High level conclusions

Fuzzers reach 60.19% code coverage.

Fuzzers reach 60.57% of cyclomatic complexity.

Fuzzers reach 65.40% of all functions.

Fuzzer fuzz_client is blocked:

The runtime code coverage of fuzz_client covers 20.16% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_mdns_message is blocked:

The runtime code coverage of fuzz_mdns_message covers 24.44% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3235 / 4946

Cyclomatic complexity statically reachable by fuzzers

13038 / 21525

Runtime code coverage of functions

2977 / 4946

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_mdns_xht

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	3.57%
lawngreen	50+	27	96.4%
All colors	28	100

Runtime coverage analysis

Covered functions

13

Functions that are reachable but not covered

6

Reachable functions

19

Percentage of reachable functions covered

68.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	1
/work/open62541/src_generated/mdnsd/sdtxt.c	5
/work/open62541/src_generated/mdnsd/xht.c	7

Fuzzer: fuzz_mdns_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	84	70.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	30.0%
All colors	120	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	34	mdnsd_in	call site: 00034	_cache
3	116	LLVMFuzzerTestOneInput	call site: 00116	_free_cached

Runtime coverage analysis

Covered functions

11

Functions that are reachable but not covered

34

Reachable functions

45

Percentage of reachable functions covered

24.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	1
/work/open62541/src_generated/mdnsd/1035.c	6
/work/open62541/src_generated/mdnsd/mdnsd.c	24
/work/open62541/src_generated/mdnsd/log.c	1

Fuzzer: fuzz_base64_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	1
/src/open62541/deps/base64.c	2

Fuzzer: fuzz_pubsub_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	7.93%
gold	[1:9]	1	1.58%
yellow	[10:29]	1	1.58%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	56	88.8%
All colors	63	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	54	UA_DataSetMessage_clear	call site: 00054	UA_DataValue_clear
1	50	UA_NetworkMessage_decodeJson	call site: 00050	UA_Array_delete
1	57	UA_NetworkMessage_clear	call site: 00057	UA_clear
1	59	UA_NetworkMessage_clear	call site: 00059	UA_clear

Runtime coverage analysis

Covered functions

128

Functions that are reachable but not covered

3

Reachable functions

28

Percentage of reachable functions covered

89.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	2
/src/open62541/src/ua_types_encoding_json.c	5
/src/open62541/deps/cj5.c	7
/src/open62541/src/pubsub/../ua_types_encoding_json.h	2
/src/open62541/src/ua_types_encoding_json.h	2
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	2
/src/open62541/src/ua_types.c	2
/work/open62541/src_generated/open62541/types_generated.h	3

Fuzzer: fuzz_certificate_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	29	40.8%
gold	[1:9]	11	15.4%
yellow	[10:29]	7	9.85%
greenyellow	[30:49]	3	4.22%
lawngreen	50+	21	29.5%
All colors	71	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	36	UA_CertificateUtils_getExpirationDate	call site: 00036	UA_DateTime_fromStruct
5	50	UA_CertificateUtils_getKeySize	call site: 00050	mbedtls_pk_rsa
4	27	UA_mbedTLS_LoadPemCrl	call site: 00027	UA_String_copy
4	42	LLVMFuzzerTestOneInput	call site: 00042	mbedtls_thumbprint_sha1
3	17	UA_mbedTLS_LoadPemCertificate	call site: 00017	UA_clear
3	58	UA_CertificateUtils_checkCA	call site: 00058	mbedtlsCheckCA
3	67	UA_CertificateUtils_verifyApplicationUri	call site: 00067	UA_Bstrstr
1	13	UA_mbedTLS_CopyDataFormatAware	call site: 00013	UA_copy
1	32	LLVMFuzzerTestOneInput	call site: 00032	UA_clear

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

24

Reachable functions

48

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/crypto/mbedtls/certificategroup.c	8
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	8
/work/open62541/src_generated/open62541/types_generated.h	6
/src/open62541/src/ua_types.c	6
/src/open62541/deps/libc_time.c	3
/usr/include/mbedtls/pk.h	1

Fuzzer: fuzz_eventfilter_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	281	58.0%
gold	[1:9]	2	0.41%
yellow	[10:29]	8	1.65%
greenyellow	[30:49]	1	0.20%
lawngreen	50+	192	39.6%
All colors	484	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
103	155	stringOrder	call site: 00155	UA_Server_readBrowseName
39	115	lookupRefType	call site: 00115	UA_Server_browseRecursive
39	303	UA_QualifiedName_parseEx	call site: 00303	UA_DataType_toStructureDescription
25	277	UA_Array_copy	call site: 00277	UA_DataType_toDescription
25	343	UA_ExtensionObject_setValue	call site: 00343	isNullableDataType
14	262	Variant_clear	call site: 00262	readExternalValueAttribute
7	45	UA_String_unescape	call site: 00045	UA_NamespaceMapping_uri2Index
4	40	parse_nodeid	call site: 00040	UA_String_unescape
2	259	UA_Array_delete	call site: 00259	Variant_clear
2	443	UA_Array_append	call site: 00443	UA_Array_delete
1	37	UA_EventFilter_lex	call site: 00037	UA_NodeId_parseEx
1	57	UA_readNumberWithBase	call site: 00057	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

183

Functions that are reachable but not covered

115

Reachable functions

236

Percentage of reachable functions covered

51.27%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	1
/src/open62541/src/ua_types.c	45
/work/open62541/src_generated/open62541/types_generated.h	48
/src/open62541/src/util/ua_eventfilter_grammar.c	14
/src/open62541/src/util/ua_eventfilter_lex.c	2
/src/open62541/src/util/ua_eventfilter_parser.c	14
/src/open62541/include/open62541/plugin/log.h	1
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/util/ua_types_lex.c	19
/src/open62541/src/util/ua_util.c	6
/src/open62541/deps/base64.c	1
/src/open62541/src/util/ua_util_internal.h	5
/src/open62541/src/server/ua_services_view.c	13
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	5
/src/open62541/deps/ziptree.c	7
/src/open62541/src/server/ua_server_internal.h	1
/src/open62541/src/server/ua_services_attribute.c	20
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5

Fuzzer: fuzz_xml_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	8.82%
gold	[1:9]	1	0.73%
yellow	[10:29]	3	2.20%
greenyellow	[30:49]	1	0.73%
lawngreen	50+	119	87.5%
All colors	136	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	123	LLVMFuzzerTestOneInput	call site: 00123
2	109	LLVMFuzzerTestOneInput	call site: 00109	UA_calcSizeXml
2	112	UA_encodeXml	call site: 00112	UA_ByteString_clear
2	117	LLVMFuzzerTestOneInput	call site: 00117
1	88	UA_decodeXml	call site: 00088	UA_STRING
1	104	LLVMFuzzerTestOneInput	call site: 00104	UA_clear
1	107	UA_ByteString_allocBuffer	call site: 00107

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

4

Reachable functions

59

Percentage of reachable functions covered

93.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_xml.c	9
/src/open62541/deps/yxml.c	34
/src/open62541/src/ua_types.c	4

Fuzzer: fuzz_json_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	21.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	78.1%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	29	LLVMFuzzerTestOneInput	call site: 00029	UA_calcSizeJson
3	42	LLVMFuzzerTestOneInput	call site: 00042
2	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear
2	36	LLVMFuzzerTestOneInput	call site: 00036
1	27	UA_ByteString_allocBuffer	call site: 00027

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

3

Reachable functions

25

Percentage of reachable functions covered

88.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	3

Fuzzer: fuzz_tcp_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2792	17.3%
gold	[1:9]	5	0.03%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13272	82.5%
All colors	16069	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
667	14644	UA_encodeBinaryInternal	call site: 14644	addWriterGroupConfig
201	14437	initPubSubNS0	call site: 14437	addPubSubConnectionConfig
126	1050	copyAttributeIntoNode	call site: 01050	UA_MonitoredItem_processSampledValue
111	15357	initPubSubNS0	call site: 15357	UA_Server_addPublishedDataSet
100	1353	UA_String_vformat	call site: 01353	auditEvent
82	1267	unlockServer	call site: 01267	auditWriteUpdateEvent
73	15682	UA_Session_detachSubscription	call site: 15682	UA_Subscription_delete
59	527	UA_findDataTypeWithCustom	call site: 00527	UA_DataType_toDescription
51	15828	UA_Subscription_delete	call site: 15828	UA_Subscription_delete
34	15590	initPubSubNS0	call site: 15590	UA_PubSubManager_setState
32	15555	initPubSubNS0	call site: 15555	UA_PubSubManager_reserveIds
29	1237	parse_nodeid_body	call site: 01237	parse_relativepath

Runtime coverage analysis

Covered functions

2348

Functions that are reachable but not covered

529

Reachable functions

2591

Percentage of reachable functions covered

79.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	2
/src/open62541/tests/fuzz/custom_memory_manager.c	2
/src/open62541/plugins/include/open62541/server_config_default.h	1
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	80
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	105
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	24
/src/open62541/src/util/ua_util_internal.h	7
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	2
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	23
/src/open62541/src/server/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	8
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	44
/src/open62541/src/server/ua_server_utils.c	9
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	6
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	4
/src/open62541/src/server/ua_server_binary.c	3
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	4
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_securechannel.c	12
/src/open62541/src/ua_securechannel_crypto.c	3
/src/open62541/src/ua_securechannel.h	1

Fuzzer: fuzz_client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1087	90.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	90	7.50%
greenyellow	[30:49]	16	1.33%
lawngreen	50+	6	0.50%
All colors	1199	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
494	371	UA_NamespaceMapping_delete	call site: 00371	__Client_networkCallback
187	871	cleanupSession	call site: 00871	__Client_Subscriptions_backgroundPublish
91	64	__Client_Service	call site: 00064	connectSync
91	156	notifyClientState	call site: 00156	__UA_Client_startup
89	1059	processServiceResponse	call site: 01059	connectActivity
52	299	UA_Array_delete	call site: 00299	__Client_Subscriptions_backgroundPublish
49	249	UA_UNLOCK	call site: 00249	__Client_Subscriptions_backgroundPublish
7	43	UA_mbedTLS_LoadLocalCertificate	call site: 00043	UA_ByteString_copy
4	38	UA_mbedTLS_CopyDataFormatAware	call site: 00038	UA_ByteString_copy
4	1190	UA_ClientConfig_clear	call site: 01190	UA_DataType_clear
3	366	UA_SecureChannel_deleteBuffered	call site: 00366	UA_Chunk_delete
2	16	UA_ConnectionManager_new_POSIX_TCP	call site: 00016	UA_copy

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

285

Reachable functions

357

Percentage of reachable functions covered

20.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_client.cc	1
/src/open62541/plugins/ua_config_default.c	2
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	41
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	45
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	6
/src/open62541/src/client/ua_client.c	24
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/client/ua_client_connect.c	47
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/src/ua_securechannel_crypto.c	21
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/client/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/work/open62541/src_generated/open62541/transport_generated.h	4
/src/open62541/src/client/ua_client_subscriptions.c	21
/src/open62541/deps/ziptree.c	6
/src/open62541/src/util/ua_util.c	9
/src/open62541/src/client/ua_client_discovery.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	1
/src/open62541/src/client/../ua_securechannel.h	1
/src/open62541/src/util/ua_encryptedsecret.c	8
/src/open62541/src/util/../ua_securechannel.h	1
/src/open62541/arch/posix/clock_posix.c	1

Fuzzer: fuzz_binary_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3152	19.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13204	80.7%
All colors	16356	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
874	14437	initPubSubNS0	call site: 14437	addPubSubConnectionConfig
363	15989	serverNetworkCallbackLocked	call site: 15989	processSecureChannelMessage
186	1267	unlockServer	call site: 01267	auditWriteUpdateEvent
185	1050	copyAttributeIntoNode	call site: 01050	UA_MonitoredItem_processSampledValue
111	15357	initPubSubNS0	call site: 15357	UA_Server_addPublishedDataSet
86	500	Variant_clear	call site: 00500	UA_DataType_toDescription
73	15682	UA_Session_detachSubscription	call site: 15682	UA_Subscription_delete
51	15828	UA_Subscription_delete	call site: 15828	UA_Subscription_delete
46	79	format_string_loop	call site: 00079	UA_NodeId_print
34	15590	initPubSubNS0	call site: 15590	UA_PubSubManager_setState
33	15757	UA_Subscription_delete	call site: 15757	UA_MonitoredItem_delete
32	15555	initPubSubNS0	call site: 15555	UA_PubSubManager_reserveIds

Runtime coverage analysis

Covered functions

2150

Functions that are reachable but not covered

611

Reachable functions

2644

Percentage of reachable functions covered

76.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_message.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	113
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	25
/src/open62541/src/util/ua_util_internal.h	10
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	2
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	9
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	13
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	44
/src/open62541/src/server/ua_server_utils.c	9
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	9
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	4
/src/open62541/src/server/ua_server_binary.c	16
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	16
/src/open62541/src/ua_securechannel.h	1
/src/open62541/tests/testing-plugins/testing_networklayers.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	3

Fuzzer: fuzz_json_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	4.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	96.0%
All colors	25	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear

Runtime coverage analysis

Covered functions

110

Functions that are reachable but not covered

0

Reachable functions

15

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	2
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	1

Fuzzer: fuzz_pubsub_connection_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	29.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	70.5%
All colors	34	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	7	UA_PubSubConnectionConfig_copy	call site: 00007	UA_String_copy
2	22	UA_PubSubConnectionConfig_clear	call site: 00022	UA_String_clear
1	12	UA_PubSubConnectionConfig_copy	call site: 00012	UA_copy
1	18	UA_Array_copy	call site: 00018	UA_Array_delete
1	20	UA_Array_delete	call site: 00020	UA_PubSubConnectionConfig_clear
1	27	UA_PubSubConnectionConfig_clear	call site: 00027	UA_clear
1	30	UA_PubSubConnectionConfig_clear	call site: 00030	UA_Array_delete

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

0

Reachable functions

18

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	1
/src/open62541/src/ua_types_encoding_binary.c	3
/src/open62541/src/ua_types.c	4
/src/open62541/src/pubsub/ua_pubsub_connection.c	2
/src/open62541/src/pubsub/ua_pubsub_manager.c	2
/work/open62541/src_generated/open62541/types_generated.h	4
/src/open62541/src/util/ua_util.c	2

Fuzzer: fuzz_server_services

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3362	19.9%
gold	[1:9]	112	0.66%
yellow	[10:29]	52	0.30%
greenyellow	[30:49]	14	0.08%
lawngreen	50+	13315	78.9%
All colors	16855	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
874	14436	initPubSubNS0	call site: 14436	addPubSubConnectionConfig
154	1049	copyAttributeIntoNode	call site: 01049	UA_MonitoredItem_processSampledValue
149	16054	process_RegisterServer	call site: 16054	UA_Discovery_updateMdnsForDiscoveryUrl
132	16244	LLVMFuzzerTestOneInput	call site: 16244	Service_CreateSession
118	16386	getSessionByToken	call site: 16386	checkActivateSessionX509
111	15356	initPubSubNS0	call site: 15356	UA_Server_addPublishedDataSet
102	1350	UA_String_vformat	call site: 01350	auditEvent
93	16667	Service_CreateMonitoredItems	call site: 16667	Operation_CreateMonitoredItem
86	499	Variant_clear	call site: 00499	UA_DataType_toDescription
82	1266	unlockServer	call site: 01266	auditWriteUpdateEvent
73	15681	UA_Session_detachSubscription	call site: 15681	UA_Subscription_delete
51	15827	UA_Subscription_delete	call site: 15827	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2316

Functions that are reachable but not covered

661

Reachable functions

2878

Percentage of reachable functions covered

77.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_server_services.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	86
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	175
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	27
/src/open62541/src/util/ua_util_internal.h	14
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	18
/src/open62541/src/server/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	12
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	14
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	44
/src/open62541/src/server/ua_server_utils.c	10
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	14
/src/open62541/src/server/ua_server_auditing.c	12
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	21
/src/open62541/src/server/ua_server_binary.c	4
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_securechannel.c	17
/src/open62541/src/ua_securechannel_crypto.c	8
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_discovery.c	12
/src/open62541/src/server/../ua_securechannel.h	1
/src/open62541/src/server/ua_discovery_mdns.c	17
/work/open62541/src_generated/mdnsd/mdnsd.c	17
/work/open62541/src_generated/mdnsd/xht.c	7
/work/open62541/src_generated/mdnsd/sdtxt.c	4
/src/open62541/plugins/crypto/mbedtls/certificategroup.c	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	2
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_services_subscription.c	8
/src/open62541/src/server/ua_services_monitoreditem.c	13
/src/open62541/src/server/ua_services.c	1

Fuzzer: fuzz_parse_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	338	71.0%
gold	[1:9]	46	9.66%
yellow	[10:29]	3	0.63%
greenyellow	[30:49]	4	0.84%
lawngreen	50+	85	17.8%
All colors	476	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
144	116	lookupRefType	call site: 00116	UA_Server_readBrowseName
64	302	UA_STRING	call site: 00302	UA_DataType_toStructureDescription
40	261	UA_Array_delete	call site: 00261	UA_DataType_toDescription
15	386	printRelativePath	call site: 00386	getRefTypeBrowseName
12	7	parse_nodeid	call site: 00007	UA_String_unescape
12	402	UA_String_escapedSize	call site: 00402	printNodeIdBody
9	416	UA_String_escapeInsert	call site: 00416	getRefTypeBrowseName
8	427	UA_String_escapeAppend	call site: 00427	itoaUnsigned
3	81	UA_ExpandedNodeId_parseEx	call site: 00081	UA_readNumber
3	380	printRelativePath	call site: 00380	UA_STRING
3	438	printRelativePath	call site: 00438	UA_String_clear
3	453	parseAttributeOperand	call site: 00453	UA_AttributeId_fromName

Runtime coverage analysis

Covered functions

93

Functions that are reachable but not covered

134

Reachable functions

234

Percentage of reachable functions covered

42.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_parse_string.cc	1
/src/open62541/src/ua_types.c	51
/work/open62541/src_generated/open62541/types_generated.h	52
/src/open62541/src/util/ua_types_lex.c	21
/src/open62541/src/util/ua_util.c	13
/src/open62541/deps/base64.c	2
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/deps/parse_num.c	2
/src/open62541/deps/libc_time.c	3
/src/open62541/src/server/ua_services_view.c	13
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	5
/src/open62541/deps/ziptree.c	7
/src/open62541/src/server/ua_server_internal.h	1
/src/open62541/src/server/ua_services_attribute.c	20
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_src_ua_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	100.%
All colors	17	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

3

Reachable functions

13

Percentage of reachable functions covered

76.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	3
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_process_request

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2682	16.6%
gold	[1:9]	2	0.01%
yellow	[10:29]	4	0.02%
greenyellow	[30:49]	1	0.00%
lawngreen	50+	13379	83.2%
All colors	16068	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
874	14436	initPubSubNS0	call site: 14436	addPubSubConnectionConfig
126	1049	copyAttributeIntoNode	call site: 01049	UA_MonitoredItem_processSampledValue
111	15356	initPubSubNS0	call site: 15356	UA_Server_addPublishedDataSet
102	1350	UA_String_vformat	call site: 01350	auditEvent
86	499	Variant_clear	call site: 00499	UA_DataType_toDescription
73	15681	UA_Session_detachSubscription	call site: 15681	UA_Subscription_delete
63	1266	unlockServer	call site: 01266	readSAOfromEventInstance
48	15827	UA_Subscription_delete	call site: 15827	UA_Subscription_delete
34	15589	initPubSubNS0	call site: 15589	UA_PubSubManager_setState
33	15756	UA_Subscription_delete	call site: 15756	UA_MonitoredItem_delete
32	15554	initPubSubNS0	call site: 15554	UA_PubSubManager_reserveIds
29	1236	parse_nodeid_body	call site: 01236	parse_relativepath

Runtime coverage analysis

Covered functions

2287

Functions that are reachable but not covered

489

Reachable functions

2595

Percentage of reachable functions covered

81.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_process_request.cc	2
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	107
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	24
/src/open62541/src/util/ua_util_internal.h	7
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	5
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	9
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	13
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	44
/src/open62541/src/server/ua_server_utils.c	9
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	6
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	4
/src/open62541/src/server/ua_server_binary.c	4
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_securechannel.c	18
/src/open62541/src/ua_securechannel_crypto.c	3
/src/open62541/src/ua_securechannel.h	1
/src/open62541/tests/testing-plugins/testing_networklayers.c	1
/src/open62541/src/server/ua_services.c	3

Fuzzer: fuzz_attributeoperand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	299	70.6%
gold	[1:9]	2	0.47%
yellow	[10:29]	8	1.89%
greenyellow	[30:49]	8	1.89%
lawngreen	50+	106	25.0%
All colors	423	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
102	97	stringOrder	call site: 00097	UA_Server_readBrowseName
69	244	UA_STRING	call site: 00244	UA_DataType_toStructureDescription
40	203	UA_Array_delete	call site: 00203	UA_DataType_toDescription
39	57	lookupRefType	call site: 00057	UA_Server_browseRecursive
7	15	UA_String_unescape	call site: 00015	UA_NamespaceMapping_uri2Index
6	33	parse_nodeid_body	call site: 00033	UA_readNumberWithBase
5	332	nodeId_printEscape	call site: 00332	UA_String_escapedSize
5	396	UA_AttributeOperand_print	call site: 00396	UA_STRING
3	10	parse_nodeid	call site: 00010	UA_String_unescape
3	361	printRelativePath	call site: 00361	UA_STRING
2	200	UA_ByteString_allocBuffer	call site: 00200	UA_Variant_copyRange
2	317	parse_relativepathElement	call site: 00317	UA_RelativePathElement_clear

Runtime coverage analysis

Covered functions

83

Functions that are reachable but not covered

128

Reachable functions

198

Percentage of reachable functions covered

35.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/work/open62541/src_generated/open62541/types_generated.h	38
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/ua_types.c	51
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/src/util/ua_util.c	14
/src/open62541/deps/base64.c	2
/src/open62541/src/server/ua_services_view.c	13
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	5
/src/open62541/deps/ziptree.c	7
/src/open62541/src/server/ua_server_internal.h	1
/src/open62541/src/server/ua_services_attribute.c	20
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_binary_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	21.3%
gold	[1:9]	2	3.27%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.63%
lawngreen	50+	45	73.7%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	19	UA_encodeBinaryInternal	call site: 00019	exchangeBuffer
2	28	LLVMFuzzerTestOneInput	call site: 00028	UA_calcSizeBinary
2	31	UA_encodeBinary	call site: 00031	UA_ByteString_clear
1	26	UA_ByteString_allocBuffer	call site: 00026	UA_delete
1	49	copySubString	call site: 00049	UA_Variant_copyRange
1	53	UA_Variant_copyRange	call site: 00053	Variant_clear
1	56	UA_DataValue_copyRange	call site: 00056	Variant_clear
1	58	LLVMFuzzerTestOneInput	call site: 00058	UA_clear

Runtime coverage analysis

Covered functions

141

Functions that are reachable but not covered

3

Reachable functions

39

Percentage of reachable functions covered

92.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	17
/src/open62541/src/ua_types_encoding_binary.c	8
/src/open62541/src/util/ua_util_internal.h	2
/work/open62541/src_generated/open62541/types_generated.h	6

Fuzzer: fuzz_base64_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	1
/src/open62541/deps/base64.c	1

Fuzzer: fuzz_pubsub_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	18	12.8%
gold	[1:9]	3	2.14%
yellow	[10:29]	9	6.42%
greenyellow	[30:49]	5	3.57%
lawngreen	50+	105	75.0%
All colors	140	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	100	stringOrder	call site: 00100	nodeIdOrder
7	92	UA_DataSetMessage_keyFrame_decodeBinary	call site: 00092	decodeRawField
1	132	UA_DataSetMessage_clear	call site: 00132	UA_clear
1	134	UA_NetworkMessage_clear	call site: 00134	UA_clear
1	136	UA_NetworkMessage_clear	call site: 00136	UA_clear

Runtime coverage analysis

Covered functions

80

Functions that are reachable but not covered

7

Reachable functions

39

Percentage of reachable functions covered

82.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	19
/src/open62541/src/pubsub/../util/ua_util_internal.h	3
/src/open62541/src/ua_types_encoding_binary.c	2
/src/open62541/src/ua_types.c	7
/work/open62541/src_generated/open62541/types_generated.h	4

Fuzzer: fuzz_config_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3267	19.6%
gold	[1:9]	51	0.30%
yellow	[10:29]	8	0.04%
greenyellow	[30:49]	16	0.09%
lawngreen	50+	13272	79.8%
All colors	16614	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
874	15083	initPubSubNS0	call site: 15083	addPubSubConnectionConfig
185	1917	unlockServer	call site: 01917	auditWriteUpdateEvent
177	1708	copyAttributeIntoNode	call site: 01708	UA_MonitoredItem_processSampledValue
110	16003	initPubSubNS0	call site: 16003	UA_Server_addPublishedDataSet
100	783	UA_KeyValueMap_getScalar	call site: 00783	UA_CertificateGroup_Filestore
86	1160	Variant_clear	call site: 01160	UA_DataType_toDescription
73	16326	UA_Session_detachSubscription	call site: 16326	UA_Subscription_delete
51	16472	UA_Subscription_delete	call site: 16472	UA_Subscription_delete
46	81	format_string_loop	call site: 00081	UA_NodeId_print
45	735	UA_Variant_setScalar	call site: 00735	UA_CertificateGroup_Filestore
44	531	UA_SecurityPolicy_initByUri	call site: 00531	UA_SecurityPolicy_Basic128Rsa15
40	687	UA_SecurityPolicy_initByUri	call site: 00687	UA_SecurityPolicy_Aes256Sha256RsaPss

Runtime coverage analysis

Covered functions

2186

Functions that are reachable but not covered

624

Reachable functions

2683

Percentage of reachable functions covered

76.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_config_json.cc	1
/src/open62541/plugins/ua_config_json.c	32
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	80
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	108
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	27
/src/open62541/src/util/ua_util_internal.h	7
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	4
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/deps/cj5.c	10
/src/open62541/deps/utf8.h	1
/src/open62541/src/ua_types_encoding_json.c	13
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic128rsa15.c	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic256.c	4
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic256sha256.c	4
/src/open62541/plugins/crypto/mbedtls/securitypolicy_aes128sha256rsaoaep.c	4
/src/open62541/plugins/crypto/mbedtls/securitypolicy_aes256sha256rsapss.c	4
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	9
/src/open62541/plugins/crypto/mbedtls/certificategroup.c	2
/src/open62541/plugins/crypto/ua_filestore_common.c	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	3
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	8
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	13
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	44
/src/open62541/src/server/ua_server_utils.c	9
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	6
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	3
/src/open62541/src/server/ua_server_binary.c	3
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	4
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_securechannel.c	12
/src/open62541/src/ua_securechannel_crypto.c	3
/src/open62541/src/ua_securechannel.h	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
UA_DiscoveryManager_start	/src/open62541/src/server/ua_discovery.c	1	['N/A']	19	0	81	13	6	211	0	1280	322
UDP_openConnection	/src/open62541/arch/posix/eventloop_posix_udp.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	13	0	155	17	7	113	0	624	190
UA_CreateCertificate	/src/open62541/plugins/crypto/mbedtls/create_certificate.c	9	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'int', 'N/A', 'N/A', 'N/A']	4	0	976	136	51	66	0	259	189

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3316 / 4946

Cyclomatic complexity statically reachable by fuzzers

13649 / 21525

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/open62541/tests/fuzz/fuzz_mdns_xht.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_mdns_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['mdnsd_in', 'LLVMFuzzerTestOneInput']

/src/open62541/tests/fuzz/fuzz_base64_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_pubsub_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_DataSetMessage_clear', 'UA_NetworkMessage_decodeJson', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_certificate_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_CertificateUtils_getExpirationDate', 'UA_CertificateUtils_getKeySize', 'UA_mbedTLS_LoadPemCrl', 'LLVMFuzzerTestOneInput', 'UA_mbedTLS_LoadPemCertificate', 'UA_CertificateUtils_checkCA', 'UA_CertificateUtils_verifyApplicationUri', 'UA_mbedTLS_CopyDataFormatAware']

/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'lookupRefType', 'UA_QualifiedName_parseEx', 'UA_Array_copy', 'UA_ExtensionObject_setValue', 'Variant_clear', 'UA_String_unescape', 'parse_nodeid', 'UA_Array_delete', 'UA_Array_append']

/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_encodeXml', 'UA_decodeXml', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_tcp_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'initPubSubNS0', 'copyAttributeIntoNode', 'UA_String_vformat', 'unlockServer', 'UA_Session_detachSubscription', 'UA_findDataTypeWithCustom', 'UA_Subscription_delete']

/src/open62541/tests/fuzz/fuzz_client.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_NamespaceMapping_delete', 'cleanupSession', '__Client_Service', 'notifyClientState', 'processServiceResponse', 'UA_Array_delete', 'UA_UNLOCK', 'UA_mbedTLS_LoadLocalCertificate', 'UA_mbedTLS_CopyDataFormatAware', 'UA_ClientConfig_clear']

/src/open62541/tests/fuzz/fuzz_binary_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'serverNetworkCallbackLocked', 'unlockServer', 'copyAttributeIntoNode', 'Variant_clear', 'UA_Session_detachSubscription', 'UA_Subscription_delete', 'format_string_loop']

/src/open62541/tests/fuzz/fuzz_json_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_PubSubConnectionConfig_copy', 'UA_PubSubConnectionConfig_clear', 'UA_Array_copy', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_server_services.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'copyAttributeIntoNode', 'process_RegisterServer', 'LLVMFuzzerTestOneInput', 'getSessionByToken', 'UA_String_vformat', 'Service_CreateMonitoredItems', 'Variant_clear', 'unlockServer']

/src/open62541/tests/fuzz/fuzz_parse_string.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['lookupRefType', 'UA_STRING', 'UA_Array_delete', 'printRelativePath', 'parse_nodeid', 'UA_String_escapedSize', 'UA_String_escapeInsert', 'UA_String_escapeAppend', 'UA_ExpandedNodeId_parseEx']

/src/open62541/tests/fuzz/fuzz_src_ua_util.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_process_request.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'copyAttributeIntoNode', 'UA_String_vformat', 'Variant_clear', 'UA_Session_detachSubscription', 'unlockServer', 'UA_Subscription_delete']

/src/open62541/tests/fuzz/fuzz_attributeoperand.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'UA_STRING', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid_body', 'nodeId_printEscape', 'UA_AttributeOperand_print', 'parse_nodeid', 'printRelativePath']

/src/open62541/tests/fuzz/fuzz_binary_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'LLVMFuzzerTestOneInput', 'UA_encodeBinary', 'UA_ByteString_allocBuffer', 'copySubString', 'UA_Variant_copyRange', 'UA_DataValue_copyRange']

/src/open62541/tests/fuzz/fuzz_base64_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'UA_DataSetMessage_keyFrame_decodeBinary', 'UA_DataSetMessage_clear', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_config_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'unlockServer', 'copyAttributeIntoNode', 'UA_KeyValueMap_getScalar', 'Variant_clear', 'UA_Session_detachSubscription', 'UA_Subscription_delete', 'format_string_loop', 'UA_Variant_setScalar']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
mdnsd_in	96	8	8.333%	['fuzz_mdns_message']
clearStructure	35	19	54.28%	['fuzz_parse_string', 'fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_pubsub_binary', 'fuzz_client', 'fuzz_binary_decode', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_json_decode', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_config_json', 'fuzz_xml_decode_encode', 'fuzz_pubsub_json', 'fuzz_tcp_message']
lookupRefType	38	12	31.57%	['fuzz_parse_string', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_config_json', 'fuzz_tcp_message']
decodeMatrixVariant	36	4	11.11%	['fuzz_xml_decode_encode']
UA_encodeJson	35	18	51.42%	['fuzz_process_request', 'fuzz_json_decode_encode', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
ExtensionObject_encodeJson	36	3	8.333%	['fuzz_json_decode_encode']
DiagnosticInfo_encodeJson	33	11	33.33%	['fuzz_json_decode_encode']
UA_KeyValueRestriction_validate	35	15	42.85%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
UA_EventLoopPOSIX_start	76	37	48.68%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
openSignalPipe	33	17	51.51%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
TCP_registerListenSocket	167	72	43.11%	['fuzz_tcp_message']
TCP_sendWithConnection	42	23	54.76%	['fuzz_tcp_message']
UDP_registerListenSocket	121	51	42.14%	['fuzz_tcp_message']
UDP_openSendConnection	80	41	51.24%	['fuzz_tcp_message']
format_string_loop	239	99	41.42%	['fuzz_process_request', 'fuzz_client', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
print_integer_finalization	51	16	31.37%	['fuzz_process_request', 'fuzz_client', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
UA_PubSubManager_setState	36	16	44.44%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
MulticastDiscoveryCallback	44	11	25.0%	['fuzz_tcp_message']
mdns_create_txt	60	24	40.0%	['fuzz_server_services', 'fuzz_tcp_message']
UA_NodePointer_copy	42	19	45.23%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
UA_Node_insertOrUpdateLocale	37	14	37.83%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
deleteServerSecureChannel	43	21	48.83%	['fuzz_tcp_message', 'fuzz_binary_message']
processSecureChannelMessage	57	12	21.05%	['fuzz_tcp_message', 'fuzz_binary_message']
UA_BinaryProtocolManager_start	56	30	53.57%	['fuzz_tcp_message']
compatibleValue	37	10	27.02%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
readValueAttributeComplete	33	18	54.54%	['fuzz_parse_string', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_config_json', 'fuzz_tcp_message']
copyAttributeIntoNode	188	49	26.06%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
writeNodeValueAttribute	90	39	43.33%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
addNode_raw	73	35	47.94%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
checkParentReference	63	29	46.03%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
useVariableTypeAttributes	48	20	41.66%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
typeCheckVariableNode	80	28	35.0%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
recursiveCallConstructors	91	41	45.05%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
Operation_addReference	110	56	50.90%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
UA_Server_addMethodNodeEx_finish	88	39	44.31%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
Operation_Browse	89	36	40.44%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
browse	48	26	54.16%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
browseWithNode	65	23	35.38%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
UA_SecureChannel_getCompleteMessage	107	26	24.29%	['fuzz_client', 'fuzz_tcp_message', 'fuzz_binary_message']
processServiceResponse	40	10	25.0%	['fuzz_client']
__Client_Service	68	8	11.76%	['fuzz_client']
auditEvent	87	4	4.597%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
createSubscriptionObject	56	18	32.14%	['fuzz_server_services']
Service_FindServersOnNetwork	57	8	14.03%	['fuzz_server_services']
process_RegisterServer	122	9	7.377%	['fuzz_process_request', 'fuzz_server_services']
Service_CreateMonitoredItems	32	16	50.0%	['fuzz_server_services']
Operation_deleteReference	55	23	41.81%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
Service_ActivateSession_inner	206	90	43.68%	['fuzz_process_request', 'fuzz_server_services']
Service_ModifySubscription	42	10	23.80%	['fuzz_server_services']
Operation_TranslateBrowsePathToNodeIds	104	57	54.80%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
walkBrowsePathElement	85	32	37.64%	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
activateSession_default	63	27	42.85%	['fuzz_process_request']
Service_CreateSession_inner	156	74	47.43%	['fuzz_process_request', 'fuzz_server_services']
signCreateSessionResponse	36	4	11.11%	['fuzz_process_request', 'fuzz_server_services']
selectTokenPolicy	68	26	38.23%	['fuzz_process_request', 'fuzz_server_services']
structureOrder	51	28	54.90%	['fuzz_binary_decode', 'fuzz_attributeoperand']
TcpConfigurationField_parseJson	32	13	40.62%	['fuzz_config_json']
PubsubConfigurationField_parseJson	32	13	40.62%	['fuzz_config_json']
SecurityPolicyField_parseJson	41	22	53.65%	['fuzz_config_json']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/open62541/src/server/ua_services_discovery.c	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/deps/base64.c	['fuzz_base64_encode', 'fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_base64_decode', 'fuzz_config_json']	['fuzz_base64_encode', 'fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_base64_decode', 'fuzz_config_json']
/src/open62541/deps/yxml.c	['fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/plugins/historydata/ua_history_database_default.c	[]	[]
/src/open62541/src/server/ua_server_internal.h	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/arch/posix/eventloop_posix_interrupt.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/util/ua_types_lex.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']
/src/open62541/arch/posix/eventloop_posix_eth.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/deps/libc_time.c	['fuzz_certificate_parse', 'fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/src/ua_types_encoding_json.c	['fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_json_decode', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_json_decode', 'fuzz_config_json']
/src/open62541/src/pubsub/ua_pubsub_internal.h	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/src/pubsub/ua_pubsub_dataset.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/work/open62541/src_generated/open62541/transport_generated.h	['fuzz_client', 'fuzz_binary_message']	[]
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic128rsa15.c	['fuzz_config_json']	[]
/src/open62541/src/ua_securechannel.h	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/deps/mp_printf.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_server_services.cc	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_pubsub_aes256ctr.c	[]	[]
/src/open62541/include/open62541/server.h	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request']	[]
/work/open62541/src_generated/open62541/namespace0_generated.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/client/../ua_securechannel.h	['fuzz_client']	[]
/src/open62541/arch/posix/eventloop_posix_udp.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/client/ua_client_subscriptions.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/ua_types.c	['fuzz_pubsub_json', 'fuzz_certificate_parse', 'fuzz_eventfilter_parse', 'fuzz_xml_decode_encode', 'fuzz_json_decode_encode', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_json_decode', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_pubsub_binary', 'fuzz_config_json']	['fuzz_pubsub_json', 'fuzz_certificate_parse', 'fuzz_eventfilter_parse', 'fuzz_xml_decode_encode', 'fuzz_json_decode_encode', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_json_decode', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_pubsub_binary', 'fuzz_config_json']
/src/open62541/src/server/ua_nodes.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/pubsub/ua_pubsub_ns0.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/ua_types_definition.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	[]
/src/open62541/include/open62541/client_subscriptions.h	[]	[]
/work/open62541/src_generated/open62541/config.h	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/arch/posix/eventloop_posix.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/plugins/crypto/ua_filestore_common.c	['fuzz_config_json']	[]
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_aes256sha256rsapss.c	['fuzz_config_json']	[]
/src/open62541/plugins/crypto/mbedtls/create_certificate.c	[]	[]
/src/open62541/src/pubsub/../server/ua_server_internal.h	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/testing-plugins/testing_networklayers.c	['fuzz_binary_message', 'fuzz_process_request']	['fuzz_binary_message', 'fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_config_json.cc	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	['fuzz_pubsub_json', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_pubsub_json']
/src/open62541/plugins/include/open62541/server_config_default.h	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	['fuzz_tcp_message']	['fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_client.cc	['fuzz_client']	['fuzz_client']
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	['fuzz_attributeoperand']	['fuzz_attributeoperand']
/src/open62541/src/pubsub/../util/ua_util_internal.h	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_pubsub_binary', 'fuzz_config_json']	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_attributeoperand']
/src/open62541/tests/fuzz/fuzz_binary_message.cc	['fuzz_binary_message']	['fuzz_binary_message']
/src/open62541/src/server/ua_services_monitoreditem.c	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	['fuzz_pubsub_connection_config']	['fuzz_pubsub_connection_config']
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/server/ua_server_binary.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/ua_securechannel.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_server_services', 'fuzz_process_request']
/src/open62541/src/server/ua_server.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/plugins/ua_log_syslog.c	[]	[]
/src/open62541/deps/cj5.c	['fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_json_decode', 'fuzz_config_json']	['fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_json_decode', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	['fuzz_pubsub_binary']	['fuzz_pubsub_binary']
/src/open62541/src/util/ua_encryptedsecret.c	['fuzz_client', 'fuzz_server_services']	[]
/src/open62541/src/server/ua_subscription.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/util/ua_util.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_src_ua_util', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_src_ua_util', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']
/src/open62541/include/open62541/plugin/nodestore.h	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/work/open62541/src_generated/mdnsd/log.c	['fuzz_mdns_message']	[]
/src/open62541/deps/utf8.h	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/arch/common/timer.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/util/ua_util_internal.h	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_config_json']	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_attributeoperand']
/src/open62541/deps/pcg_basic.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/server/ua_subscription_datachange.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/src/server/ua_services_subscription.c	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/src/client/ua_client.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/client/ua_client_util.c	[]	[]
/src/open62541/src/ua_types_encoding_xml.c	['fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/fuzz/custom_memory_manager.c	['fuzz_pubsub_json', 'fuzz_certificate_parse', 'fuzz_tcp_message', 'fuzz_src_ua_util', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_pubsub_binary']	['fuzz_pubsub_json', 'fuzz_certificate_parse', 'fuzz_tcp_message', 'fuzz_src_ua_util', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_pubsub_binary']
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	['fuzz_certificate_parse']	['fuzz_certificate_parse']
/src/open62541/plugins/crypto/ua_certificategroup_none.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	['fuzz_base64_encode']	['fuzz_base64_encode']
/src/open62541/deps/itoa.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_server_services', 'fuzz_process_request', 'fuzz_attributeoperand']
/src/open62541/src/pubsub/ua_pubsub_reader.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/src/server/ua_services_nodemanagement.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/server/ua_services_attribute.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_json_decode.cc	['fuzz_json_decode']	['fuzz_json_decode']
/work/open62541/src_generated/open62541/statuscodes.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/plugins/historydata/ua_history_data_backend_memory.c	[]	[]
/src/open62541/plugins/crypto/mbedtls/certificategroup.c	['fuzz_certificate_parse', 'fuzz_server_services', 'fuzz_config_json']	['fuzz_certificate_parse']
/src/open62541/src/server/ua_services_session.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_server_services', 'fuzz_process_request']
/src/open62541/arch/posix/clock_posix.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/include/open62541/plugin/log.h	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/server/ua_server_binary_reverse.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/server/ua_services_method.c	[]	[]
/src/open62541/deps/dtoa.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/src/server/ua_discovery_mdns.c	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/plugins/ua_config_json.c	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/src/pubsub/ua_pubsub_connection.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_pubsub_connection_config']
/src/open62541/arch/posix/eventloop_posix_tcp.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/server/ua_server_ns0.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	['fuzz_pubsub_json']	['fuzz_pubsub_json']
/src/open62541/plugins/ua_log_stdout.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_parse_string.cc	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	['fuzz_pubsub_json', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_pubsub_binary', 'fuzz_config_json']	['fuzz_pubsub_json', 'fuzz_pubsub_binary']
/src/open62541/src/client/ua_client_connect.c	['fuzz_client']	['fuzz_client']
/src/open62541/deps/ziptree.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/pubsub/ua_pubsub_manager.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/deps/utf8.c	[]	[]
/src/open62541/tests/fuzz/fuzz_process_request.cc	['fuzz_process_request']	['fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	['fuzz_base64_decode']	['fuzz_base64_decode']
/src/open62541/plugins/ua_config_default.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/util/ua_eventfilter_grammar.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/plugins/crypto/ua_securitypolicy_filestore.c	[]	[]
/src/open62541/src/server/ua_services_view.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic256.c	['fuzz_config_json']	[]
/src/open62541/src/ua_types_encoding_binary.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_binary_decode', 'fuzz_pubsub_binary', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_binary_decode', 'fuzz_pubsub_binary']
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	['fuzz_binary_decode']	['fuzz_binary_decode']
/src/open62541/src/ua_securechannel_crypto.c	['fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/plugins/ua_accesscontrol_default.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/work/open62541/src_generated/mdnsd/xht.c	['fuzz_mdns_xht', 'fuzz_server_services']	['fuzz_mdns_xht']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	['fuzz_certificate_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_certificate_parse', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/work/open62541/src_generated/open62541/types_generated.h	['fuzz_pubsub_json', 'fuzz_certificate_parse', 'fuzz_eventfilter_parse', 'fuzz_xml_decode_encode', 'fuzz_json_decode_encode', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_json_decode', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_pubsub_binary', 'fuzz_config_json']	['fuzz_pubsub_json', 'fuzz_certificate_parse', 'fuzz_eventfilter_parse', 'fuzz_xml_decode_encode', 'fuzz_json_decode_encode', 'fuzz_tcp_message', 'fuzz_client', 'fuzz_binary_message', 'fuzz_json_decode', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_pubsub_binary', 'fuzz_config_json']
/src/open62541/src/client/../util/ua_util_internal.h	['fuzz_client']	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_attributeoperand']
/src/open62541/src/server/ua_services.c	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_process_request']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_aes128sha256rsaoaep.c	['fuzz_config_json']	[]
/usr/include/mbedtls/pk.h	['fuzz_certificate_parse']	[]
/src/open62541/src/server/ua_discovery.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	['fuzz_src_ua_util']	['fuzz_src_ua_util']
/work/open62541/src_generated/mdnsd/1035.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/work/open62541/src_generated/mdnsd/mdnsd.c	['fuzz_mdns_message', 'fuzz_server_services']	['fuzz_mdns_message']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic256sha256.c	['fuzz_config_json']	[]
/src/open62541/src/util/ua_eventfilter_lex.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/plugins/ua_nodestore_ziptree.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	['fuzz_config_json']	[]
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/deps/musl_inet_pton.c	[]	[]
/src/open62541/src/client/ua_client_discovery.c	['fuzz_client']	[]
/src/open62541/src/server/ua_server_ns0_diagnostics.c	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/src/client/ua_client_highlevel.c	[]	[]
/src/open62541/src/server/ua_session.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/pubsub/../ua_types_encoding_json.h	['fuzz_pubsub_json']	[]
/src/open62541/arch/posix/eventloop_posix.h	[]	[]
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	['fuzz_json_decode_encode']	['fuzz_json_decode_encode']
/work/open62541/src_generated/mdnsd/sdtxt.c	['fuzz_mdns_xht', 'fuzz_server_services']	['fuzz_mdns_xht']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_pubsub_aes128ctr.c	[]	[]
/src/open62541/src/server/ua_server_async.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/plugins/historydata/ua_history_data_gathering_default.c	[]	[]
/src/open62541/src/server/ua_server_config.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/arch/common/eventloop_common.c	[]	[]
/src/open62541/src/server/ua_subscription_event.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/deps/parse_num.c	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/src/server/ua_services_securechannel.c	['fuzz_binary_message']	[]
/src/open62541/src/server/ua_server_utils.c	['fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_attributeoperand', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']
/src/open62541/src/server/ua_server_auditing.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	['fuzz_server_services', 'fuzz_process_request']
/src/open62541/src/util/ua_eventfilter_parser.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/pubsub/ua_pubsub_writer.c	['fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_process_request', 'fuzz_config_json']	[]
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	['fuzz_xml_decode_encode']	['fuzz_xml_decode_encode']

Directories in report

Directory
/src/open62541/src/client/../util/
/src/open62541/include/open62541/
/src/open62541/arch/posix/
/src/open62541/src/pubsub/../server/
/work/open62541/src_generated/open62541/
/src/open62541/plugins/include/open62541/
/src/open62541/include/open62541/plugin/
/src/open62541/src/server/
/src/open62541/deps/
/src/open62541/plugins/
/src/open62541/plugins/historydata/
/src/open62541/plugins/crypto/
/src/open62541/tests/fuzz/
/src/open62541/src/client/../
/src/open62541/src/util/
/src/open62541/src/pubsub/
/src/open62541/src/pubsub/../
/src/open62541/plugins/crypto/mbedtls/
/src/open62541/src/client/
/src/open62541/src/pubsub/../util/
/work/open62541/src_generated/mdnsd/
/src/open62541/src/
/usr/include/mbedtls/
/src/open62541/tests/testing-plugins/
/src/open62541/arch/common/