High level conclusions

Fuzzers reach 55.44% code coverage.

Fuzzers reach 56.28% of cyclomatic complexity.

Fuzzers reach 59.88% of all functions.

Fuzzer fuzz_client is blocked:

The runtime code coverage of fuzz_client covers 17.16% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3306 / 5521

Cyclomatic complexity statically reachable by fuzzers

13501 / 23987

Runtime code coverage of functions

3061 / 5521

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_certificate_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	67	70.5%
gold	[1:9]	3	3.15%
yellow	[10:29]	2	2.10%
greenyellow	[30:49]	4	4.21%
lawngreen	50+	19	20.0%
All colors	95	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	75	UA_CertificateUtils_verifyApplicationUri	call site: 00075	UA_Bstrstr
11	42	LLVMFuzzerTestOneInput	call site: 00042	UA_OpenSSL_LoadCertificate
10	56	UA_CertificateUtils_getKeySize	call site: 00056	X509_get_pubkey
6	9	UA_OpenSSL_LoadPemCertificate	call site: 00009	X509_get_pubkey
6	35	UA_CertificateUtils_getExpirationDate	call site: 00035	musl_tm_to_secs
5	26	UA_STRING	call site: 00026	UA_String_copy
4	68	UA_CertificateUtils_checkCA	call site: 00068	openSSLCheckCA
3	22	UA_OpenSSL_LoadPemCrl	call site: 00022	UA_STRING
1	4	UA_OpenSSL_LoadCertificate	call site: 00004	d2i_X509
1	17	UA_OpenSSL_LoadCrl	call site: 00017	d2i_X509_CRL
1	32	LLVMFuzzerTestOneInput	call site: 00032	UA_clear

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

41

Reachable functions

59

Percentage of reachable functions covered

30.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/crypto/openssl/certificategroup.c	9
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	6
/src/open62541/src/ua_types.c	3
/work/open62541/src_generated/open62541/types_generated.h	3
/src/open62541/deps/libc_time.c	3
/usr/include/openssl/x509v3.h	3

Fuzzer: fuzz_base64_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	1
/src/open62541/deps/base64.c	2

Fuzzer: fuzz_src_ua_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	100.%
All colors	17	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

3

Reachable functions

13

Percentage of reachable functions covered

76.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	3
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_attributeoperand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	382	75.4%
gold	[1:9]	1	0.19%
yellow	[10:29]	8	1.58%
greenyellow	[30:49]	9	1.77%
lawngreen	50+	106	20.9%
All colors	506	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
151	246	UA_STRING	call site: 00246	buildEnumDefinitionFromProperties
104	97	stringOrder	call site: 00097	UA_Server_readBrowseName
40	205	UA_Array_delete	call site: 00205	UA_DataType_toDescription
39	57	lookupRefType	call site: 00057	UA_Server_browseRecursive
7	15	UA_String_unescape	call site: 00015	UA_NamespaceMapping_uri2Index
6	33	parse_nodeid_body	call site: 00033	UA_readNumberWithBase
5	415	nodeId_printEscape	call site: 00415	UA_String_escapedSize
5	479	UA_AttributeOperand_print	call site: 00479	UA_STRING
3	10	parse_nodeid	call site: 00010	UA_String_unescape
3	444	printRelativePath	call site: 00444	UA_STRING
2	202	UA_ByteString_allocBuffer	call site: 00202	UA_Variant_copyRange
2	401	parse_relativepathElement	call site: 00401	UA_RelativePathElement_clear

Runtime coverage analysis

Covered functions

83

Functions that are reachable but not covered

159

Reachable functions

229

Percentage of reachable functions covered

30.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/work/open62541/src_generated/open62541/types_generated.h	49
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/ua_types.c	58
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/src/util/ua_util.c	14
/src/open62541/deps/base64.c	2
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_json_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	4.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	96.0%
All colors	25	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear

Runtime coverage analysis

Covered functions

110

Functions that are reachable but not covered

0

Reachable functions

15

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	2
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	1

Fuzzer: fuzz_parse_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	369	66.0%
gold	[1:9]	4	0.71%
yellow	[10:29]	2	0.35%
greenyellow	[30:49]	1	0.17%
lawngreen	50+	183	32.7%
All colors	559	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
146	304	UA_STRING	call site: 00304	buildEnumDefinitionFromProperties
105	157	stringOrder	call site: 00157	UA_Server_readBrowseName
40	263	UA_Array_delete	call site: 00263	UA_DataType_toDescription
39	117	lookupRefType	call site: 00117	UA_Server_browseRecursive
7	12	UA_String_unescape	call site: 00012	UA_NamespaceMapping_uri2Index
4	7	parse_nodeid	call site: 00007	UA_String_unescape
3	481	nodeId_printEscape	call site: 00481	UA_String_escapedSize
3	494	nodeId_printEscape	call site: 00494	UA_String_escapeInsert
3	521	printRelativePath	call site: 00521	UA_String_clear
2	101	parse_qn	call site: 00101	UA_QualifiedName_clear
1	4	LLVMFuzzerTestOneInput	call site: 00004	UA_NodeId_parseEx
1	24	UA_readNumberWithBase	call site: 00024	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

150

Reachable functions

265

Percentage of reachable functions covered

43.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_parse_string.cc	1
/src/open62541/src/ua_types.c	58
/work/open62541/src_generated/open62541/types_generated.h	63
/src/open62541/src/util/ua_types_lex.c	21
/src/open62541/src/util/ua_util.c	13
/src/open62541/deps/base64.c	2
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/deps/parse_num.c	2
/src/open62541/deps/libc_time.c	3
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1228	91.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	88	6.56%
greenyellow	[30:49]	19	1.41%
lawngreen	50+	6	0.44%
All colors	1341	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
472	816	cleanupSession	call site: 00816	connectActivity
252	499	UA_NamespaceMapping_delete	call site: 00499	__Client_networkCallback
162	318	UA_Array_delete	call site: 00318	__Client_Subscriptions_backgroundPublish
97	169	notifyClientState	call site: 00169	__UA_Client_startup
92	76	__Client_Service	call site: 00076	connectSync
57	752	processServiceResponse	call site: 00752	processMSGResponse
49	268	UA_UNLOCK	call site: 00268	__Client_Subscriptions_backgroundPublish
23	38	setLocalCertificate_none	call site: 00038	UA_OpenSSL_LoadLocalCertificate
4	1331	UA_ClientConfig_clear	call site: 01331	UA_DataType_clear
3	494	UA_SecureChannel_deleteBuffered	call site: 00494	UA_Chunk_delete
2	17	UA_ConnectionManager_new_POSIX_TCP	call site: 00017	UA_copy
2	66	UA_Client_newWithConfig	call site: 00066	UA_Client_delete

Runtime coverage analysis

Covered functions

97

Functions that are reachable but not covered

333

Reachable functions

402

Percentage of reachable functions covered

17.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_client.cc	1
/src/open62541/tests/testing-plugins/test_helpers.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/plugins/ua_config_default.c	1
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	42
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	48
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	8
/src/open62541/src/client/ua_client.c	27
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/client/ua_client_connect.c	50
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/client/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/work/open62541/src_generated/open62541/transport_generated.h	4
/src/open62541/src/client/ua_client_subscriptions.c	29
/src/open62541/deps/ziptree.c	8
/src/open62541/src/util/ua_util.c	15
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	1
/src/open62541/plugins/crypto/openssl/certificategroup.c	1
/usr/include/openssl/asn1.h	1
/src/open62541/src/client/ua_client_discovery.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/client/../ua_securechannel.h	1
/src/open62541/src/util/ua_encryptedsecret.c	8
/src/open62541/src/util/../ua_securechannel.h	1
/src/open62541/arch/posix/clock_posix.c	1

Fuzzer: fuzz_xml_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	8.82%
gold	[1:9]	1	0.73%
yellow	[10:29]	3	2.20%
greenyellow	[30:49]	2	1.47%
lawngreen	50+	118	86.7%
All colors	136	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	123	LLVMFuzzerTestOneInput	call site: 00123
2	109	LLVMFuzzerTestOneInput	call site: 00109	UA_calcSizeXml
2	112	UA_encodeXml	call site: 00112	UA_ByteString_clear
2	117	LLVMFuzzerTestOneInput	call site: 00117
1	88	UA_decodeXml	call site: 00088	UA_STRING
1	104	LLVMFuzzerTestOneInput	call site: 00104	UA_clear
1	107	UA_ByteString_allocBuffer	call site: 00107

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

4

Reachable functions

59

Percentage of reachable functions covered

93.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_xml.c	9
/src/open62541/deps/yxml.c	34
/src/open62541/src/ua_types.c	4

Fuzzer: fuzz_process_request

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3469	20.3%
gold	[1:9]	6	0.03%
yellow	[10:29]	3	0.01%
greenyellow	[30:49]	12	0.07%
lawngreen	50+	13598	79.5%
All colors	17088	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
816	15790	findSingleChildNode	call site: 15790	addDataSetReaderConfig
239	14970	ctxClear	call site: 14970	processSecureChannelMessage
127	1003	copyAttributeIntoNode	call site: 01003	UA_MonitoredItem_processSampledValue
113	16652	initPubSubNS0	call site: 16652	UA_Server_addPublishedDataSet
100	1309	getNodeContext	call site: 01309	recordModelChangeEvent
86	513	Variant_clear	call site: 00513	UA_DataType_toDescription
81	14669	UA_Session_detachSubscription	call site: 14669	UA_Subscription_delete
79	1412	endModelChange	call site: 01412	UA_ModelChangeAccumulator_finalize
70	15437	selectEndpointAndTokenPolicy	call site: 15437	checkActivateSessionX509
62	1233	browseRecursive	call site: 01233	UA_Server_readBrowseName
52	15622	UA_WebSocketProtocolManager_new	call site: 15622	createWebSocketServerConnection
49	14828	notifySubscription	call site: 14828	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2375

Functions that are reachable but not covered

646

Reachable functions

2818

Percentage of reachable functions covered

77.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_process_request.cc	2
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	122
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	14
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	19
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	12
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	20
/src/open62541/src/server/ua_server_binary_tcp.c	5
/src/open62541/src/server/ua_server_binary.c	16
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	3
/src/open62541/plugins/crypto/openssl/certificategroup.c	5
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	6
/src/open62541/src/server/../ua_securechannel.h	1
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_server_ws.c	7
/src/open62541/src/server/ua_server_binary_tcp_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_mdns_xht

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	3.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	96.4%
All colors	28	100

Runtime coverage analysis

Covered functions

13

Functions that are reachable but not covered

6

Reachable functions

19

Percentage of reachable functions covered

68.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	1
/work/open62541/src_generated/mdnsd/sdtxt.c	5
/work/open62541/src_generated/mdnsd/xht.c	7

Fuzzer: fuzz_pubsub_connection_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	29.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	70.5%
All colors	34	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	7	UA_PubSubConnectionConfig_copy	call site: 00007	UA_String_copy
2	22	UA_PubSubConnectionConfig_clear	call site: 00022	UA_String_clear
1	12	UA_PubSubConnectionConfig_copy	call site: 00012	UA_copy
1	18	UA_Array_copy	call site: 00018	UA_Array_delete
1	20	UA_Array_delete	call site: 00020	UA_PubSubConnectionConfig_clear
1	27	UA_PubSubConnectionConfig_clear	call site: 00027	UA_clear
1	30	UA_PubSubConnectionConfig_clear	call site: 00030	UA_Array_delete

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

0

Reachable functions

18

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	1
/src/open62541/src/ua_types_encoding_binary.c	3
/src/open62541/src/ua_types.c	4
/src/open62541/src/pubsub/ua_pubsub_connection.c	2
/src/open62541/src/pubsub/ua_pubsub_manager.c	2
/work/open62541/src_generated/open62541/types_generated.h	4
/src/open62541/src/util/ua_util.c	2

Fuzzer: fuzz_binary_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	21.3%
gold	[1:9]	2	3.27%
yellow	[10:29]	1	1.63%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	45	73.7%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	19	UA_encodeBinaryInternal	call site: 00019	exchangeBuffer
2	28	LLVMFuzzerTestOneInput	call site: 00028	UA_calcSizeBinary
2	31	UA_encodeBinary	call site: 00031	UA_ByteString_clear
1	26	UA_ByteString_allocBuffer	call site: 00026	UA_delete
1	49	copySubString	call site: 00049	UA_Variant_copyRange
1	53	UA_Variant_copyRange	call site: 00053	Variant_clear
1	56	UA_DataValue_copyRange	call site: 00056	Variant_clear
1	58	LLVMFuzzerTestOneInput	call site: 00058	UA_clear

Runtime coverage analysis

Covered functions

141

Functions that are reachable but not covered

3

Reachable functions

39

Percentage of reachable functions covered

92.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	17
/src/open62541/src/ua_types_encoding_binary.c	8
/src/open62541/src/util/ua_util_internal.h	2
/work/open62541/src_generated/open62541/types_generated.h	6

Fuzzer: fuzz_pubsub_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	7.93%
gold	[1:9]	1	1.58%
yellow	[10:29]	1	1.58%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	56	88.8%
All colors	63	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	54	UA_DataSetMessage_clear	call site: 00054	UA_DataValue_clear
1	50	UA_NetworkMessage_decodeJson	call site: 00050	UA_Array_delete
1	57	UA_NetworkMessage_clear	call site: 00057	UA_clear
1	59	UA_NetworkMessage_clear	call site: 00059	UA_clear

Runtime coverage analysis

Covered functions

129

Functions that are reachable but not covered

3

Reachable functions

28

Percentage of reachable functions covered

89.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	2
/src/open62541/src/ua_types_encoding_json.c	5
/src/open62541/deps/cj5.c	7
/src/open62541/src/pubsub/../ua_types_encoding_json.h	2
/src/open62541/src/ua_types_encoding_json.h	2
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	2
/src/open62541/src/ua_types.c	2
/work/open62541/src_generated/open62541/types_generated.h	3

Fuzzer: fuzz_eventfilter_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	363	64.2%
gold	[1:9]	2	0.35%
yellow	[10:29]	1	0.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	199	35.2%
All colors	565	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
107	345	UA_ExtensionObject_setValue	call site: 00345	buildEnumDefinitionFromProperties
105	155	stringOrder	call site: 00155	UA_Server_readBrowseName
39	115	lookupRefType	call site: 00115	UA_Server_browseRecursive
39	305	UA_QualifiedName_parseEx	call site: 00305	UA_DataType_toStructureDescription
25	279	UA_Array_copy	call site: 00279	UA_DataType_toDescription
14	264	Variant_clear	call site: 00264	readExternalValueAttribute
7	45	UA_String_unescape	call site: 00045	UA_NamespaceMapping_uri2Index
4	40	parse_nodeid	call site: 00040	UA_String_unescape
2	261	UA_Array_delete	call site: 00261	Variant_clear
2	525	UA_Array_append	call site: 00525	UA_Array_delete
1	37	UA_EventFilter_lex	call site: 00037	UA_NodeId_parseEx
1	57	UA_readNumberWithBase	call site: 00057	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

187

Functions that are reachable but not covered

142

Reachable functions

265

Percentage of reachable functions covered

46.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	1
/src/open62541/src/ua_types.c	52
/work/open62541/src_generated/open62541/types_generated.h	58
/src/open62541/src/util/ua_eventfilter_grammar.c	14
/src/open62541/src/util/ua_eventfilter_lex.c	2
/src/open62541/src/util/ua_eventfilter_parser.c	14
/src/open62541/include/open62541/plugin/log.h	1
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/util/ua_types_lex.c	19
/src/open62541/src/util/ua_util.c	6
/src/open62541/deps/base64.c	1
/src/open62541/src/util/ua_util_internal.h	5
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5

Fuzzer: fuzz_json_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	21.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	78.1%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	29	LLVMFuzzerTestOneInput	call site: 00029	UA_calcSizeJson
3	42	LLVMFuzzerTestOneInput	call site: 00042
2	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear
2	36	LLVMFuzzerTestOneInput	call site: 00036
1	27	UA_ByteString_allocBuffer	call site: 00027

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

3

Reachable functions

25

Percentage of reachable functions covered

88.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	3

Fuzzer: fuzz_pubsub_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	18	12.6%
gold	[1:9]	5	3.52%
yellow	[10:29]	7	4.92%
greenyellow	[30:49]	7	4.92%
lawngreen	50+	105	73.9%
All colors	142	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	102	stringOrder	call site: 00102	nodeIdOrder
7	94	UA_DataSetMessage_keyFrame_decodeBinary	call site: 00094	decodeRawField
1	134	UA_DataSetMessage_clear	call site: 00134	UA_clear
1	136	UA_NetworkMessage_clear	call site: 00136	UA_clear
1	138	UA_NetworkMessage_clear	call site: 00138	UA_clear

Runtime coverage analysis

Covered functions

80

Functions that are reachable but not covered

7

Reachable functions

39

Percentage of reachable functions covered

82.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	19
/src/open62541/src/pubsub/../util/ua_util_internal.h	3
/src/open62541/src/ua_types_encoding_binary.c	2
/src/open62541/src/ua_types.c	7
/work/open62541/src_generated/open62541/types_generated.h	4

Fuzzer: fuzz_mdns_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	53	41.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	1.55%
greenyellow	[30:49]	1	0.77%
lawngreen	50+	73	56.5%
All colors	129	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	73	_a_match	call site: 00073	_conflict
17	50	_r_next	call site: 00050	_r_send
6	37	mdnsd_in	call site: 00037	_is_local_ipv4
4	104	_cache	call site: 00104	_q_answer
3	95	mdnsd_in	call site: 00095	_conflict
2	126	mdnsd_free	call site: 00126	_free_record
1	33	inet_anyaddr	call site: 00033	htons
1	44	mdnsd_in	call site: 00044	vsyslog
1	122	_q_next	call site: 00122	_q_answer

Runtime coverage analysis

Covered functions

20

Functions that are reachable but not covered

33

Reachable functions

53

Percentage of reachable functions covered

37.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	1
/work/open62541/src_generated/mdnsd/1035.c	6
/work/open62541/src_generated/mdnsd/mdnsd.c	26
/work/open62541/src_generated/mdnsd/inet.c	3
/work/open62541/src_generated/mdnsd/log.c	1

Fuzzer: fuzz_base64_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	1
/src/open62541/deps/base64.c	1

Fuzzer: fuzz_datatype_description

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	37	25.8%
gold	[1:9]	5	3.49%
yellow	[10:29]	1	0.69%
greenyellow	[30:49]	1	0.69%
lawngreen	50+	99	69.2%
All colors	143	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	87	parse_qn	call site: 00087	UA_String_unescape
2	18	fromDescription	call site: 00018	UA_QualifiedName_printEx
2	23	reverse	call site: 00023	UA_ByteString_allocBuffer
2	100	parse_qn	call site: 00100	UA_QualifiedName_clear
2	119	UA_DataType_toStructureDescription	call site: 00119	UA_StructureDescription_clear
2	128	UA_DataType_toStructureDescription	call site: 00128	UA_StructureDescription_clear
2	135	UA_DataType_toSimpleTypeDescription	call site: 00135	UA_SimpleTypeDescription_clear
1	15	fromDescription	call site: 00015	UA_copy
1	30	UA_DataType_clear	call site: 00030	UA_clear
1	38	UA_DataType_fromEnumDescription	call site: 00038	UA_DataType_clear
1	48	UA_DataType_fromStructureDescription	call site: 00048	UA_DataType_clear
1	50	UA_DataType_fromStructureDescription	call site: 00050	UA_order

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

12

Reachable functions

74

Percentage of reachable functions covered

83.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_datatype_description.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	21
/src/open62541/src/ua_types_encoding_binary.c	3
/work/open62541/src_generated/open62541/types_generated.h	19
/src/open62541/src/ua_types_definition.c	11
/src/open62541/deps/itoa.c	3
/src/open62541/src/util/ua_util_internal.h	2
/src/open62541/src/util/ua_types_lex.c	4
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_server_services

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3861	22.1%
gold	[1:9]	87	0.49%
yellow	[10:29]	73	0.41%
greenyellow	[30:49]	28	0.16%
lawngreen	50+	13400	76.7%
All colors	17449	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
869	15737	initPubSubNS0	call site: 15737	addDataSetReaderConfig
245	14970	ctxClear	call site: 14970	processSecureChannelMessage
127	1003	copyAttributeIntoNode	call site: 01003	UA_MonitoredItem_processSampledValue
116	15426	Service_ActivateSession_inner	call site: 15426	checkActivateSessionX509
113	1296	UA_KeyValueMap_clear	call site: 01296	recordModelChangeEvent
113	16652	initPubSubNS0	call site: 16652	UA_Server_addPublishedDataSet
103	15219	getSessionByToken	call site: 15219	processServiceInternal
86	513	Variant_clear	call site: 00513	UA_DataType_toDescription
81	14669	UA_Session_detachSubscription	call site: 14669	UA_Subscription_delete
79	1412	endModelChange	call site: 01412	UA_ModelChangeAccumulator_finalize
76	17301	Service_CreateMonitoredItems	call site: 17301	Operation_CreateMonitoredItem
62	1233	browseRecursive	call site: 01233	UA_Server_readBrowseName

Runtime coverage analysis

Covered functions

2359

Functions that are reachable but not covered

726

Reachable functions

2975

Percentage of reachable functions covered

75.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_server_services.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	86
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	181
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	16
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	12
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	15
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	19
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	12
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription_event.c	14
/src/open62541/src/server/ua_server_auditing.c	15
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	21
/src/open62541/src/server/ua_server_binary_tcp.c	5
/src/open62541/src/server/ua_server_binary.c	16
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/server/ua_services_monitoreditem.c	13
/src/open62541/src/server/ua_services_subscription.c	8
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	4
/src/open62541/plugins/crypto/openssl/certificategroup.c	5
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	18
/src/open62541/src/server/../ua_securechannel.h	1
/src/open62541/src/server/ua_server_ns0_diagnostics.c	2
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_server_ws.c	7
/src/open62541/src/server/ua_server_binary_tcp_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11

Fuzzer: fuzz_binary_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3762	22.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13293	77.9%
All colors	17055	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
869	15738	initPubSubNS0	call site: 15738	addDataSetReaderConfig
366	14957	UA_KeyValueMap_getScalar	call site: 14957	processSecureChannelMessage
268	15325	UA_KeyValueMap_setScalar	call site: 15325	createSessionObject
127	1004	copyAttributeIntoNode	call site: 01004	UA_MonitoredItem_processSampledValue
113	1297	UA_KeyValueMap_clear	call site: 01297	recordModelChangeEvent
113	16653	initPubSubNS0	call site: 16653	UA_Server_addPublishedDataSet
86	514	Variant_clear	call site: 00514	UA_DataType_toDescription
81	14670	UA_Session_detachSubscription	call site: 14670	UA_Subscription_delete
79	1413	endModelChange	call site: 01413	UA_ModelChangeAccumulator_finalize
73	14882	UA_Session_detachFromSecureChannel	call site: 14882	auditCloseSessionEvent
62	1234	browseRecursive	call site: 01234	UA_Server_readBrowseName
52	1508	deleteNodeOperation_inner	call site: 01508	deleteNodeSet

Runtime coverage analysis

Covered functions

2194

Functions that are reachable but not covered

746

Reachable functions

2812

Percentage of reachable functions covered

73.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_message.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	122
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	14
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	19
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	12
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	20
/src/open62541/src/server/ua_server_binary_tcp.c	5
/src/open62541/src/server/ua_server_binary.c	16
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	3
/src/open62541/plugins/crypto/openssl/certificategroup.c	5
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	6
/src/open62541/src/server/../ua_securechannel.h	1
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_server_ws.c	7
/src/open62541/src/server/ua_server_binary_tcp_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_config_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3971	22.5%
gold	[1:9]	51	0.28%
yellow	[10:29]	9	0.05%
greenyellow	[30:49]	14	0.07%
lawngreen	50+	13581	77.0%
All colors	17626	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
868	16322	initPubSubNS0	call site: 16322	addDataSetReaderConfig
438	15472	UA_Session_detachFromSecureChannel	call site: 15472	processSecureChannelMessage
274	15912	UA_KeyValueMap_setScalar	call site: 15912	createServerConnection
148	1604	copyAttributeIntoNode	call site: 01604	UA_MonitoredItem_processSampledValue
113	1889	UA_KeyValueMap_clear	call site: 01889	recordModelChangeEvent
113	17236	initPubSubNS0	call site: 17236	UA_Server_addPublishedDataSet
86	1115	Variant_clear	call site: 01115	UA_DataType_toDescription
81	15260	UA_Session_detachSubscription	call site: 15260	UA_Subscription_delete
79	2005	endModelChange	call site: 02005	UA_ModelChangeAccumulator_finalize
62	1826	browseRecursive	call site: 01826	UA_Server_readBrowseName
52	2100	deleteNodeOperation_inner	call site: 02100	deleteNodeSet
52	15419	notifySubscription	call site: 15419	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2269

Functions that are reachable but not covered

782

Reachable functions

2905

Percentage of reachable functions covered

73.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_config_json.cc	1
/src/open62541/plugins/ua_config_json.c	32
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	123
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	14
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/deps/cj5.c	10
/src/open62541/deps/utf8.h	1
/src/open62541/src/ua_types_encoding_json.c	13
/src/open62541/plugins/crypto/openssl/securitypolicy_basic128rsa15.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256sha256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes128sha256rsaoaep.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes256sha256rsapss.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256.c	2
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	10
/src/open62541/plugins/crypto/openssl/certificategroup.c	7
/usr/include/openssl/x509.h	6
/src/open62541/plugins/crypto/ua_filestore_common.c	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	14
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	19
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	12
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	20
/src/open62541/src/server/ua_server_binary_tcp.c	5
/src/open62541/src/server/ua_server_binary.c	16
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	6
/src/open62541/src/server/../ua_securechannel.h	1
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_server_ws.c	7
/src/open62541/src/server/ua_server_binary_tcp_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_tcp_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3712	21.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.00%
greenyellow	[30:49]	2	0.01%
lawngreen	50+	13449	78.3%
All colors	17164	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
869	15738	initPubSubNS0	call site: 15738	addDataSetReaderConfig
351	14972	extractCompleteChunk	call site: 14972	processSecureChannelMessage
253	15325	UA_KeyValueMap_setScalar	call site: 15325	createSessionObject
127	1004	copyAttributeIntoNode	call site: 01004	UA_MonitoredItem_processSampledValue
113	1297	UA_KeyValueMap_clear	call site: 01297	recordModelChangeEvent
113	16653	initPubSubNS0	call site: 16653	UA_Server_addPublishedDataSet
79	1413	endModelChange	call site: 01413	UA_ModelChangeAccumulator_finalize
62	1234	browseRecursive	call site: 01234	UA_Server_readBrowseName
59	541	UA_findDataTypeWithCustom	call site: 00541	UA_DataType_toDescription
53	14698	UA_encodeBinaryInternal	call site: 14698	UA_Subscription_delete
52	1508	deleteNodeOperation_inner	call site: 01508	deleteNodeSet
52	14829	notifySubscription	call site: 14829	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2303

Functions that are reachable but not covered

722

Reachable functions

2834

Percentage of reachable functions covered

74.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	2
/src/open62541/tests/fuzz/custom_memory_manager.c	2
/src/open62541/plugins/include/open62541/server_config_default.h	1
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	120
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	23
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	19
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	12
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	21
/src/open62541/src/server/ua_server_binary_tcp.c	5
/src/open62541/src/server/ua_server_binary.c	16
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	3
/src/open62541/plugins/crypto/openssl/certificategroup.c	5
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	8
/src/open62541/src/server/../ua_securechannel.h	1
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_server_ws.c	7
/src/open62541/src/server/ua_server_binary_tcp_reverse.c	1
/src/open62541/src/server/ua_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/src/ua_types_encoding_json.c	11

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
MdnsdDriver_start	/src/open62541/drivers/discovery_mdns_mdnsd.c	1	['N/A']	13	0	468	65	24	244	0	1432	523
UDP_openConnection	/src/open62541/arch/posix/eventloop_posix_udp.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	13	0	155	17	7	113	0	618	182
lteOperator	/src/open62541/src/server/ua_subscription_event.c	2	['N/A', 'size_t']	33	0	18	3	2	261	0	1511	161

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3430 / 5521

Cyclomatic complexity statically reachable by fuzzers

14343 / 23987

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/open62541/tests/fuzz/fuzz_certificate_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_CertificateUtils_verifyApplicationUri', 'LLVMFuzzerTestOneInput', 'UA_CertificateUtils_getKeySize', 'UA_OpenSSL_LoadPemCertificate', 'UA_CertificateUtils_getExpirationDate', 'UA_STRING', 'UA_CertificateUtils_checkCA', 'UA_OpenSSL_LoadPemCrl', 'UA_OpenSSL_LoadCertificate', 'UA_OpenSSL_LoadCrl']

/src/open62541/tests/fuzz/fuzz_base64_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_src_ua_util.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_attributeoperand.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid_body', 'nodeId_printEscape', 'UA_AttributeOperand_print', 'parse_nodeid', 'printRelativePath']

/src/open62541/tests/fuzz/fuzz_json_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

/src/open62541/tests/fuzz/fuzz_parse_string.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid', 'nodeId_printEscape', 'printRelativePath', 'parse_qn']

/src/open62541/tests/fuzz/fuzz_client.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cleanupSession', 'UA_NamespaceMapping_delete', 'UA_Array_delete', 'notifyClientState', '__Client_Service', 'processServiceResponse', 'UA_UNLOCK', 'setLocalCertificate_none', 'UA_ClientConfig_clear', 'UA_SecureChannel_deleteBuffered']

/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_encodeXml', 'UA_decodeXml', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_process_request.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['findSingleChildNode', 'ctxClear', 'copyAttributeIntoNode', 'initPubSubNS0', 'getNodeContext', 'Variant_clear', 'UA_Session_detachSubscription', 'endModelChange', 'selectEndpointAndTokenPolicy', 'browseRecursive']

/src/open62541/tests/fuzz/fuzz_mdns_xht.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_PubSubConnectionConfig_copy', 'UA_PubSubConnectionConfig_clear', 'UA_Array_copy', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_binary_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'LLVMFuzzerTestOneInput', 'UA_encodeBinary', 'UA_ByteString_allocBuffer', 'copySubString', 'UA_Variant_copyRange', 'UA_DataValue_copyRange']

/src/open62541/tests/fuzz/fuzz_pubsub_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_DataSetMessage_clear', 'UA_NetworkMessage_decodeJson', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_ExtensionObject_setValue', 'stringOrder', 'lookupRefType', 'UA_QualifiedName_parseEx', 'UA_Array_copy', 'Variant_clear', 'UA_String_unescape', 'parse_nodeid', 'UA_Array_delete', 'UA_Array_append']

/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'UA_DataSetMessage_keyFrame_decodeBinary', 'UA_DataSetMessage_clear', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_mdns_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_a_match', '_r_next', 'mdnsd_in', '_cache', 'mdnsd_free', 'inet_anyaddr', '_q_next']

/src/open62541/tests/fuzz/fuzz_base64_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_datatype_description.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse_qn', 'fromDescription', 'reverse', 'UA_DataType_toStructureDescription', 'UA_DataType_toSimpleTypeDescription', 'UA_DataType_clear', 'UA_DataType_fromEnumDescription']

/src/open62541/tests/fuzz/fuzz_server_services.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'ctxClear', 'copyAttributeIntoNode', 'Service_ActivateSession_inner', 'UA_KeyValueMap_clear', 'getSessionByToken', 'Variant_clear', 'UA_Session_detachSubscription', 'endModelChange']

/src/open62541/tests/fuzz/fuzz_binary_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_KeyValueMap_getScalar', 'UA_KeyValueMap_setScalar', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'Variant_clear', 'UA_Session_detachSubscription', 'endModelChange', 'UA_Session_detachFromSecureChannel']

/src/open62541/tests/fuzz/fuzz_config_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_Session_detachFromSecureChannel', 'UA_KeyValueMap_setScalar', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'Variant_clear', 'UA_Session_detachSubscription', 'endModelChange', 'browseRecursive']

/src/open62541/tests/fuzz/fuzz_tcp_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'extractCompleteChunk', 'UA_KeyValueMap_setScalar', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'endModelChange', 'browseRecursive', 'UA_findDataTypeWithCustom', 'UA_encodeBinaryInternal']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
UA_CertificateUtils_verifyApplicationUri	36	6	16.66%	['fuzz_certificate_parse', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
UA_CertificateUtils_getSubjectName	31	12	38.70%	['fuzz_certificate_parse', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
UA_CertificateUtils_getThumbprint	33	3	9.090%	['fuzz_certificate_parse']
clearStructure	35	19	54.28%	['fuzz_eventfilter_parse', 'fuzz_pubsub_json', 'fuzz_parse_string', 'fuzz_client', 'fuzz_binary_decode', 'fuzz_pubsub_connection_config', 'fuzz_json_decode', 'fuzz_server_services', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_xml_decode_encode', 'fuzz_binary_message', 'fuzz_attributeoperand']
structureOrder	51	28	54.90%	['fuzz_xml_decode_encode', 'fuzz_binary_decode', 'fuzz_attributeoperand']
lookupRefType	38	12	31.57%	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_attributeoperand']
processServiceResponse	40	10	25.0%	['fuzz_client']
__Client_Service	69	8	11.59%	['fuzz_client']
decodeMatrixVariant	36	10	27.77%	['fuzz_xml_decode_encode']
UA_KeyValueRestriction_validate	35	15	42.85%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
UA_EventLoopPOSIX_start	77	38	49.35%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
openSignalPipe	33	17	51.51%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
format_string_loop	239	110	46.02%	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
print_integer_finalization	51	16	31.37%	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
activateSession_default	72	28	38.88%	['fuzz_process_request']
UA_Node_insertOrUpdateLocale	37	14	37.83%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
addDriver	32	12	37.5%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
Service_Read	46	18	39.13%	['fuzz_process_request']
auditEvent	87	4	4.597%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
compatibleValue	37	10	27.02%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
Operation_WriteWithNode	64	26	40.62%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
Service_HistoryUpdate	64	11	17.18%	['fuzz_process_request']
readValueAttributeComplete	33	18	54.54%	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_attributeoperand']
copyAttributeIntoNode	209	57	27.27%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
writeNodeValueAttribute	90	39	43.33%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
triggerImmediateDataChange	33	4	12.12%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
process_RegisterServer	104	5	4.807%	['fuzz_server_services', 'fuzz_process_request']
addNode_raw	73	35	47.94%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
useVariableTypeAttributes	51	20	39.21%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
typeCheckVariableNode	81	28	34.56%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
recursiveCallConstructors	91	41	45.05%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
UA_Server_addMethodNodeEx_finish	90	41	45.55%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
Service_Cancel	31	15	48.38%	['fuzz_server_services', 'fuzz_process_request']
Service_CreateSession_inner	157	74	47.13%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
signCreateSessionResponse	36	4	11.11%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
Service_ActivateSession_inner	206	90	43.68%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
selectTokenPolicy	68	27	39.70%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
Operation_TransferSubscription	117	10	8.547%	['fuzz_process_request']
browseResolvedNode	39	21	53.84%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
browseWithNode	65	27	41.53%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
walkBrowsePathElement	95	52	54.73%	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_attributeoperand']
UA_String_vformat	31	15	48.38%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
UA_encodeJson	35	18	51.42%	['fuzz_server_services', 'fuzz_binary_message', 'fuzz_tcp_message', 'fuzz_json_decode_encode', 'fuzz_process_request', 'fuzz_config_json']
ExtensionObject_encodeJson	37	4	10.81%	['fuzz_json_decode_encode']
DiagnosticInfo_encodeJson	33	12	36.36%	['fuzz_json_decode_encode']
mdnsd_in	96	38	39.58%	['fuzz_mdns_message']
createSubscriptionObject	56	18	32.14%	['fuzz_server_services']
process_FindServersOnNetwork	44	4	9.090%	['fuzz_server_services']
Service_CreateMonitoredItems	34	18	52.94%	['fuzz_server_services']
Service_ModifySubscription	44	12	27.27%	['fuzz_server_services']
reloadCertificates	64	18	28.12%	['fuzz_config_json']
readCertificates	49	23	46.93%	['fuzz_config_json']
ApplicationTypeField_parseJson	35	16	45.71%	['fuzz_config_json']
UA_TrustListDataType_add	73	32	43.83%	['fuzz_config_json']
TCP_registerListenSocket	167	72	43.11%	['fuzz_tcp_message']
TCP_connectionSocketCallback	64	28	43.75%	['fuzz_tcp_message']
TCP_sendWithConnection	42	23	54.76%	['fuzz_tcp_message']
UA_PubSubManager_setState	36	16	44.44%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
UA_Server_run_startup	163	67	41.10%	['fuzz_tcp_message']
deleteServerSecureChannel	43	21	48.83%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
startTcpTransport	62	33	53.22%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
startWebSocketTransport	51	7	13.72%	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']
UA_SecureChannel_getCompleteMessage	107	8	7.476%	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/open62541/src/pubsub/ua_pubsub_writer.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/server/ua_services_method.c	[]	[]
/src/open62541/deps/ziptree.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_client', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/work/open62541/src_generated/mdnsd/inet.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/server/ua_server_ns0.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/pubsub/ua_pubsub_reader.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/server/ua_server_binary_tcp_reverse.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_aes256sha256rsapss.c	['fuzz_config_json']	[]
/src/open62541/arch/posix/eventloop_posix.h	[]	[]
/src/open62541/tests/fuzz/fuzz_process_request.cc	['fuzz_process_request']	['fuzz_process_request']
/src/open62541/src/util/ua_types_lex.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256.c	['fuzz_config_json']	[]
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	['fuzz_certificate_parse', 'fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_process_request']
/src/open62541/arch/common/eventloop_common.c	[]	[]
/src/open62541/tests/fuzz/fuzz_config_json.cc	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/drivers/discovery_mdns_mdnsd.c	[]	[]
/src/open62541/src/server/ua_services_securechannel.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_tcp_message']
/work/open62541/src_generated/mdnsd/log.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/deps/cj5.c	['fuzz_json_decode', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_config_json']	['fuzz_json_decode', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	['fuzz_tcp_message']	['fuzz_tcp_message']
/src/open62541/src/server/ua_server_async.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_aes128sha256rsaoaep.c	['fuzz_config_json']	[]
/src/open62541/src/pubsub/ua_pubsub_ns0.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	['fuzz_pubsub_json']	['fuzz_pubsub_json']
/src/open62541/src/server/ua_nodes.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/deps/yxml.c	['fuzz_xml_decode_encode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_xml_decode_encode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/arch/posix/eventloop_posix.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	['fuzz_process_request', 'fuzz_pubsub_json', 'fuzz_pubsub_binary', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_pubsub_json', 'fuzz_pubsub_binary']
/src/open62541/src/server/ua_session.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/server/ua_services.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/deps/utf8.c	[]	[]
/src/open62541/deps/libc_time.c	['fuzz_certificate_parse', 'fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/tests/fuzz/fuzz_parse_string.cc	['fuzz_parse_string']	['fuzz_parse_string']
/usr/include/openssl/x509.h	['fuzz_config_json']	[]
/src/open62541/src/server/ua_server_binary_tcp.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_basic128rsa15.c	['fuzz_config_json']	[]
/src/open62541/plugins/crypto/ua_securitypolicy_filestore.c	[]	[]
/src/open62541/include/open62541/server.h	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_tcp_message']	[]
/src/open62541/src/pubsub/ua_pubsub_connection.c	['fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_pubsub_connection_config']
/work/open62541/src_generated/open62541/statuscodes.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/server/ua_server_ws.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/pubsub/ua_pubsub_manager.c	['fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/plugins/ua_log_stdout.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/arch/common/timer.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/ua_securechannel.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	['fuzz_src_ua_util']	['fuzz_src_ua_util']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp384.c	[]	[]
/src/open62541/plugins/crypto/openssl/certificategroup.c	['fuzz_certificate_parse', 'fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_config_json']
/src/open62541/src/server/ua_services_attribute.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/work/open62541/src_generated/mdnsd/1035.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/server/ua_services_nodemanagement.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/deps/base64.c	['fuzz_base64_encode', 'fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_client', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_base64_decode', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_base64_encode', 'fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_base64_decode', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/server/ua_server.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/arch/posix/eventloop_posix_tcp.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/util/ua_encryptedsecret.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/util/ua_util_internal.h	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_client', 'fuzz_process_request', 'fuzz_binary_decode', 'fuzz_eventfilter_parse', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_eventfilter_parse']
/src/open62541/plugins/ua_log_syslog.c	[]	[]
/src/open62541/plugins/ua_config_default.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/client/ua_client.c	['fuzz_client']	['fuzz_client']
/src/open62541/plugins/ua_config_json.c	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/plugins/crypto/ua_certificategroup_none.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/server/ua_server_auditing.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/deps/dtoa.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/client/ua_client_discovery.c	['fuzz_client']	[]
/work/open62541/src_generated/mdnsd/sdtxt.c	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/src/server/ua_server_modelchange.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	['fuzz_json_decode_encode']	['fuzz_json_decode_encode']
/src/open62541/plugins/ua_nodestore_ziptree.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/deps/pcg_basic.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/arch/posix/eventloop_posix_eth.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/server/ua_services_discovery.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/src/util/ua_util.c	['fuzz_src_ua_util', 'fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_client', 'fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_eventfilter_parse', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_src_ua_util', 'fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_client', 'fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_eventfilter_parse', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/usr/include/openssl/asn1.h	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/client/ua_client_highlevel.c	[]	[]
/src/open62541/plugins/crypto/ua_filestore_common.c	['fuzz_config_json']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_ecccurve25519.c	[]	[]
/src/open62541/src/server/ua_server_binary.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/server/ua_server_ns0_diagnostics.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/tests/fuzz/fuzz_binary_message.cc	['fuzz_binary_message']	['fuzz_binary_message']
/src/open62541/src/client/../ua_securechannel.h	['fuzz_client']	[]
/src/open62541/include/open62541/client_subscriptions.h	[]	[]
/src/open62541/src/server/ua_subscription.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/work/open62541/src_generated/open62541/transport_generated.h	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256.c	['fuzz_config_json']	[]
/src/open62541/src/pubsub/../server/ua_server_internal.h	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/server/ua_services_monitoreditem.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_server_services']
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	['fuzz_attributeoperand']	['fuzz_attributeoperand']
/src/open62541/tests/fuzz/fuzz_client.cc	['fuzz_client']	['fuzz_client']
/src/open62541/src/server/ua_server_utils.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	['fuzz_xml_decode_encode']	['fuzz_xml_decode_encode']
/src/open62541/deps/itoa.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_client', 'fuzz_process_request', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_datatype_description', 'fuzz_server_services']
/usr/include/openssl/x509v3.h	['fuzz_certificate_parse', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/work/open62541/src_generated/open62541/types_generated.h	['fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_json_decode', 'fuzz_parse_string', 'fuzz_client', 'fuzz_xml_decode_encode', 'fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_binary_decode', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_json_decode', 'fuzz_parse_string', 'fuzz_client', 'fuzz_xml_decode_encode', 'fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_binary_decode', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/plugins/include/open62541/server_config_default.h	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/ua_securechannel.h	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/tests/fuzz/custom_memory_manager.c	['fuzz_certificate_parse', 'fuzz_src_ua_util', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_pubsub_json', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_src_ua_util', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_pubsub_json', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_tcp_message']
/src/open62541/src/pubsub/ua_pubsub_internal.h	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/include/open62541/plugin/log.h	['fuzz_client', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/ua_types_encoding_binary.c	['fuzz_client', 'fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_binary_decode', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_binary_decode', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	['fuzz_pubsub_connection_config']	['fuzz_pubsub_connection_config']
/src/open62541/src/ua_types_encoding_json.c	['fuzz_json_decode', 'fuzz_process_request', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_json_decode', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_config_json']
/work/open62541/src_generated/mdnsd/xht.c	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/plugins/historydata/ua_history_database_default.c	[]	[]
/src/open62541/src/util/ua_eventfilter_lex.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/tests/testing-plugins/testing_clock.c	[]	[]
/src/open62541/deps/parse_num.c	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256sha256.c	['fuzz_config_json']	[]
/src/open62541/tests/fuzz/fuzz_datatype_description.cc	['fuzz_datatype_description']	['fuzz_datatype_description']
/src/open62541/tests/testing-plugins/testing_networklayers.c	['fuzz_process_request', 'fuzz_binary_message']	['fuzz_process_request', 'fuzz_binary_message']
/src/open62541/src/server/ua_services_view.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/include/open62541/plugin/nodestore.h	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/client/ua_client_connect.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/server/ua_services_subscription.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	['fuzz_certificate_parse']	['fuzz_certificate_parse']
/work/open62541/src_generated/mdnsd/mdnsd.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/plugins/ua_accesscontrol_default.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/util/ua_eventfilter_grammar.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/deps/utf8.h	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/src/server/ua_server_config.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	['fuzz_base64_encode']	['fuzz_base64_encode']
/src/open62541/src/server/ua_subscription_event.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	['fuzz_process_request', 'fuzz_pubsub_json', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_pubsub_json']
/src/open62541/src/ua_securechannel_crypto.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/pubsub/../ua_types_encoding_json.h	['fuzz_pubsub_json']	[]
/src/open62541/arch/posix/eventloop_posix_interrupt.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/arch/posix/eventloop_posix_udp.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/work/open62541/src_generated/open62541/config.h	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_client', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_json_decode.cc	['fuzz_json_decode']	['fuzz_json_decode']
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	['fuzz_binary_decode']	['fuzz_binary_decode']
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/server/ua_subscription_datachange.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/server/ua_services_session.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	['fuzz_base64_decode']	['fuzz_base64_decode']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccbrainpoolp256r1.c	[]	[]
/src/open62541/tests/testing-plugins/test_helpers.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/client/ua_client_subscriptions.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/pubsub/ua_pubsub_dataset.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	[]
/src/open62541/src/ua_types_definition.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_datatype_description']
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	['fuzz_pubsub_binary']	['fuzz_pubsub_binary']
/src/open62541/src/util/ua_eventfilter_parser.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/server/ua_discovery.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_server_services.cc	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/deps/musl_inet_pton.c	[]	[]
/src/open62541/arch/posix/clock_posix.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccbrainpoolp384r1.c	[]	[]
/src/open62541/plugins/historydata/ua_history_data_backend_memory.c	[]	[]
/src/open62541/plugins/historydata/ua_history_data_gathering_default.c	[]	[]
/src/open62541/src/server/ua_server_internal.h	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/deps/mp_printf.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256_chachapoly.c	[]	[]
/src/open62541/src/ua_types.c	['fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_json_decode', 'fuzz_parse_string', 'fuzz_client', 'fuzz_xml_decode_encode', 'fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_binary_decode', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_attributeoperand', 'fuzz_json_decode', 'fuzz_parse_string', 'fuzz_client', 'fuzz_xml_decode_encode', 'fuzz_process_request', 'fuzz_pubsub_connection_config', 'fuzz_binary_decode', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/work/open62541/src_generated/open62541/namespace0_generated.c	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/pubsub/../util/ua_util_internal.h	['fuzz_process_request', 'fuzz_pubsub_binary', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_eventfilter_parse']
/src/open62541/plugins/crypto/openssl/create_certificate.c	[]	[]
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_client', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/client/../util/ua_util_internal.h	['fuzz_client']	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_eventfilter_parse']
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256_aesgcm.c	[]	[]
/src/open62541/src/ua_types_encoding_xml.c	['fuzz_xml_decode_encode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']	['fuzz_xml_decode_encode', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_tcp_message']
/src/open62541/src/client/ua_client_util.c	[]	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_ecccurve448.c	[]	[]

Directories in report

Directory
/src/open62541/src/util/
/work/open62541/src_generated/mdnsd/
/src/open62541/plugins/crypto/
/usr/include/openssl/
/src/open62541/plugins/include/open62541/
/src/open62541/src/pubsub/
/src/open62541/arch/posix/
/src/open62541/src/pubsub/../
/src/open62541/deps/
/src/open62541/include/open62541/plugin/
/src/open62541/src/pubsub/../server/
/src/open62541/plugins/
/src/open62541/drivers/
/src/open62541/src/server/
/work/open62541/src_generated/open62541/
/src/open62541/include/open62541/
/src/open62541/tests/testing-plugins/
/src/open62541/plugins/crypto/openssl/
/src/open62541/src/client/
/src/open62541/src/
/src/open62541/tests/fuzz/
/src/open62541/plugins/historydata/
/src/open62541/arch/common/
/src/open62541/src/client/../util/
/src/open62541/src/pubsub/../util/
/src/open62541/src/client/../