High level conclusions

Fuzzers reach 58.57% code coverage.

Fuzzers reach 59.66% of cyclomatic complexity.

Fuzzers reach 64.61% of all functions.

Fuzzer fuzz_mdns_message is blocked:

The runtime code coverage of fuzz_mdns_message covers 26.41% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer fuzz_client is blocked:

The runtime code coverage of fuzz_client covers 20.16% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3219 / 4982

Cyclomatic complexity statically reachable by fuzzers

12916 / 21646

Runtime code coverage of functions

2918 / 4982

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_base64_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	1
/src/open62541/deps/base64.c	2

Fuzzer: fuzz_client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1089	90.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	90	7.49%
greenyellow	[30:49]	16	1.33%
lawngreen	50+	6	0.49%
All colors	1201	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
494	373	UA_NamespaceMapping_delete	call site: 00373	__Client_networkCallback
187	873	cleanupSession	call site: 00873	__Client_Subscriptions_backgroundPublish
92	64	__Client_Service	call site: 00064	connectSync
92	157	notifyClientState	call site: 00157	__UA_Client_startup
89	1061	processServiceResponse	call site: 01061	connectActivity
52	301	UA_Array_delete	call site: 00301	__Client_Subscriptions_backgroundPublish
49	251	UA_UNLOCK	call site: 00251	__Client_Subscriptions_backgroundPublish
7	43	UA_mbedTLS_LoadLocalCertificate	call site: 00043	UA_ByteString_copy
4	38	UA_mbedTLS_CopyDataFormatAware	call site: 00038	UA_ByteString_copy
4	1192	UA_ClientConfig_clear	call site: 01192	UA_DataType_clear
3	368	UA_SecureChannel_deleteBuffered	call site: 00368	UA_Chunk_delete
2	16	UA_ConnectionManager_new_POSIX_TCP	call site: 00016	UA_copy

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

285

Reachable functions

357

Percentage of reachable functions covered

20.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_client.cc	1
/src/open62541/plugins/ua_config_default.c	2
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	41
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	45
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	6
/src/open62541/src/client/ua_client.c	24
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/client/ua_client_connect.c	47
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/src/ua_securechannel_crypto.c	21
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/client/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/work/open62541/src_generated/open62541/transport_generated.h	4
/src/open62541/src/client/ua_client_subscriptions.c	21
/src/open62541/deps/ziptree.c	6
/src/open62541/src/util/ua_util.c	9
/src/open62541/src/client/ua_client_discovery.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	1
/src/open62541/src/client/../ua_securechannel.h	1
/src/open62541/src/util/ua_encryptedsecret.c	8
/src/open62541/src/util/../ua_securechannel.h	1
/src/open62541/arch/posix/clock_posix.c	1

Fuzzer: fuzz_base64_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	1
/src/open62541/deps/base64.c	1

Fuzzer: fuzz_mdns_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	87	68.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	31.4%
All colors	127	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
83	39	_is_local	call site: 00039	_cache
3	123	LLVMFuzzerTestOneInput	call site: 00123	_free_cached
1	33	inet_anyaddr	call site: 00033	htons

Runtime coverage analysis

Covered functions

14

Functions that are reachable but not covered

39

Reachable functions

53

Percentage of reachable functions covered

26.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	1
/work/open62541/src_generated/mdnsd/1035.c	6
/work/open62541/src_generated/mdnsd/mdnsd.c	26
/work/open62541/src_generated/mdnsd/inet.c	3
/work/open62541/src_generated/mdnsd/log.c	1

Fuzzer: fuzz_pubsub_connection_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	29.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	70.5%
All colors	34	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	7	UA_PubSubConnectionConfig_copy	call site: 00007	UA_String_copy
2	22	UA_PubSubConnectionConfig_clear	call site: 00022	UA_String_clear
1	12	UA_PubSubConnectionConfig_copy	call site: 00012	UA_copy
1	18	UA_Array_copy	call site: 00018	UA_Array_delete
1	20	UA_Array_delete	call site: 00020	UA_PubSubConnectionConfig_clear
1	27	UA_PubSubConnectionConfig_clear	call site: 00027	UA_clear
1	30	UA_PubSubConnectionConfig_clear	call site: 00030	UA_Array_delete

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

0

Reachable functions

18

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	1
/src/open62541/src/ua_types_encoding_binary.c	3
/src/open62541/src/ua_types.c	4
/src/open62541/src/pubsub/ua_pubsub_connection.c	2
/src/open62541/src/pubsub/ua_pubsub_manager.c	2
/work/open62541/src_generated/open62541/types_generated.h	4
/src/open62541/src/util/ua_util.c	2

Fuzzer: fuzz_json_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	21.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	78.1%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	29	LLVMFuzzerTestOneInput	call site: 00029	UA_calcSizeJson
3	42	LLVMFuzzerTestOneInput	call site: 00042
2	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear
2	36	LLVMFuzzerTestOneInput	call site: 00036
1	27	UA_ByteString_allocBuffer	call site: 00027

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

3

Reachable functions

25

Percentage of reachable functions covered

88.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	3

Fuzzer: fuzz_pubsub_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	18	12.8%
gold	[1:9]	1	0.71%
yellow	[10:29]	11	7.85%
greenyellow	[30:49]	7	5.0%
lawngreen	50+	103	73.5%
All colors	140	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	100	stringOrder	call site: 00100	nodeIdOrder
7	92	UA_DataSetMessage_keyFrame_decodeBinary	call site: 00092	decodeRawField
1	132	UA_DataSetMessage_clear	call site: 00132	UA_clear
1	134	UA_NetworkMessage_clear	call site: 00134	UA_clear
1	136	UA_NetworkMessage_clear	call site: 00136	UA_clear

Runtime coverage analysis

Covered functions

80

Functions that are reachable but not covered

7

Reachable functions

39

Percentage of reachable functions covered

82.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	19
/src/open62541/src/pubsub/../util/ua_util_internal.h	3
/src/open62541/src/ua_types_encoding_binary.c	2
/src/open62541/src/ua_types.c	7
/work/open62541/src_generated/open62541/types_generated.h	4

Fuzzer: fuzz_xml_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	8.82%
gold	[1:9]	1	0.73%
yellow	[10:29]	3	2.20%
greenyellow	[30:49]	1	0.73%
lawngreen	50+	119	87.5%
All colors	136	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	123	LLVMFuzzerTestOneInput	call site: 00123
2	109	LLVMFuzzerTestOneInput	call site: 00109	UA_calcSizeXml
2	112	UA_encodeXml	call site: 00112	UA_ByteString_clear
2	117	LLVMFuzzerTestOneInput	call site: 00117
1	88	UA_decodeXml	call site: 00088	UA_STRING
1	104	LLVMFuzzerTestOneInput	call site: 00104	UA_clear
1	107	UA_ByteString_allocBuffer	call site: 00107

Runtime coverage analysis

Covered functions

165

Functions that are reachable but not covered

4

Reachable functions

59

Percentage of reachable functions covered

93.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_xml.c	9
/src/open62541/deps/yxml.c	34
/src/open62541/src/ua_types.c	4

Fuzzer: fuzz_tcp_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2857	17.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.00%
lawngreen	50+	13272	82.2%
All colors	16130	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
666	14668	UA_encodeBinaryInternal	call site: 14668	addWriterGroupConfig
200	14462	initPubSubNS0	call site: 14462	addPubSubConnectionConfig
180	1297	unlockServer	call site: 01297	auditWriteUpdateEvent
124	1084	copyAttributeIntoNode	call site: 01084	UA_MonitoredItem_processSampledValue
112	15379	initPubSubNS0	call site: 15379	UA_Server_addPublishedDataSet
74	15708	UA_Session_detachSubscription	call site: 15708	UA_Subscription_delete
58	523	UA_findDataTypeWithCustom	call site: 00523	UA_DataType_toDescription
52	15881	notifySubscription	call site: 15881	UA_Subscription_delete
42	15790	removeCallback	call site: 15790	async_cancel
34	15614	initPubSubNS0	call site: 15614	UA_PubSubManager_setState
33	15578	initPubSubNS0	call site: 15578	UA_PubSubManager_reserveIds
29	1267	parse_nodeid_body	call site: 01267	parse_relativepath

Runtime coverage analysis

Covered functions

2255

Functions that are reachable but not covered

545

Reachable functions

2600

Percentage of reachable functions covered

79.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	2
/src/open62541/tests/fuzz/custom_memory_manager.c	2
/src/open62541/plugins/include/open62541/server_config_default.h	1
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	80
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	109
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	24
/src/open62541/src/util/ua_util_internal.h	7
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	2
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	21
/src/open62541/src/server/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	8
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	46
/src/open62541/src/server/ua_server_utils.c	9
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	6
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	4
/src/open62541/src/server/ua_server_binary.c	3
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	4
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_securechannel.c	12
/src/open62541/src/ua_securechannel_crypto.c	3
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_discovery.c	2

Fuzzer: fuzz_binary_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	21.3%
gold	[1:9]	2	3.27%
yellow	[10:29]	1	1.63%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	45	73.7%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	19	UA_encodeBinaryInternal	call site: 00019	exchangeBuffer
2	28	LLVMFuzzerTestOneInput	call site: 00028	UA_calcSizeBinary
2	31	UA_encodeBinary	call site: 00031	UA_ByteString_clear
1	26	UA_ByteString_allocBuffer	call site: 00026	UA_delete
1	49	copySubString	call site: 00049	UA_Variant_copyRange
1	53	UA_Variant_copyRange	call site: 00053	Variant_clear
1	56	UA_DataValue_copyRange	call site: 00056	Variant_clear
1	58	LLVMFuzzerTestOneInput	call site: 00058	UA_clear

Runtime coverage analysis

Covered functions

141

Functions that are reachable but not covered

3

Reachable functions

39

Percentage of reachable functions covered

92.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	17
/src/open62541/src/ua_types_encoding_binary.c	8
/src/open62541/src/util/ua_util_internal.h	2
/work/open62541/src_generated/open62541/types_generated.h	6

Fuzzer: fuzz_process_request

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2725	16.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13392	83.0%
All colors	16117	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
872	14461	initPubSubNS0	call site: 14461	addPubSubConnectionConfig
124	1083	copyAttributeIntoNode	call site: 01083	UA_MonitoredItem_processSampledValue
112	15378	initPubSubNS0	call site: 15378	UA_Server_addPublishedDataSet
94	1382	UA_String_vformat	call site: 01382	auditEvent
85	495	Variant_clear	call site: 00495	UA_DataType_toDescription
74	15707	UA_Session_detachSubscription	call site: 15707	UA_Subscription_delete
63	1296	unlockServer	call site: 01296	readSAOfromEventInstance
49	15880	notifySubscription	call site: 15880	UA_Subscription_delete
48	15783	UA_Subscription_delete	call site: 15783	UA_MonitoredItem_delete
34	15613	initPubSubNS0	call site: 15613	UA_PubSubManager_setState
33	15577	initPubSubNS0	call site: 15577	UA_PubSubManager_reserveIds
29	1266	parse_nodeid_body	call site: 01266	parse_relativepath

Runtime coverage analysis

Covered functions

2302

Functions that are reachable but not covered

497

Reachable functions

2601

Percentage of reachable functions covered

80.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_process_request.cc	2
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	111
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	24
/src/open62541/src/util/ua_util_internal.h	7
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	5
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	13
/src/open62541/src/server/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	9
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	13
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	46
/src/open62541/src/server/ua_server_utils.c	9
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	6
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	4
/src/open62541/src/server/ua_server_binary.c	4
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_securechannel.c	18
/src/open62541/src/ua_securechannel_crypto.c	3
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/tests/testing-plugins/testing_networklayers.c	1
/src/open62541/src/server/ua_services.c	3

Fuzzer: fuzz_server_services

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3256	19.4%
gold	[1:9]	108	0.64%
yellow	[10:29]	49	0.29%
greenyellow	[30:49]	25	0.14%
lawngreen	50+	13309	79.4%
All colors	16747	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
872	14461	initPubSubNS0	call site: 14461	addPubSubConnectionConfig
150	1083	copyAttributeIntoNode	call site: 01083	UA_MonitoredItem_processSampledValue
132	16166	LLVMFuzzerTestOneInput	call site: 16166	Service_CreateSession
117	16308	getSessionByToken	call site: 16308	checkActivateSessionX509
112	15378	initPubSubNS0	call site: 15378	UA_Server_addPublishedDataSet
94	1382	UA_String_vformat	call site: 01382	auditEvent
85	495	Variant_clear	call site: 00495	UA_DataType_toDescription
84	1296	unlockServer	call site: 01296	auditWriteUpdateEvent
77	16577	Service_CreateMonitoredItems	call site: 16577	Operation_CreateMonitoredItem
74	15707	UA_Session_detachSubscription	call site: 15707	UA_Subscription_delete
52	15880	notifySubscription	call site: 15880	UA_Subscription_delete
42	15789	removeCallback	call site: 15789	async_cancel

Runtime coverage analysis

Covered functions

2314

Functions that are reachable but not covered

613

Reachable functions

2829

Percentage of reachable functions covered

78.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_server_services.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	86
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	176
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	26
/src/open62541/src/util/ua_util_internal.h	14
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	16
/src/open62541/src/server/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	12
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	14
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	46
/src/open62541/src/server/ua_server_utils.c	10
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	14
/src/open62541/src/server/ua_server_auditing.c	12
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	21
/src/open62541/src/server/ua_server_binary.c	4
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_securechannel.c	17
/src/open62541/src/ua_securechannel_crypto.c	8
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	13
/src/open62541/src/server/ua_services_subscription.c	8
/src/open62541/src/server/ua_services_discovery.c	16
/src/open62541/src/server/../ua_securechannel.h	1
/src/open62541/plugins/crypto/mbedtls/certificategroup.c	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	2
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_services.c	1

Fuzzer: fuzz_certificate_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	29	40.8%
gold	[1:9]	11	15.4%
yellow	[10:29]	10	14.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	21	29.5%
All colors	71	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	36	UA_CertificateUtils_getExpirationDate	call site: 00036	UA_DateTime_fromStruct
5	50	UA_CertificateUtils_getKeySize	call site: 00050	mbedtls_pk_rsa
4	27	UA_mbedTLS_LoadPemCrl	call site: 00027	UA_String_copy
4	42	LLVMFuzzerTestOneInput	call site: 00042	mbedtls_thumbprint_sha1
3	17	UA_mbedTLS_LoadPemCertificate	call site: 00017	UA_clear
3	58	UA_CertificateUtils_checkCA	call site: 00058	mbedtlsCheckCA
3	67	UA_CertificateUtils_verifyApplicationUri	call site: 00067	UA_Bstrstr
1	13	UA_mbedTLS_CopyDataFormatAware	call site: 00013	UA_copy
1	32	LLVMFuzzerTestOneInput	call site: 00032	UA_clear

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

24

Reachable functions

48

Percentage of reachable functions covered

50.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/crypto/mbedtls/certificategroup.c	8
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	8
/work/open62541/src_generated/open62541/types_generated.h	6
/src/open62541/src/ua_types.c	6
/src/open62541/deps/libc_time.c	3
/usr/include/mbedtls/pk.h	1

Fuzzer: fuzz_attributeoperand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	379	75.3%
gold	[1:9]	2	0.39%
yellow	[10:29]	8	1.59%
greenyellow	[30:49]	8	1.59%
lawngreen	50+	106	21.0%
All colors	503	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
149	244	UA_STRING	call site: 00244	buildEnumDefinitionFromProperties
102	97	stringOrder	call site: 00097	UA_Server_readBrowseName
40	203	UA_Array_delete	call site: 00203	UA_DataType_toDescription
39	57	lookupRefType	call site: 00057	UA_Server_browseRecursive
7	15	UA_String_unescape	call site: 00015	UA_NamespaceMapping_uri2Index
6	33	parse_nodeid_body	call site: 00033	UA_readNumberWithBase
5	412	nodeId_printEscape	call site: 00412	UA_String_escapedSize
5	476	UA_AttributeOperand_print	call site: 00476	UA_STRING
3	10	parse_nodeid	call site: 00010	UA_String_unescape
3	441	printRelativePath	call site: 00441	UA_STRING
2	200	UA_ByteString_allocBuffer	call site: 00200	UA_Variant_copyRange
2	397	parse_relativepathElement	call site: 00397	UA_RelativePathElement_clear

Runtime coverage analysis

Covered functions

83

Functions that are reachable but not covered

155

Reachable functions

225

Percentage of reachable functions covered

31.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/work/open62541/src_generated/open62541/types_generated.h	49
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/ua_types.c	57
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/src/util/ua_util.c	14
/src/open62541/deps/base64.c	2
/src/open62541/src/server/ua_services_view.c	17
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	6
/src/open62541/deps/ziptree.c	8
/src/open62541/src/server/ua_server_internal.h	2
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_eventfilter_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	360	64.0%
gold	[1:9]	2	0.35%
yellow	[10:29]	6	1.06%
greenyellow	[30:49]	1	0.17%
lawngreen	50+	193	34.3%
All colors	562	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
105	343	UA_ExtensionObject_setValue	call site: 00343	buildEnumDefinitionFromProperties
103	155	stringOrder	call site: 00155	UA_Server_readBrowseName
39	115	lookupRefType	call site: 00115	UA_Server_browseRecursive
39	303	UA_QualifiedName_parseEx	call site: 00303	UA_DataType_toStructureDescription
25	277	UA_Array_copy	call site: 00277	UA_DataType_toDescription
14	262	Variant_clear	call site: 00262	readExternalValueAttribute
7	45	UA_String_unescape	call site: 00045	UA_NamespaceMapping_uri2Index
4	40	parse_nodeid	call site: 00040	UA_String_unescape
2	259	UA_Array_delete	call site: 00259	Variant_clear
2	522	UA_Array_append	call site: 00522	UA_Array_delete
1	37	UA_EventFilter_lex	call site: 00037	UA_NodeId_parseEx
1	57	UA_readNumberWithBase	call site: 00057	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

186

Functions that are reachable but not covered

138

Reachable functions

261

Percentage of reachable functions covered

47.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	1
/src/open62541/src/ua_types.c	51
/work/open62541/src_generated/open62541/types_generated.h	58
/src/open62541/src/util/ua_eventfilter_grammar.c	14
/src/open62541/src/util/ua_eventfilter_lex.c	2
/src/open62541/src/util/ua_eventfilter_parser.c	14
/src/open62541/include/open62541/plugin/log.h	1
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/util/ua_types_lex.c	19
/src/open62541/src/util/ua_util.c	6
/src/open62541/deps/base64.c	1
/src/open62541/src/util/ua_util_internal.h	5
/src/open62541/src/server/ua_services_view.c	17
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	6
/src/open62541/deps/ziptree.c	8
/src/open62541/src/server/ua_server_internal.h	2
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5

Fuzzer: fuzz_mdns_xht

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	3.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	96.4%
All colors	28	100

Runtime coverage analysis

Covered functions

13

Functions that are reachable but not covered

6

Reachable functions

19

Percentage of reachable functions covered

68.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	1
/work/open62541/src_generated/mdnsd/sdtxt.c	5
/work/open62541/src_generated/mdnsd/xht.c	7

Fuzzer: fuzz_binary_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3197	19.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13209	80.5%
All colors	16406	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
872	14462	initPubSubNS0	call site: 14462	addPubSubConnectionConfig
365	16037	serverNetworkCallbackLocked	call site: 16037	processSecureChannelMessage
181	1084	copyAttributeIntoNode	call site: 01084	UA_MonitoredItem_processSampledValue
180	1297	unlockServer	call site: 01297	auditWriteUpdateEvent
112	15379	initPubSubNS0	call site: 15379	UA_Server_addPublishedDataSet
85	496	Variant_clear	call site: 00496	UA_DataType_toDescription
74	15708	UA_Session_detachSubscription	call site: 15708	UA_Subscription_delete
52	15881	notifySubscription	call site: 15881	UA_Subscription_delete
48	15784	UA_Subscription_delete	call site: 15784	UA_MonitoredItem_delete
46	77	format_string_loop	call site: 00077	UA_NodeId_print
34	15614	initPubSubNS0	call site: 15614	UA_PubSubManager_setState
33	15578	initPubSubNS0	call site: 15578	UA_PubSubManager_reserveIds

Runtime coverage analysis

Covered functions

2148

Functions that are reachable but not covered

618

Reachable functions

2650

Percentage of reachable functions covered

76.68%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_message.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	117
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	25
/src/open62541/src/util/ua_util_internal.h	10
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	2
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	13
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	9
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	13
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	46
/src/open62541/src/server/ua_server_utils.c	9
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	9
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	4
/src/open62541/src/server/ua_server_binary.c	16
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	16
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/tests/testing-plugins/testing_networklayers.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	3

Fuzzer: fuzz_config_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3299	19.8%
gold	[1:9]	23	0.13%
yellow	[10:29]	41	0.24%
greenyellow	[30:49]	3	0.01%
lawngreen	50+	13289	79.7%
All colors	16655	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
872	15101	initPubSubNS0	call site: 15101	addPubSubConnectionConfig
180	1937	unlockServer	call site: 01937	auditWriteUpdateEvent
173	1732	copyAttributeIntoNode	call site: 01732	UA_MonitoredItem_processSampledValue
111	16018	initPubSubNS0	call site: 16018	UA_Server_addPublishedDataSet
100	769	UA_KeyValueMap_getScalar	call site: 00769	UA_CertificateGroup_Filestore
85	1146	Variant_clear	call site: 01146	UA_DataType_toDescription
74	16345	UA_Session_detachSubscription	call site: 16345	UA_Subscription_delete
52	16518	notifySubscription	call site: 16518	UA_Subscription_delete
48	16421	UA_Subscription_delete	call site: 16421	UA_MonitoredItem_delete
46	79	format_string_loop	call site: 00079	UA_NodeId_print
44	519	UA_SecurityPolicy_initByUri	call site: 00519	UA_SecurityPolicy_Basic128Rsa15
43	723	UA_Variant_setScalar	call site: 00723	UA_CertificateGroup_Filestore

Runtime coverage analysis

Covered functions

2183

Functions that are reachable but not covered

630

Reachable functions

2687

Percentage of reachable functions covered

76.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_config_json.cc	1
/src/open62541/plugins/ua_config_json.c	31
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	80
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	112
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	27
/src/open62541/src/util/ua_util_internal.h	7
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	4
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/deps/cj5.c	10
/src/open62541/deps/utf8.h	1
/src/open62541/src/ua_types_encoding_json.c	13
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic128rsa15.c	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic256.c	4
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic256sha256.c	4
/src/open62541/plugins/crypto/mbedtls/securitypolicy_aes128sha256rsaoaep.c	4
/src/open62541/plugins/crypto/mbedtls/securitypolicy_aes256sha256rsapss.c	4
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	10
/src/open62541/plugins/crypto/mbedtls/certificategroup.c	2
/src/open62541/plugins/crypto/ua_filestore_common.c	1
/src/open62541/src/server/ua_server.c	13
/src/open62541/src/server/../util/ua_util_internal.h	3
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	8
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	13
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	63
/src/open62541/src/server/ua_nodes.c	35
/src/open62541/src/server/ua_services_view.c	39
/src/open62541/deps/ziptree.c	13
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	15
/src/open62541/src/server/ua_services_attribute.c	46
/src/open62541/src/server/ua_server_utils.c	9
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	6
/work/open62541/src_generated/open62541/namespace0_generated.c	1671
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	3
/src/open62541/src/server/ua_server_binary.c	3
/src/open62541/src/server/ua_server_binary_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	21
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/ua_types_encoding_binary.c	4
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_securechannel.c	12
/src/open62541/src/ua_securechannel_crypto.c	3
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1

Fuzzer: fuzz_parse_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	366	65.8%
gold	[1:9]	3	0.53%
yellow	[10:29]	3	0.53%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	184	33.0%
All colors	556	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
144	302	UA_STRING	call site: 00302	buildEnumDefinitionFromProperties
103	157	stringOrder	call site: 00157	UA_Server_readBrowseName
40	261	UA_Array_delete	call site: 00261	UA_DataType_toDescription
39	117	lookupRefType	call site: 00117	UA_Server_browseRecursive
7	12	UA_String_unescape	call site: 00012	UA_NamespaceMapping_uri2Index
4	7	parse_nodeid	call site: 00007	UA_String_unescape
3	478	nodeId_printEscape	call site: 00478	UA_String_escapedSize
3	491	nodeId_printEscape	call site: 00491	UA_String_escapeInsert
3	518	printRelativePath	call site: 00518	UA_String_clear
2	101	parse_qn	call site: 00101	UA_QualifiedName_clear
1	4	LLVMFuzzerTestOneInput	call site: 00004	UA_NodeId_parseEx
1	24	UA_readNumberWithBase	call site: 00024	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

146

Reachable functions

261

Percentage of reachable functions covered

44.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_parse_string.cc	1
/src/open62541/src/ua_types.c	57
/work/open62541/src_generated/open62541/types_generated.h	63
/src/open62541/src/util/ua_types_lex.c	21
/src/open62541/src/util/ua_util.c	13
/src/open62541/deps/base64.c	2
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/deps/parse_num.c	2
/src/open62541/deps/libc_time.c	3
/src/open62541/src/server/ua_services_view.c	17
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	6
/src/open62541/deps/ziptree.c	8
/src/open62541/src/server/ua_server_internal.h	2
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_json_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	4.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	96.0%
All colors	25	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear

Runtime coverage analysis

Covered functions

110

Functions that are reachable but not covered

0

Reachable functions

15

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	2
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	1

Fuzzer: fuzz_pubsub_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	7.93%
gold	[1:9]	1	1.58%
yellow	[10:29]	1	1.58%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	56	88.8%
All colors	63	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	54	UA_DataSetMessage_clear	call site: 00054	UA_DataValue_clear
1	50	UA_NetworkMessage_decodeJson	call site: 00050	UA_Array_delete
1	57	UA_NetworkMessage_clear	call site: 00057	UA_clear
1	59	UA_NetworkMessage_clear	call site: 00059	UA_clear

Runtime coverage analysis

Covered functions

128

Functions that are reachable but not covered

3

Reachable functions

28

Percentage of reachable functions covered

89.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	2
/src/open62541/src/ua_types_encoding_json.c	5
/src/open62541/deps/cj5.c	7
/src/open62541/src/pubsub/../ua_types_encoding_json.h	2
/src/open62541/src/ua_types_encoding_json.h	2
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	2
/src/open62541/src/ua_types.c	2
/work/open62541/src_generated/open62541/types_generated.h	3

Fuzzer: fuzz_src_ua_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	100.%
All colors	17	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

3

Reachable functions

13

Percentage of reachable functions covered

76.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	3
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/util/ua_util.c	4

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
MdnsdDriver_start	/src/open62541/drivers/discovery_mdns_mdnsd.c	1	['N/A']	13	0	468	65	24	244	0	1426	523
UA_CreateCertificate	/src/open62541/plugins/crypto/mbedtls/create_certificate.c	9	['N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'int', 'N/A', 'N/A', 'N/A']	4	0	976	136	51	66	0	259	189
UDP_openConnection	/src/open62541/arch/posix/eventloop_posix_udp.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	13	0	155	17	7	113	0	624	186

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3338 / 4982

Cyclomatic complexity statically reachable by fuzzers

13726 / 21646

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/open62541/tests/fuzz/fuzz_base64_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_client.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_NamespaceMapping_delete', 'cleanupSession', '__Client_Service', 'notifyClientState', 'processServiceResponse', 'UA_Array_delete', 'UA_UNLOCK', 'UA_mbedTLS_LoadLocalCertificate', 'UA_mbedTLS_CopyDataFormatAware', 'UA_ClientConfig_clear']

/src/open62541/tests/fuzz/fuzz_base64_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_mdns_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_is_local', 'LLVMFuzzerTestOneInput', 'inet_anyaddr']

/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_PubSubConnectionConfig_copy', 'UA_PubSubConnectionConfig_clear', 'UA_Array_copy', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'UA_DataSetMessage_keyFrame_decodeBinary', 'UA_DataSetMessage_clear', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_encodeXml', 'UA_decodeXml', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_tcp_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'initPubSubNS0', 'unlockServer', 'copyAttributeIntoNode', 'UA_Session_detachSubscription', 'UA_findDataTypeWithCustom', 'notifySubscription', 'removeCallback']

/src/open62541/tests/fuzz/fuzz_binary_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'LLVMFuzzerTestOneInput', 'UA_encodeBinary', 'UA_ByteString_allocBuffer', 'copySubString', 'UA_Variant_copyRange', 'UA_DataValue_copyRange']

/src/open62541/tests/fuzz/fuzz_process_request.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'copyAttributeIntoNode', 'UA_String_vformat', 'Variant_clear', 'UA_Session_detachSubscription', 'unlockServer', 'notifySubscription', 'UA_Subscription_delete']

/src/open62541/tests/fuzz/fuzz_server_services.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'copyAttributeIntoNode', 'LLVMFuzzerTestOneInput', 'getSessionByToken', 'UA_String_vformat', 'Variant_clear', 'unlockServer', 'Service_CreateMonitoredItems', 'UA_Session_detachSubscription']

/src/open62541/tests/fuzz/fuzz_certificate_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_CertificateUtils_getExpirationDate', 'UA_CertificateUtils_getKeySize', 'UA_mbedTLS_LoadPemCrl', 'LLVMFuzzerTestOneInput', 'UA_mbedTLS_LoadPemCertificate', 'UA_CertificateUtils_checkCA', 'UA_CertificateUtils_verifyApplicationUri', 'UA_mbedTLS_CopyDataFormatAware']

/src/open62541/tests/fuzz/fuzz_attributeoperand.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid_body', 'nodeId_printEscape', 'UA_AttributeOperand_print', 'parse_nodeid', 'printRelativePath']

/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_ExtensionObject_setValue', 'stringOrder', 'lookupRefType', 'UA_QualifiedName_parseEx', 'UA_Array_copy', 'Variant_clear', 'UA_String_unescape', 'parse_nodeid', 'UA_Array_delete', 'UA_Array_append']

/src/open62541/tests/fuzz/fuzz_mdns_xht.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_binary_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'serverNetworkCallbackLocked', 'copyAttributeIntoNode', 'unlockServer', 'Variant_clear', 'UA_Session_detachSubscription', 'notifySubscription', 'UA_Subscription_delete', 'format_string_loop']

/src/open62541/tests/fuzz/fuzz_config_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'unlockServer', 'copyAttributeIntoNode', 'UA_KeyValueMap_getScalar', 'Variant_clear', 'UA_Session_detachSubscription', 'notifySubscription', 'UA_Subscription_delete', 'format_string_loop']

/src/open62541/tests/fuzz/fuzz_parse_string.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid', 'nodeId_printEscape', 'printRelativePath', 'parse_qn']

/src/open62541/tests/fuzz/fuzz_json_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

/src/open62541/tests/fuzz/fuzz_pubsub_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_DataSetMessage_clear', 'UA_NetworkMessage_decodeJson', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_src_ua_util.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
processServiceResponse	40	10	25.0%	['fuzz_client']
__Client_Service	68	8	11.76%	['fuzz_client']
clearStructure	35	19	54.28%	['fuzz_binary_decode', 'fuzz_json_decode', 'fuzz_pubsub_binary', 'fuzz_config_json', 'fuzz_xml_decode_encode', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_client', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_pubsub_connection_config']
mdnsd_free	42	19	45.23%	['fuzz_mdns_message']
mdnsd_in	96	8	8.333%	['fuzz_mdns_message']
UA_encodeJson	35	18	51.42%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_json_decode_encode']
ExtensionObject_encodeJson	37	4	10.81%	['fuzz_json_decode_encode']
DiagnosticInfo_encodeJson	33	12	36.36%	['fuzz_json_decode_encode']
decodeMatrixVariant	36	10	27.77%	['fuzz_xml_decode_encode']
UA_KeyValueRestriction_validate	35	15	42.85%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
UA_EventLoopPOSIX_start	76	37	48.68%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
openSignalPipe	33	17	51.51%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
TCP_registerListenSocket	167	72	43.11%	['fuzz_tcp_message']
TCP_sendWithConnection	42	23	54.76%	['fuzz_tcp_message']
format_string_loop	239	99	41.42%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
print_integer_finalization	51	16	31.37%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
UA_PubSubManager_setState	36	16	44.44%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
UA_NodePointer_copy	42	19	45.23%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
UA_Node_insertOrUpdateLocale	37	14	37.83%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
deleteServerSecureChannel	43	21	48.83%	['fuzz_tcp_message', 'fuzz_binary_message']
UA_BinaryProtocolManager_start	56	30	53.57%	['fuzz_tcp_message']
compatibleValue	37	10	27.02%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
readValueAttributeComplete	33	18	54.54%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_eventfilter_parse']
copyAttributeIntoNode	188	49	26.06%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
writeNodeValueAttribute	90	39	43.33%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
addNode_raw	73	35	47.94%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
checkParentReference	63	29	46.03%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
useVariableTypeAttributes	48	20	41.66%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
typeCheckVariableNode	80	28	35.0%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
recursiveCallConstructors	91	41	45.05%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
Operation_addReference	110	56	50.90%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
UA_Server_addMethodNodeEx_finish	88	39	44.31%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
Operation_Browse	89	36	40.44%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
browse	48	26	54.16%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
browseWithNode	65	23	35.38%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
UA_SecureChannel_getCompleteMessage	107	8	7.476%	['fuzz_binary_message', 'fuzz_tcp_message', 'fuzz_client']
structureOrder	51	28	54.90%	['fuzz_binary_decode', 'fuzz_attributeoperand']
activateSession_default	72	28	38.88%	['fuzz_process_request']
Service_Read	44	13	29.54%	['fuzz_process_request']
auditEvent	87	4	4.597%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
process_RegisterServer	104	5	4.807%	['fuzz_process_request', 'fuzz_server_services']
Service_CreateSession_inner	156	74	47.43%	['fuzz_process_request', 'fuzz_server_services']
signCreateSessionResponse	36	4	11.11%	['fuzz_process_request', 'fuzz_server_services']
Service_ActivateSession_inner	206	90	43.68%	['fuzz_process_request', 'fuzz_server_services']
selectTokenPolicy	68	27	39.70%	['fuzz_process_request', 'fuzz_server_services']
UA_String_vformat	31	15	48.38%	['fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
createSubscriptionObject	56	18	32.14%	['fuzz_server_services']
process_FindServersOnNetwork	44	4	9.090%	['fuzz_server_services']
Service_CreateMonitoredItems	32	16	50.0%	['fuzz_server_services']
Service_ModifySubscription	42	10	23.80%	['fuzz_server_services']
Operation_TranslateBrowsePathToNodeIds	104	57	54.80%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_eventfilter_parse']
walkBrowsePathElement	85	32	37.64%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_eventfilter_parse']
lookupRefType	38	12	31.57%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_eventfilter_parse']
SecurityPolicyField_parseJson	41	22	53.65%	['fuzz_config_json']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/open62541/deps/mp_printf.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/plugins/ua_log_syslog.c	[]	[]
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	['fuzz_xml_decode_encode']	['fuzz_xml_decode_encode']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic128rsa15.c	['fuzz_config_json']	[]
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	['fuzz_certificate_parse']	['fuzz_certificate_parse']
/src/open62541/src/client/ua_client_subscriptions.c	['fuzz_client']	['fuzz_client']
/src/open62541/deps/utf8.h	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/deps/yxml.c	['fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	['fuzz_src_ua_util']	['fuzz_src_ua_util']
/src/open62541/plugins/ua_config_default.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_services_monitoreditem.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_server_services']
/src/open62541/deps/musl_inet_pton.c	[]	[]
/src/open62541/plugins/ua_log_stdout.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_nodes.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_server_binary.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_aes256sha256rsapss.c	['fuzz_config_json']	[]
/src/open62541/plugins/historydata/ua_history_database_default.c	[]	[]
/src/open62541/src/client/ua_client_discovery.c	['fuzz_client']	[]
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	['fuzz_base64_decode']	['fuzz_base64_decode']
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	['fuzz_attributeoperand']	['fuzz_attributeoperand']
/src/open62541/src/server/ua_server_auditing.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/src/server/ua_server_ns0_diagnostics.c	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/tests/fuzz/fuzz_json_decode.cc	['fuzz_json_decode']	['fuzz_json_decode']
/src/open62541/tests/fuzz/fuzz_client.cc	['fuzz_client']	['fuzz_client']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_pubsub_aes128ctr.c	[]	[]
/src/open62541/include/open62541/server.h	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message']	[]
/work/open62541/src_generated/mdnsd/mdnsd.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/deps/itoa.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_parse_string']
/work/open62541/src_generated/mdnsd/inet.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/ua_securechannel.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services']
/src/open62541/arch/posix/eventloop_posix_tcp.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/arch/common/eventloop_common.c	[]	[]
/src/open62541/src/pubsub/ua_pubsub_manager.c	['fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/include/open62541/plugin/log.h	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_services_method.c	[]	[]
/src/open62541/arch/posix/eventloop_posix_interrupt.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/deps/parse_num.c	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/src/pubsub/../server/ua_server_internal.h	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/include/open62541/plugin/nodestore.h	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/deps/pcg_basic.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_services_securechannel.c	['fuzz_binary_message']	[]
/work/open62541/src_generated/open62541/config.h	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	['fuzz_pubsub_connection_config']	['fuzz_pubsub_connection_config']
/src/open62541/src/server/ua_server_internal.h	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/ua_types_encoding_xml.c	['fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_discovery.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/work/open62541/src_generated/open62541/types_generated.h	['fuzz_client', 'fuzz_pubsub_connection_config', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_json_decode', 'fuzz_pubsub_json']	['fuzz_client', 'fuzz_pubsub_connection_config', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_json_decode', 'fuzz_pubsub_json']
/src/open62541/src/ua_types_encoding_json.c	['fuzz_json_decode_encode', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_pubsub_json']	['fuzz_json_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_pubsub_json']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_aes128sha256rsaoaep.c	['fuzz_config_json']	[]
/src/open62541/plugins/ua_nodestore_ziptree.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	['fuzz_base64_encode']	['fuzz_base64_encode']
/src/open62541/plugins/crypto/ua_filestore_common.c	['fuzz_config_json']	[]
/work/open62541/src_generated/open62541/statuscodes.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/plugins/crypto/ua_certificategroup_none.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	['fuzz_binary_decode']	['fuzz_binary_decode']
/src/open62541/src/client/ua_client_connect.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/server/ua_session.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_subscription_datachange.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/server/ua_services_view.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/pubsub/ua_pubsub_ns0.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/arch/posix/eventloop_posix_eth.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_common.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_certificate_parse', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_certificate_parse', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	['fuzz_tcp_message']	['fuzz_tcp_message']
/src/open62541/src/server/ua_server_ns0.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/arch/posix/eventloop_posix_udp.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/ua_types_definition.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	[]
/src/open62541/plugins/crypto/ua_securitypolicy_filestore.c	[]	[]
/usr/include/mbedtls/pk.h	['fuzz_certificate_parse']	[]
/src/open62541/src/util/ua_eventfilter_parser.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/pubsub/ua_pubsub_reader.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/pubsub/../ua_types_encoding_json.h	['fuzz_pubsub_json']	[]
/work/open62541/src_generated/mdnsd/log.c	['fuzz_mdns_message']	[]
/src/open62541/src/util/ua_encryptedsecret.c	['fuzz_client', 'fuzz_server_services']	[]
/src/open62541/plugins/ua_accesscontrol_default.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/include/open62541/client_subscriptions.h	[]	[]
/src/open62541/src/util/ua_util.c	['fuzz_client', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_src_ua_util']	['fuzz_client', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_src_ua_util']
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	['fuzz_pubsub_binary']	['fuzz_pubsub_binary']
/src/open62541/tests/fuzz/fuzz_server_services.cc	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	['fuzz_pubsub_json']	['fuzz_pubsub_json']
/src/open62541/src/pubsub/../util/ua_util_internal.h	['fuzz_pubsub_binary', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string']
/src/open62541/arch/common/timer.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_process_request.cc	['fuzz_process_request']	['fuzz_process_request']
/work/open62541/src_generated/mdnsd/xht.c	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic256sha256.c	['fuzz_config_json']	[]
/src/open62541/arch/posix/eventloop_posix.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/ua_securechannel_crypto.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/server/ua_services_session.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/tests/fuzz/fuzz_binary_message.cc	['fuzz_binary_message']	['fuzz_binary_message']
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_pubsub_json']	['fuzz_pubsub_json']
/src/open62541/src/util/ua_eventfilter_lex.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/pubsub/ua_pubsub_writer.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/plugins/crypto/mbedtls/certificategroup.c	['fuzz_server_services', 'fuzz_certificate_parse', 'fuzz_config_json']	['fuzz_certificate_parse']
/src/open62541/plugins/historydata/ua_history_data_backend_memory.c	[]	[]
/src/open62541/src/client/../util/ua_util_internal.h	['fuzz_client']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string']
/src/open62541/tests/fuzz/fuzz_parse_string.cc	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/src/pubsub/ua_pubsub_connection.c	['fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_pubsub_connection_config']
/src/open62541/deps/utf8.c	[]	[]
/src/open62541/deps/ziptree.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/tests/testing-plugins/testing_networklayers.c	['fuzz_process_request', 'fuzz_binary_message']	['fuzz_process_request', 'fuzz_binary_message']
/src/open62541/src/server/ua_subscription.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_services_nodemanagement.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/plugins/include/open62541/server_config_default.h	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/plugins/crypto/mbedtls/create_certificate.c	[]	[]
/src/open62541/plugins/crypto/mbedtls/securitypolicy_pubsub_aes256ctr.c	[]	[]
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/client/ua_client_highlevel.c	[]	[]
/src/open62541/src/server/ua_subscription_event.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/server/ua_services_discovery.c	['fuzz_tcp_message', 'fuzz_server_services']	['fuzz_server_services']
/work/open62541/src_generated/mdnsd/sdtxt.c	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	['fuzz_config_json']	[]
/src/open62541/deps/cj5.c	['fuzz_json_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_pubsub_json']	['fuzz_json_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_pubsub_json']
/src/open62541/deps/libc_time.c	['fuzz_certificate_parse', 'fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/ua_types.c	['fuzz_client', 'fuzz_pubsub_connection_config', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_json_decode', 'fuzz_pubsub_json']	['fuzz_client', 'fuzz_pubsub_connection_config', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_xml_decode_encode', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_json_decode', 'fuzz_pubsub_json']
/src/open62541/plugins/ua_config_json.c	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/src/server/ua_server.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/util/ua_util_internal.h	['fuzz_client', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string']
/src/open62541/src/client/ua_client_util.c	[]	[]
/src/open62541/src/ua_types_encoding_binary.c	['fuzz_client', 'fuzz_pubsub_connection_config', 'fuzz_pubsub_binary', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_pubsub_connection_config', 'fuzz_pubsub_binary', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_process_request', 'fuzz_server_services']
/src/open62541/arch/posix/eventloop_posix.h	[]	[]
/src/open62541/src/client/ua_client.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/util/ua_eventfilter_grammar.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/deps/dtoa.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/ua_securechannel.h	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/pubsub/ua_pubsub_dataset.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/work/open62541/src_generated/mdnsd/1035.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	['fuzz_pubsub_binary', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_pubsub_json']	['fuzz_pubsub_binary', 'fuzz_pubsub_json']
/src/open62541/plugins/crypto/mbedtls/securitypolicy_basic256.c	['fuzz_config_json']	[]
/src/open62541/deps/base64.c	['fuzz_base64_encode', 'fuzz_client', 'fuzz_base64_decode', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_base64_encode', 'fuzz_base64_decode', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']
/src/open62541/src/server/ua_server_binary_reverse.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/arch/posix/clock_posix.c	['fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	['fuzz_json_decode_encode']	['fuzz_json_decode_encode']
/work/open62541/src_generated/open62541/transport_generated.h	['fuzz_client', 'fuzz_binary_message']	[]
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/client/../ua_securechannel.h	['fuzz_client']	[]
/src/open62541/tests/fuzz/custom_memory_manager.c	['fuzz_pubsub_binary', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_pubsub_json', 'fuzz_src_ua_util']	['fuzz_pubsub_binary', 'fuzz_tcp_message', 'fuzz_binary_decode', 'fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_pubsub_json', 'fuzz_src_ua_util']
/work/open62541/src_generated/open62541/namespace0_generated.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_services_subscription.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/drivers/discovery_mdns_mdnsd.c	[]	[]
/src/open62541/src/util/ua_types_lex.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']
/src/open62541/src/server/ua_server_config.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_services.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/src/server/ua_server_async.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/plugins/historydata/ua_history_data_gathering_default.c	[]	[]
/src/open62541/tests/fuzz/fuzz_config_json.cc	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/src/pubsub/ua_pubsub_internal.h	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']	[]
/src/open62541/src/server/ua_server_utils.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']
/src/open62541/src/server/ua_services_attribute.c	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_parse_string']	['fuzz_tcp_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json']

Directories in report

Directory
/src/open62541/tests/testing-plugins/
/usr/include/mbedtls/
/src/open62541/plugins/historydata/
/src/open62541/src/pubsub/../
/work/open62541/src_generated/mdnsd/
/src/open62541/src/
/src/open62541/plugins/crypto/
/src/open62541/src/client/
/src/open62541/src/pubsub/../server/
/src/open62541/src/util/
/src/open62541/src/server/
/src/open62541/deps/
/src/open62541/src/client/../
/src/open62541/arch/posix/
/src/open62541/src/pubsub/
/src/open62541/src/pubsub/../util/
/src/open62541/include/open62541/plugin/
/src/open62541/include/open62541/
/work/open62541/src_generated/open62541/
/src/open62541/plugins/include/open62541/
/src/open62541/plugins/
/src/open62541/tests/fuzz/
/src/open62541/arch/common/
/src/open62541/drivers/
/src/open62541/src/client/../util/
/src/open62541/plugins/crypto/mbedtls/