : View List ['diagnosticInfoOrder']	0	57	diagnosticInfoOrder	call site: 00000	/src/open62541/src/ua_types.c:1807
0	39	1 : View List ['String_encodeJson']	0	118	QualifiedName_encodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:919
0	39	1 : View List ['String_encodeJson']	0	104	NodeId_encodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:785
0	20	1 : View List ['variantOrder']	0	20	dataValueOrder	call site: 00000	/src/open62541/src/ua_types.c:1721

Runtime coverage analysis

Covered functions

170

Functions that are reachable but not covered

3

Reachable functions

24

Percentage of reachable functions covered

87.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated_handling.h	5
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	2

Fuzzer: fuzz_src_ua_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	36.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	21	63.6%
All colors	33	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	6	UA_memoryManager_setLimitFromLast4Bytes	call site: 00006	removeFromMap
3	2	UA_memoryManager_setLimitFromLast4Bytes	call site: 00002	addToMap
3	14	UA_memoryManager_setLimitFromLast4Bytes	call site: 00014	removeFromMap
2	11	UA_memoryManager_setLimitFromLast4Bytes	call site: 00011	addToMap

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

13

Reachable functions

23

Percentage of reachable functions covered

43.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	3
/src/open62541/tests/fuzz/custom_memory_manager.c	7
/src/open62541/src/ua_util.c	4

Fuzzer: fuzz_mdns_xht

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	100.%
All colors	27	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	xht_free	call site: 00026	/src/open62541/deps/mdnsd/libmdnsd/xht.c:147
0	0	1 : View List ['free']	0	0	_xht_set	call site: 00009	/src/open62541/deps/mdnsd/libmdnsd/xht.c:91

Runtime coverage analysis

Covered functions

14

Functions that are reachable but not covered

4

Reachable functions

18

Percentage of reachable functions covered

77.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/deps/mdnsd/tests/fuzz/fuzz_mdns_xht.cc	1
/src/open62541/deps/mdnsd/libmdnsd/sdtxt.c	5
/src/open62541/deps/mdnsd/libmdnsd/xht.c	8

Fuzzer: fuzz_base64_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	0	UA_unbase64	call site: 00001	/src/open62541/deps/base64.c:87

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	1
/src/open62541/deps/base64.c	1

Fuzzer: fuzz_json_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	25	100.%
All colors	25	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	11	2 : View List ['UA_Array_delete', 'UA_copy']	0	11	UA_Array_copy	call site: 00000	/src/open62541/src/ua_types.c:1970
0	0	None	0	191	Variant_decodeJsonUnwrapExtensionObject	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:2457
0	0	None	0	114	UA_decodeJson	call site: 00002	/src/open62541/src/ua_types_encoding_json.c:2767
0	0	None	0	114	UA_decodeJson	call site: 00002	/src/open62541/src/ua_types_encoding_json.c:2776
0	0	None	0	112	tokenize	call site: 00004	/src/open62541/src/ua_types_encoding_json.c:2747
0	0	None	0	84	cj5_parse	call site: 00004	/src/open62541/deps/cj5.c:354
0	0	None	0	47	DiagnosticInfoInner_decodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:2505
0	0	None	0	40	Variant_decodeJsonUnwrapExtensionObject	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:2443
0	0	None	0	38	ExtensionObject_decodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:2379
0	0	None	0	38	Variant_decodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:2254
0	0	None	0	30	String_decodeJson	call site: 00000	/src/open62541/src/ua_types_encoding_json.c:1733
0	0	None	0	18	clearStructure	call site: 00000	/src/open62541/src/ua_types.c:1418

Runtime coverage analysis

Covered functions

102

Functions that are reachable but not covered

0

Reachable functions

15

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode.cc	1
/work/open62541/src_generated/open62541/types_generated_handling.h	2
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	1

Fuzzer: fuzz_tcp_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1827	17.4%
gold	[1:9]	18	0.17%
yellow	[10:29]	1	0.00%
greenyellow	[30:49]	12	0.11%
lawngreen	50+	8602	82.2%
All colors	10460	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1072	1238	2 : View List ['readValueAttribute', 'setDefaultValue']	1074	2720	typeCheckVariableNode	call site: 02567	/src/open62541/src/server/ua_services_nodemanagement.c:338
134	134	1 : View List ['TCP_openActiveConnection']	134	134	TCP_openConnection	call site: 00300	/src/open62541/arch/eventloop_posix_tcp.c:898
108	108	1 : View List ['UA_Variant_copyRange']	108	108	readValueAttributeFromNode	call site: 01656	/src/open62541/src/server/ua_services_attribute.c:179
63	63	1 : View List ['RefTree_double']	63	120	RefTree_add	call site: 01299	/src/open62541/src/server/ua_services_view.c:267
32	32	2 : View List ['UA_Session_getNodeDisplayName', 'UA_LocalizedText_copy.2444']	36	57	addReferenceDescription	call site: 02629	/src/open62541/src/server/ua_services_view.c:574
30	30	2 : View List ['Array_encodeBinaryComplex', 'Array_encodeBinaryOverlayable']	30	30	Array_encodeBinary	call site: 00000	/src/open62541/src/ua_types_encoding_binary.c:448
29	29	1 : View List ['readValueAttributeFromDataSource']	29	29	readValueAttributeComplete	call site: 01677	/src/open62541/src/server/ua_services_attribute.c:264
23	23	1 : View List ['UA_ExpandedNodeId_order']	23	23	cmpTarget	call site: 01300	/src/open62541/src/server/ua_services_view.c:193
19	19	3 : View List ['UA_EventLoopPOSIX_modifyFD', 'UA_LOG_INFO.6375', 'getSockError']	19	87	TCP_connectionSocketCallback	call site: 00000	/src/open62541/arch/eventloop_posix_tcp.c:149
15	21	2 : View List ['_r_push', '_r_remove_lists']	15	21	_r_send	call site: 02076	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:290
10	10	3 : View List ['UA_LOG_WARNING.6289', '__errno_location', 'strerror']	10	10	UA_EventLoopPOSIX_pollFDs	call site: 00000	/src/open62541/arch/eventloop_posix_epoll.c:86
10	10	3 : View List ['__errno_location', 'UA_LOG_ERROR.3555', 'strerror']	10	10	startMulticastDiscoveryServer	call site: 01899	/src/open62541/src/server/ua_services_discovery_multicast.c:206

Runtime coverage analysis

Covered functions

1662

Functions that are reachable but not covered

458

Reachable functions

2069

Percentage of reachable functions covered

77.86%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	2
/src/open62541/tests/fuzz/custom_memory_manager.c	8
/src/open62541/plugins/include/open62541/server_config_default.h	1
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_hashmap.c	22
/src/open62541/src/server/ua_nodes.c	48
/src/open62541/include/open62541/plugin/nodestore.h	6
/work/open62541/src_generated/open62541/types_generated_handling.h	93
/src/open62541/src/ua_types.c	49
/src/open62541/src/server/ua_server_internal.h	17
/src/open62541/deps/ziptree.c	7
/src/open62541/include/open62541/types.h	15
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/tests/testing-plugins/testing_clock.c	3
/src/open62541/deps/libc_time.c	1
/src/open62541/arch/posix/ua_architecture.h	5
/src/open62541/arch/eventloop_posix.c	14
/src/open62541/arch/common/ua_timer.c	16
/src/open62541/arch/eventloop_posix_tcp.c	12
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/eventloop_common.c	1
/src/open62541/src/ua_util.c	10
/src/open62541/arch/eventloop_posix_epoll.c	2
/src/open62541/arch/eventloop_posix.h	3
/src/open62541/arch/eventloop_posix_udp.c	28
/src/open62541/arch/eventloop_posix_interrupt.c	9
/src/open62541/plugins/crypto/ua_pki_none.c	4
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	16
/src/open62541/plugins/crypto/mbedtls/securitypolicy_mbedtls_common.c	2
/src/open62541/deps/pcg_basic.c	1
/src/open62541/plugins/ua_accesscontrol_default.c	16
/src/open62541/src/server/ua_server.c	24
/src/open62541/src/ua_util_internal.h	7
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/src/server/ua_session.c	9
/src/open62541/src/server/ua_server_async.c	11
/src/open62541/src/server/ua_services_session.c	4
/src/open62541/src/server/ua_server_binary.c	29
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	15
/src/open62541/src/ua_types_encoding_binary.c	4
/work/open62541/src_generated/open62541/transport_generated_handling.h	4
/src/open62541/src/server/ua_services_securechannel.c	4
/src/open62541/src/server/ua_subscription.c	15
/src/open62541/deps/itoa.c	3
/src/open62541/src/server/ua_services_view.c	35
/src/open62541/src/server/ua_services_nodemanagement.c	54
/src/open62541/src/server/ua_server_utils.c	7
/src/open62541/src/server/ua_subscription_monitoreditem.c	16
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_method.c	9
/src/open62541/src/server/ua_services_attribute.c	43
/src/open62541/src/server/ua_discovery_manager.c	5
/src/open62541/src/server/ua_services_discovery_multicast.c	11
/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c	42
/src/open62541/src/server/ua_server_discovery_mdns.c	11
/src/open62541/deps/mdnsd/libmdnsd/sdtxt.c	5
/src/open62541/deps/mdnsd/libmdnsd/xht.c	9
/src/open62541/arch/posix/ua_architecture_functions.c	2
/src/open62541/deps/mdnsd/libmdnsd/1035.c	20
/src/open62541/src/server/ua_server_ns0.c	10
/src/open62541/src/server/ua_subscription_datachange.c	5
/work/open62541/src_generated/open62541/namespace0_generated.c	1113

Fuzzer: fuzz_base64_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	0	None	0	4	UA_base64	call site: 00001	/src/open62541/deps/base64.c:28
0	0	None	0	0	UA_base64	call site: 00001	/src/open62541/deps/base64.c:18
0	0	None	0	0	UA_base64	call site: 00001	/src/open62541/deps/base64.c:24

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	1
/src/open62541/deps/base64.c	2

Fuzzer: fuzz_binary_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2050	19.6%
gold	[1:9]	27	0.25%
yellow	[10:29]	7	0.06%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	8329	79.9%
All colors	10413	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1072	1238	2 : View List ['readValueAttribute', 'setDefaultValue']	1072	2720	typeCheckVariableNode	call site: 02568	/src/open62541/src/server/ua_services_nodemanagement.c:338
348	354	7 : View List ['UA_SecureChannel_processBuffer', 'setBinaryProtocolManagerState', 'UA_SecureChannel_sendError', 'UA_StatusCode_name', 'deleteServerSecureChannel', 'UA_SecureChannel_shutdown', 'createServerSecureChannel']	348	354	serverNetworkCallback	call site: 01038	/src/open62541/src/server/ua_server_binary.c:1165
108	108	1 : View List ['UA_Variant_copyRange']	108	108	readValueAttributeFromNode	call site: 01657	/src/open62541/src/server/ua_services_attribute.c:179
63	63	1 : View List ['RefTree_double']	63	120	RefTree_add	call site: 01300	/src/open62541/src/server/ua_services_view.c:267
32	32	2 : View List ['UA_Session_getNodeDisplayName', 'UA_LocalizedText_copy.2444']	36	57	addReferenceDescription	call site: 02630	/src/open62541/src/server/ua_services_view.c:574
29	29	1 : View List ['readValueAttributeFromDataSource']	29	29	readValueAttributeComplete	call site: 01678	/src/open62541/src/server/ua_services_attribute.c:264
8	8	3 : View List ['__errno_location', 'UA_LOG_WARNING.6254', 'strerror']	8	8	UA_EventLoopPOSIX_start	call site: 00000	/src/open62541/arch/eventloop_posix.c:137
6	6	1 : View List ['moveTreeToArray']	6	6	UA_NodeReferenceKind_switch	call site: 00087	/src/open62541/src/server/ua_nodes.c:309
4	4	1 : View List ['UA_ReferenceDescription_clear']	4	4	addReferenceDescription	call site: 02633	/src/open62541/src/server/ua_services_view.c:593
2	2	1 : View List ['calculateNextTime']	2	55	UA_Timer_addRepeatedCallback	call site: 00235	/src/open62541/arch/common/ua_timer.c:113
0	1832	4 : View List ['UA_Variant_setArray', 'addNode', 'UA_LOCALIZEDTEXT.3399', 'UA_QUALIFIEDNAME.3414']	0	4573	UA_Server_addMethodNodeEx_finish	call site: 08608	/src/open62541/src/server/ua_services_nodemanagement.c:2611
0	1044	1 : View List ['deleteNode']	0	1044	UA_Server_addMethodNodeEx_finish	call site: 08617	/src/open62541/src/server/ua_services_nodemanagement.c:2636

Runtime coverage analysis

Covered functions

1542

Functions that are reachable but not covered

551

Reachable functions

2060

Percentage of reachable functions covered

73.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_message.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	7
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_hashmap.c	22
/src/open62541/src/server/ua_nodes.c	48
/src/open62541/include/open62541/plugin/nodestore.h	6
/work/open62541/src_generated/open62541/types_generated_handling.h	94
/src/open62541/src/ua_types.c	49
/src/open62541/src/server/ua_server_internal.h	17
/src/open62541/deps/ziptree.c	7
/src/open62541/include/open62541/types.h	15
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/tests/testing-plugins/testing_clock.c	3
/src/open62541/deps/libc_time.c	1
/src/open62541/arch/posix/ua_architecture.h	5
/src/open62541/arch/eventloop_posix.c	14
/src/open62541/arch/common/ua_timer.c	16
/src/open62541/arch/eventloop_posix_tcp.c	12
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/eventloop_common.c	1
/src/open62541/src/ua_util.c	10
/src/open62541/arch/eventloop_posix_epoll.c	2
/src/open62541/arch/eventloop_posix.h	3
/src/open62541/arch/eventloop_posix_udp.c	28
/src/open62541/arch/eventloop_posix_interrupt.c	9
/src/open62541/plugins/crypto/ua_pki_none.c	4
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	16
/src/open62541/plugins/crypto/mbedtls/securitypolicy_mbedtls_common.c	2
/src/open62541/deps/pcg_basic.c	1
/src/open62541/plugins/ua_accesscontrol_default.c	16
/src/open62541/src/server/ua_server.c	21
/src/open62541/src/ua_util_internal.h	7
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/src/server/ua_session.c	9
/src/open62541/src/server/ua_server_async.c	11
/src/open62541/src/server/ua_services_session.c	4
/src/open62541/src/server/ua_server_binary.c	29
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	15
/src/open62541/src/ua_types_encoding_binary.c	4
/work/open62541/src_generated/open62541/transport_generated_handling.h	4
/src/open62541/src/server/ua_services_securechannel.c	4
/src/open62541/src/server/ua_subscription.c	15
/src/open62541/deps/itoa.c	3
/src/open62541/src/server/ua_services_view.c	35
/src/open62541/src/server/ua_services_nodemanagement.c	54
/src/open62541/src/server/ua_server_utils.c	7
/src/open62541/src/server/ua_subscription_monitoreditem.c	16
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_method.c	9
/src/open62541/src/server/ua_services_attribute.c	43
/src/open62541/src/server/ua_discovery_manager.c	5
/src/open62541/src/server/ua_services_discovery_multicast.c	11
/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c	42
/src/open62541/src/server/ua_server_discovery_mdns.c	11
/src/open62541/deps/mdnsd/libmdnsd/sdtxt.c	5
/src/open62541/deps/mdnsd/libmdnsd/xht.c	9
/src/open62541/arch/posix/ua_architecture_functions.c	2
/src/open62541/deps/mdnsd/libmdnsd/1035.c	20
/src/open62541/src/server/ua_server_ns0.c	10
/src/open62541/src/server/ua_subscription_datachange.c	5
/work/open62541/src_generated/open62541/namespace0_generated.c	1113

Fuzzer: fuzz_mdns_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	29	32.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	60	67.4%
All colors	89	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
23	23	1 : View List ['_q_answer']	23	23	_cache	call site: 00084	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:520
0	0	None	39	142	mdnsd_in	call site: 00064	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:758
0	0	None	39	142	mdnsd_in	call site: 00066	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:762
0	0	None	23	23	_c_expire	call site: 00072	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:420
0	0	None	8	8	_a_match	call site: 00041	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:196
0	0	None	2	2	_r_next	call site: 00036	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:164
0	0	None	2	2	_q_next	call site: 00084	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:134
0	0	None	0	0	message_parse	call site: 00001	/src/open62541/deps/mdnsd/libmdnsd/1035.c:457
0	0	None	0	0	message_parse	call site: 00012	/src/open62541/deps/mdnsd/libmdnsd/1035.c:519
0	0	None	0	0	_label	call site: 00009	/src/open62541/deps/mdnsd/libmdnsd/1035.c:148
0	0	None	0	0	mdnsd_in	call site: 00034	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:681
0	0	None	0	0	mdnsd_in	call site: 00061	/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c:752

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

20

Reachable functions

37

Percentage of reachable functions covered

45.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/deps/mdnsd/tests/fuzz/fuzz_mdns_message.cc	1
/src/open62541/deps/mdnsd/libmdnsd/1035.c	6
/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c	20

Fuzzer: fuzz_binary_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	14	27.4%
gold	[1:9]	1	1.96%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	70.5%
All colors	51	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
3	7	3 : View List ['isGood', 'exchangeBuffer', 'isTrue']	3	7	encodeWithExchangeBuffer	call site: 00041	/src/open62541/src/ua_types_encoding_binary.c:104
0	11	3 : View List ['UInt32_encodeBinary', 'isGood', 'isTrue']	0	24	Variant_encodeBinaryWrapExtensionObject	call site: 00000	/src/open62541/src/ua_types_encoding_binary.c:929
0	8	2 : View List ['UA_calcSizeBinary', 'UA_ByteString_allocBuffer']	4	30	UA_encodeBinary	call site: 00036	/src/open62541/src/ua_types_encoding_binary.c:1507
0	0	None	4	4	addToMap	call site: 00003	/src/open62541/tests/fuzz/custom_memory_manager.c:49
0	0	None	0	109	Variant_encodeBinary	call site: 00000	/src/open62541/src/ua_types_encoding_binary.c:972
0	0	None	0	107	ExtensionObject_encodeBinary	call site: 00000	/src/open62541/src/ua_types_encoding_binary.c:830
0	0	None	0	57	diagnosticInfoOrder	call site: 00000	/src/open62541/src/ua_types.c:1809
0	0	None	0	54	copyStructure	call site: 00000	/src/open62541/src/ua_types.c:1286
0	0	None	0	28	extensionObjectOrder	call site: 00000	/src/open62541/src/ua_types.c:1622
0	0	None	0	28	extensionObjectOrder	call site: 00000	/src/open62541/src/ua_types.c:1624
0	0	None	0	18	ExtensionObject_copy	call site: 00000	/src/open62541/src/ua_types.c:677
0	0	None	0	18	clearStructure	call site: 00000	/src/open62541/src/ua_types.c:1418

Runtime coverage analysis

Covered functions

141

Functions that are reachable but not covered

8

Reachable functions

33

Percentage of reachable functions covered

75.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	7
/src/open62541/src/ua_types.c	6
/src/open62541/src/ua_types_encoding_binary.c	7
/work/open62541/src_generated/open62541/types_generated_handling.h	3
/src/open62541/src/ua_util_internal.h	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
UA_Server_addPeriodicServerRegisterCallback	/src/open62541/src/server/ua_services_discovery.c	6	['struct.UA_Server *', 'struct.UA_Client *', 'char *', 'N/A', 'N/A', 'size_t *']	14	0	421	41	15	231	0	1125	580
UA_ServerConfig_setDefaultWithSecurityPolicies	/src/open62541/plugins/ua_config_default.c	10	['struct.UA_ServerConfig.5425 *', 'N/A', 'struct.UA_String *', 'struct.UA_String *', 'struct.UA_String *', 'size_t ', 'struct.UA_String *', 'size_t ', 'struct.UA_String *', 'size_t ']	8	0	170	17	8	438	0	1737	560
lteOperator	/src/open62541/src/server/ua_subscription_events_filter.c	2	['struct.UA_FilterEvalContext *', 'size_t ']	6	0	20	3	2	150	0	923	207
Service_CreateMonitoredItems	/src/open62541/src/server/ua_services_monitoreditem.c	4	['struct.UA_Server *', 'struct.UA_Session *', 'struct.UA_CreateMonitoredItemsRequest *', 'struct.UA_CreateMonitoredItemsResponse *']	8	0	118	13	6	191	0	1060	202
DataValue_encodeJson	/src/open62541/src/ua_types_encoding_json.c	3	['struct.CtxJson *', 'struct.UA_DataValue *', 'struct.UA_DataType *']	6	0	232	21	8	49	0	268	179
ExpandedNodeId_decodeJson	/src/open62541/src/ua_types_encoding_json.c	3	['struct.ParseCtx *', 'struct.UA_ExpandedNodeId *', 'struct.UA_DataType *']	4	0	185	14	5	35	0	220	149
UA_Server_triggerEvent	/src/open62541/src/server/ua_subscription_events.c	5	['struct.UA_Server *', 'struct.UA_NodeId *', 'struct.UA_NodeId *', 'struct.UA_String *', 'N/A']	9	0	38	3	2	257	0	1404	91

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2322 / 3064

Cyclomatic complexity statically reachable by fuzzers

11155 / 14503

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
clearStructure	35	19	54.28%	[]
UA_encodeJson	37	19	51.35%	['fuzz_json_decode_encode']
NodeId_encodeJson	33	14	42.42%	[]
ExpandedNodeId_encodeJson	48	21	43.75%	[]
UA_KeyValueRestriction_validate	35	15	42.85%	['fuzz_tcp_message', 'fuzz_binary_message']
UA_EventLoopPOSIX_pollFDs	31	15	48.38%	[]
TCP_registerListenSocket	133	63	47.36%	['fuzz_tcp_message', 'fuzz_binary_message']
__ZIP_UNZIP	41	19	46.34%	['fuzz_tcp_message', 'fuzz_binary_message']
UA_DiscoveryManager_free	44	19	43.18%	['fuzz_tcp_message', 'fuzz_binary_message']
UA_NodePointer_copy	42	11	26.19%	['fuzz_tcp_message', 'fuzz_binary_message']
UA_Node_insertOrUpdateLocale	37	18	48.64%	['fuzz_tcp_message', 'fuzz_binary_message']
deleteServerSecureChannel	32	16	50.0%	['fuzz_tcp_message', 'fuzz_binary_message']
processSecureChannelMessage	57	12	21.05%	['fuzz_tcp_message', 'fuzz_binary_message']
mdns_create_txt	60	24	40.0%	['fuzz_tcp_message', 'fuzz_binary_message']
getAllInterfaceChildNodeIds	91	41	45.05%	['fuzz_tcp_message', 'fuzz_binary_message']
ReadWithNode	209	46	22.00%	['fuzz_tcp_message', 'fuzz_binary_message']
compatibleValue	37	20	54.05%	['fuzz_tcp_message', 'fuzz_binary_message']
readValueAttributeComplete	58	23	39.65%	['fuzz_tcp_message', 'fuzz_binary_message']
attributeId2AttributeMask	32	6	18.75%	['fuzz_tcp_message', 'fuzz_binary_message']
unwrapEOArray	31	4	12.90%	['fuzz_tcp_message', 'fuzz_binary_message']
copyAttributeIntoNode	157	50	31.84%	['fuzz_tcp_message', 'fuzz_binary_message']
writeNodeValueAttribute	107	42	39.25%	['fuzz_tcp_message', 'fuzz_binary_message']
discovery_createMulticastSocket	64	35	54.68%	['fuzz_tcp_message', 'fuzz_binary_message']
addNode_addRefs	156	85	54.48%	['fuzz_tcp_message', 'fuzz_binary_message']
useVariableTypeAttributes	47	20	42.55%	['fuzz_tcp_message', 'fuzz_binary_message']
typeCheckVariableNode	73	32	43.83%	['fuzz_tcp_message', 'fuzz_binary_message']
copyChild	113	16	14.15%	['fuzz_tcp_message', 'fuzz_binary_message']
recursiveCallConstructors	95	40	42.10%	['fuzz_tcp_message', 'fuzz_binary_message']
deleteNodeOperation	48	26	54.16%	['fuzz_tcp_message', 'fuzz_binary_message']
UA_Server_addMethodNodeEx_finish	89	39	43.82%	['fuzz_tcp_message', 'fuzz_binary_message']
Operation_Browse	93	43	46.23%	['fuzz_tcp_message', 'fuzz_binary_message']
browseWithNode	64	23	35.93%	['fuzz_tcp_message', 'fuzz_binary_message']
assembleProcessMessage	46	11	23.91%	['fuzz_tcp_message', 'fuzz_binary_message']
UA_Array_resize	36	16	44.44%	['fuzz_tcp_message', 'fuzz_binary_message']
mdnsd_in	66	23	34.84%	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_mdns_message']
structureOrder	51	28	54.90%	[]

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/work/open62541/src_generated/open62541/transport_generated_handling.h	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/src/open62541/arch/eventloop_posix_epoll.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message']
/src/open62541/include/open62541/plugin/nodestore.h	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_services_method.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/work/open62541/src_generated/open62541/statuscodes.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/tests/testing-plugins/testing_networklayers.c	[]	[]
/src/open62541/src/server/ua_server_ns0_diagnostics.c	[]	[]
/src/open62541/deps/mdnsd/tests/fuzz/fuzz_mdns_xht.cc	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/src/ua_types_encoding_json.h	[]	[]
/src/open62541/src/server/ua_server_discovery_mdns.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message']
/src/open62541/plugins/crypto/mbedtls/ua_pki_mbedtls.c	[]	[]
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_services_nodemanagement.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/client/ua_client_discovery.c	[]	[]
/src/open62541/plugins/ua_config_default.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_session.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/deps/ziptree.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/plugins/crypto/ua_pki_none.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/arch/posix/ua_architecture_functions.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message']
/src/open62541/plugins/crypto/mbedtls/ua_securitypolicy_basic256sha256.c	[]	[]
/src/open62541/src/server/ua_server_async.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_nodes.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_subscription_events_filter.c	[]	[]
/usr/include/mbedtls/pk.h	[]	[]
/src/open62541/plugins/crypto/mbedtls/ua_securitypolicy_basic128rsa15.c	[]	[]
/src/open62541/plugins/ua_accesscontrol_default.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/arch/eventloop_common.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_services_discovery.c	[]	[]
/src/open62541/src/server/ua_server_binary.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/arch/eventloop_posix.h	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/deps/base64.c	['fuzz_base64_decode', 'fuzz_base64_encode']	['fuzz_base64_decode', 'fuzz_base64_encode']
/src/open62541/include/open62541/util.h	[]	[]
/src/open62541/src/server/ua_subscription_events.c	[]	[]
/src/open62541/tests/fuzz/custom_memory_manager.c	['fuzz_src_ua_util', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']	['fuzz_src_ua_util', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']
/src/open62541/arch/eventloop_posix.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/work/open62541/src_generated/open62541/namespace0_generated.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/plugins/ua_nodestore_hashmap.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/plugins/crypto/mbedtls/ua_securitypolicy_basic256.c	[]	[]
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	['fuzz_tcp_message']	['fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	['fuzz_binary_decode']	['fuzz_binary_decode']
/src/open62541/src/client/ua_client_highlevel.c	[]	[]
/src/open62541/src/server/ua_services_attribute.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/include/open62541/client.h	[]	[]
/src/open62541/src/ua_types.c	['fuzz_json_decode_encode', 'fuzz_json_decode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']	['fuzz_json_decode_encode', 'fuzz_json_decode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']
/src/open62541/tests/fuzz/fuzz_json_decode.cc	['fuzz_json_decode']	['fuzz_json_decode']
/src/open62541/deps/parse_num.c	[]	[]
/src/open62541/include/open62541/plugin/log.h	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	['fuzz_base64_decode']	['fuzz_base64_decode']
/src/open62541/src/server/ua_services_securechannel.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/src/open62541/tests/fuzz/fuzz_binary_message.cc	['fuzz_binary_message']	['fuzz_binary_message']
/src/open62541/deps/mdnsd/tests/fuzz/fuzz_mdns_message.cc	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/plugins/include/open62541/server_config_default.h	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/ua_util.c	['fuzz_src_ua_util', 'fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_src_ua_util', 'fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_discovery_manager.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/deps/mdnsd/libmdnsd/sdtxt.c	['fuzz_mdns_xht', 'fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_mdns_xht', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	['fuzz_src_ua_util']	['fuzz_src_ua_util']
/src/open62541/src/server/ua_server_discovery.c	[]	[]
/src/open62541/tests/testing-plugins/testing_clock.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/deps/libc_time.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message']
/src/open62541/src/server/ua_server_utils.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_subscription_monitoreditem.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/src/open62541/src/server/ua_server_ns0.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/arch/posix/ua_architecture.h	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/ua_types_encoding_binary.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']	['fuzz_tcp_message', 'fuzz_binary_decode']
/src/open62541/deps/mdnsd/libmdnsd/xht.c	['fuzz_mdns_xht', 'fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_mdns_xht', 'fuzz_tcp_message']
/src/open62541/src/server/ua_server.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/deps/itoa.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/src/open62541/src/ua_types_lex.c	[]	[]
/src/open62541/src/client/ua_client_connect.c	[]	[]
/src/open62541/deps/mdnsd/libmdnsd/mdnsd.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_mdns_message']	['fuzz_tcp_message', 'fuzz_mdns_message']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_mbedtls_common.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_server_config.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	['fuzz_json_decode_encode']	['fuzz_json_decode_encode']
/src/open62541/deps/pcg_basic.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/arch/eventloop_posix_tcp.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_server_internal.h	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/server/ua_services_discovery_multicast.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message']
/src/open62541/arch/common/ua_timer.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/deps/cj5.c	['fuzz_json_decode_encode', 'fuzz_json_decode']	['fuzz_json_decode_encode', 'fuzz_json_decode']
/src/open62541/include/open62541/server.h	[]	[]
/src/open62541/src/server/ua_subscription_datachange.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/src/open62541/src/ua_securechannel.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	['fuzz_base64_encode']	['fuzz_base64_encode']
/work/open62541/src_generated/open62541/types_generated_handling.h	['fuzz_json_decode_encode', 'fuzz_json_decode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']	['fuzz_json_decode_encode', 'fuzz_json_decode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']
/src/open62541/src/server/ua_services_session.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/src/open62541/plugins/ua_nodestore_ziptree.c	[]	[]
/src/open62541/src/client/ua_client.c	[]	[]
/src/open62541/arch/eventloop_posix_udp.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/client/ua_client_subscriptions.c	[]	[]
/src/open62541/src/server/ua_subscription.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/src/open62541/src/server/ua_services_subscription.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]
/src/open62541/plugins/ua_log_stdout.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/ua_types_encoding_json.c	['fuzz_json_decode_encode', 'fuzz_json_decode']	['fuzz_json_decode_encode', 'fuzz_json_decode']
/src/open62541/src/ua_util_internal.h	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_binary_decode']
/src/open62541/src/server/ua_services_monitoreditem.c	[]	[]
/src/open62541/arch/eventloop_posix_interrupt.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/deps/mdnsd/libmdnsd/1035.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/plugins/crypto/mbedtls/ua_securitypolicy_aes128sha256rsaoaep.c	[]	[]
/src/open62541/src/server/ua_services_view.c	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/include/open62541/types.h	['fuzz_tcp_message', 'fuzz_binary_message']	['fuzz_tcp_message', 'fuzz_binary_message']
/src/open62541/src/ua_securechannel_crypto.c	['fuzz_tcp_message', 'fuzz_binary_message']	[]

Directories in report

Directory
/src/open62541/arch/posix/
/src/open62541/tests/fuzz/
/src/open62541/include/open62541/plugin/
/src/open62541/arch/
/src/open62541/deps/mdnsd/libmdnsd/
/src/open62541/tests/testing-plugins/
/src/open62541/plugins/
/src/open62541/plugins/include/open62541/
/src/open62541/deps/mdnsd/tests/fuzz/
/src/open62541/src/server/
/src/open62541/plugins/crypto/mbedtls/
/src/open62541/src/client/
/src/open62541/arch/common/
/src/open62541/plugins/crypto/
/work/open62541/src_generated/open62541/
/src/open62541/src/
/src/open62541/deps/
/src/open62541/include/open62541/
/usr/include/mbedtls/