High level conclusions

Fuzzers reach 55.09% code coverage.

Fuzzers reach 55.93% of cyclomatic complexity.

Fuzzers reach 59.72% of all functions.

Fuzzer fuzz_client is blocked:

The runtime code coverage of fuzz_client covers 15.43% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3361 / 5627

Cyclomatic complexity statically reachable by fuzzers

13939 / 24918

Runtime code coverage of functions

3100 / 5627

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_mdns_xht

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	3.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	96.4%
All colors	28	100

Runtime coverage analysis

Covered functions

13

Functions that are reachable but not covered

6

Reachable functions

19

Percentage of reachable functions covered

68.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	1
/work/open62541/src_generated/mdnsd/sdtxt.c	5
/work/open62541/src_generated/mdnsd/xht.c	7

Fuzzer: fuzz_attributeoperand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	382	75.6%
gold	[1:9]	2	0.39%
yellow	[10:29]	7	1.38%
greenyellow	[30:49]	9	1.78%
lawngreen	50+	105	20.7%
All colors	505	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
151	245	UA_STRING	call site: 00245	buildEnumDefinitionFromProperties
104	96	stringOrder	call site: 00096	UA_Server_readBrowseName
40	204	UA_Array_delete	call site: 00204	UA_DataType_toDescription
39	56	lookupRefType	call site: 00056	UA_Server_browseRecursive
7	15	UA_String_unescape	call site: 00015	UA_NamespaceMapping_uri2Index
6	33	parse_nodeid_body	call site: 00033	UA_readNumberWithBase
5	414	nodeId_printEscape	call site: 00414	UA_String_escapedSize
5	478	UA_AttributeOperand_print	call site: 00478	UA_STRING
3	10	parse_nodeid	call site: 00010	UA_String_unescape
3	443	printRelativePath	call site: 00443	UA_STRING
2	201	UA_ByteString_allocBuffer	call site: 00201	UA_Variant_copyRange
2	400	parse_relativepathElement	call site: 00400	UA_RelativePathElement_clear

Runtime coverage analysis

Covered functions

83

Functions that are reachable but not covered

159

Reachable functions

229

Percentage of reachable functions covered

30.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/work/open62541/src_generated/open62541/types_generated.h	49
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/ua_types.c	58
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/src/util/ua_util.c	14
/src/open62541/deps/base64.c	2
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_json_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	4.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	96.0%
All colors	25	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear

Runtime coverage analysis

Covered functions

114

Functions that are reachable but not covered

0

Reachable functions

15

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	2
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	1

Fuzzer: fuzz_json_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	21.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	78.1%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	29	LLVMFuzzerTestOneInput	call site: 00029	UA_calcSizeJson
3	42	LLVMFuzzerTestOneInput	call site: 00042
2	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear
2	36	LLVMFuzzerTestOneInput	call site: 00036
1	27	UA_ByteString_allocBuffer	call site: 00027

Runtime coverage analysis

Covered functions

195

Functions that are reachable but not covered

3

Reachable functions

25

Percentage of reachable functions covered

88.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	3

Fuzzer: fuzz_pubsub_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	16.2%
gold	[1:9]	5	3.37%
yellow	[10:29]	5	3.37%
greenyellow	[30:49]	9	6.08%
lawngreen	50+	105	70.9%
All colors	148	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	102	stringOrder	call site: 00102	nodeIdOrder
7	94	UA_DataSetMessage_keyFrame_decodeBinary	call site: 00094	decodeRawField
1	140	UA_DataSetMessage_clear	call site: 00140	UA_clear
1	142	UA_NetworkMessage_clear	call site: 00142	UA_clear
1	144	UA_NetworkMessage_clear	call site: 00144	UA_clear

Runtime coverage analysis

Covered functions

80

Functions that are reachable but not covered

8

Reachable functions

40

Percentage of reachable functions covered

80.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	20
/src/open62541/src/pubsub/../util/ua_util_internal.h	3
/src/open62541/src/ua_types_encoding_binary.c	2
/src/open62541/src/ua_types.c	7
/work/open62541/src_generated/open62541/types_generated.h	4

Fuzzer: fuzz_xml_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	8.82%
gold	[1:9]	1	0.73%
yellow	[10:29]	3	2.20%
greenyellow	[30:49]	1	0.73%
lawngreen	50+	119	87.5%
All colors	136	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	123	LLVMFuzzerTestOneInput	call site: 00123
2	109	LLVMFuzzerTestOneInput	call site: 00109	UA_calcSizeXml
2	112	UA_encodeXml	call site: 00112	UA_ByteString_clear
2	117	LLVMFuzzerTestOneInput	call site: 00117
1	88	UA_decodeXml	call site: 00088	UA_STRING
1	104	LLVMFuzzerTestOneInput	call site: 00104	UA_clear
1	107	UA_ByteString_allocBuffer	call site: 00107

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

4

Reachable functions

59

Percentage of reachable functions covered

93.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_xml.c	9
/src/open62541/deps/yxml.c	34
/src/open62541/src/ua_types.c	4

Fuzzer: fuzz_eventfilter_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	363	64.3%
gold	[1:9]	2	0.35%
yellow	[10:29]	1	0.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	198	35.1%
All colors	564	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
107	344	UA_ExtensionObject_setValue	call site: 00344	buildEnumDefinitionFromProperties
105	154	stringOrder	call site: 00154	UA_Server_readBrowseName
39	114	lookupRefType	call site: 00114	UA_Server_browseRecursive
39	304	UA_QualifiedName_parseEx	call site: 00304	UA_DataType_toStructureDescription
25	278	UA_Array_copy	call site: 00278	UA_DataType_toDescription
14	263	Variant_clear	call site: 00263	readExternalValueAttribute
7	45	UA_String_unescape	call site: 00045	UA_NamespaceMapping_uri2Index
4	40	parse_nodeid	call site: 00040	UA_String_unescape
2	260	UA_Array_delete	call site: 00260	Variant_clear
2	524	UA_Array_append	call site: 00524	UA_Array_delete
1	37	UA_EventFilter_lex	call site: 00037	UA_NodeId_parseEx
1	57	UA_readNumberWithBase	call site: 00057	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

187

Functions that are reachable but not covered

143

Reachable functions

265

Percentage of reachable functions covered

46.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	1
/src/open62541/src/ua_types.c	52
/work/open62541/src_generated/open62541/types_generated.h	58
/src/open62541/src/util/ua_eventfilter_grammar.c	14
/src/open62541/src/util/ua_eventfilter_lex.c	2
/src/open62541/src/util/ua_eventfilter_parser.c	14
/src/open62541/include/open62541/plugin/log.h	1
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/util/ua_types_lex.c	19
/src/open62541/src/util/ua_util.c	6
/src/open62541/deps/base64.c	1
/src/open62541/src/util/ua_util_internal.h	5
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5

Fuzzer: fuzz_parse_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	369	66.1%
gold	[1:9]	3	0.53%
yellow	[10:29]	3	0.53%
greenyellow	[30:49]	2	0.35%
lawngreen	50+	181	32.4%
All colors	558	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
146	303	UA_STRING	call site: 00303	buildEnumDefinitionFromProperties
105	156	stringOrder	call site: 00156	UA_Server_readBrowseName
40	262	UA_Array_delete	call site: 00262	UA_DataType_toDescription
39	116	lookupRefType	call site: 00116	UA_Server_browseRecursive
7	12	UA_String_unescape	call site: 00012	UA_NamespaceMapping_uri2Index
4	7	parse_nodeid	call site: 00007	UA_String_unescape
3	480	nodeId_printEscape	call site: 00480	UA_String_escapedSize
3	493	nodeId_printEscape	call site: 00493	UA_String_escapeInsert
3	520	printRelativePath	call site: 00520	UA_String_clear
2	100	parse_qn	call site: 00100	UA_QualifiedName_clear
1	4	LLVMFuzzerTestOneInput	call site: 00004	UA_NodeId_parseEx
1	24	UA_readNumberWithBase	call site: 00024	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

150

Reachable functions

265

Percentage of reachable functions covered

43.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_parse_string.cc	1
/src/open62541/src/ua_types.c	58
/work/open62541/src_generated/open62541/types_generated.h	63
/src/open62541/src/util/ua_types_lex.c	21
/src/open62541/src/util/ua_util.c	13
/src/open62541/deps/base64.c	2
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/deps/parse_num.c	2
/src/open62541/deps/libc_time.c	3
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1419	92.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	92	5.98%
greenyellow	[30:49]	19	1.23%
lawngreen	50+	6	0.39%
All colors	1536	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
557	541	UA_NamespaceMapping_delete	call site: 00541	__Client_networkCallback
306	1104	cleanupSession	call site: 01104	__Client_Subscriptions_backgroundPublish
162	360	UA_Array_delete	call site: 00360	__Client_Subscriptions_backgroundPublish
135	172	notifyClientState	call site: 00172	__UA_Client_startup
95	76	__Client_Service	call site: 00076	connectSync
68	1411	processServiceResponse	call site: 01411	connectActivity
50	309	UA_UNLOCK	call site: 00309	__Client_Subscriptions_backgroundPublish
23	38	setLocalCertificate_none	call site: 00038	UA_OpenSSL_LoadLocalCertificate
4	1526	UA_ClientConfig_clear	call site: 01526	UA_DataType_clear
3	536	UA_SecureChannel_deleteBuffered	call site: 00536	UA_Chunk_delete
2	17	UA_ConnectionManager_new_POSIX_TCP	call site: 00017	UA_copy
2	66	UA_Client_newWithConfig	call site: 00066	UA_Client_delete

Runtime coverage analysis

Covered functions

97

Functions that are reachable but not covered

378

Reachable functions

447

Percentage of reachable functions covered

15.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_client.cc	1
/src/open62541/tests/testing-plugins/test_helpers.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/plugins/ua_config_default.c	1
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	49
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	50
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	8
/src/open62541/src/client/ua_client.c	33
/src/open62541/src/ua_securechannel.c	31
/src/open62541/src/client/ua_client_connect.c	52
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/client/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/work/open62541/src_generated/open62541/transport_generated.h	4
/src/open62541/src/ua_securechannel_http.c	7
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/src/client/ua_client_subscriptions.c	29
/src/open62541/deps/ziptree.c	8
/src/open62541/src/util/ua_util.c	15
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	1
/src/open62541/src/client/ua_client_connect_http.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	1
/usr/include/openssl/asn1.h	1
/src/open62541/src/client/../ua_securechannel.h	3
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/client/ua_client_discovery.c	1
/src/open62541/src/util/ua_encryptedsecret.c	8
/src/open62541/src/util/../ua_securechannel.h	1
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/cj5.c	7

Fuzzer: fuzz_certificate_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	38	40.4%
gold	[1:9]	16	17.0%
yellow	[10:29]	1	1.06%
greenyellow	[30:49]	5	5.31%
lawngreen	50+	34	36.1%
All colors	94	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	77	UA_CertificateUtils_verifyApplicationUri	call site: 00077	UA_String_clear
11	42	LLVMFuzzerTestOneInput	call site: 00042	UA_OpenSSL_LoadCertificate
5	9	UA_OpenSSL_LoadPemCertificate	call site: 00009	X509_get_pubkey
2	62	UA_CertificateUtils_getKeySize	call site: 00062	EVP_PKEY_free
1	4	UA_OpenSSL_LoadCertificate	call site: 00004	d2i_X509
1	17	UA_OpenSSL_LoadCrl	call site: 00017	d2i_X509_CRL
1	27	UA_CertificateUtils_getSubjectName	call site: 00027	UA_copy
1	32	LLVMFuzzerTestOneInput	call site: 00032	UA_clear

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

34

Reachable functions

58

Percentage of reachable functions covered

41.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/crypto/openssl/certificategroup.c	7
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	6
/src/open62541/src/ua_types.c	3
/work/open62541/src_generated/open62541/types_generated.h	3
/src/open62541/deps/libc_time.c	3
/usr/include/openssl/x509v3.h	3

Fuzzer: fuzz_pubsub_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	7.81%
gold	[1:9]	2	3.12%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	57	89.0%
All colors	64	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	55	UA_DataSetMessage_clear	call site: 00055	UA_DataValue_clear
1	51	UA_NetworkMessage_decodeJson	call site: 00051	UA_Array_delete
1	58	UA_NetworkMessage_clear	call site: 00058	UA_clear
1	60	UA_NetworkMessage_clear	call site: 00060	UA_clear

Runtime coverage analysis

Covered functions

134

Functions that are reachable but not covered

3

Reachable functions

29

Percentage of reachable functions covered

89.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	2
/src/open62541/src/ua_types_encoding_json.c	6
/src/open62541/deps/cj5.c	7
/src/open62541/src/pubsub/../ua_types_encoding_json.h	2
/src/open62541/src/ua_types_encoding_json.h	2
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	2
/src/open62541/src/ua_types.c	2
/work/open62541/src_generated/open62541/types_generated.h	3

Fuzzer: fuzz_server_services

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3927	22.3%
gold	[1:9]	93	0.52%
yellow	[10:29]	58	0.33%
greenyellow	[30:49]	24	0.13%
lawngreen	50+	13455	76.6%
All colors	17557	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
865	15840	initPubSubNS0	call site: 15840	addDataSetReaderConfig
253	15046	ctxClear	call site: 15046	processSecureChannelMessage
130	1006	copyAttributeIntoNode	call site: 01006	UA_MonitoredItem_processSampledValue
116	1302	UA_KeyValueMap_clear	call site: 01302	recordModelChangeEvent
114	16750	initPubSubNS0	call site: 16750	UA_Server_addPublishedDataSet
110	15535	Service_ActivateSession_inner	call site: 15535	UA_Session_attachToSecureChannel
107	15304	findSessionByToken	call site: 15304	processServiceInternal
85	517	Variant_clear	call site: 00517	UA_DataType_toDescription
85	14746	UA_NamespaceMapping_delete	call site: 14746	UA_Subscription_delete
79	1421	endModelChange	call site: 01421	UA_ModelChangeAccumulator_finalize
75	17410	Service_CreateMonitoredItems	call site: 17410	Operation_CreateMonitoredItem
62	1239	browseRecursive	call site: 01239	UA_Server_readBrowseName

Runtime coverage analysis

Covered functions

2370

Functions that are reachable but not covered

747

Reachable functions

3004

Percentage of reachable functions covered

75.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_server_services.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	86
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	181
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	16
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	12
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	15
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_server_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	1
/src/open62541/src/server/ua_subscription_event.c	14
/src/open62541/src/server/ua_server_auditing.c	15
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	23
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	13
/src/open62541/src/server/ua_services_subscription.c	8
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	7
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	21
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	2
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_base64_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	1
/src/open62541/deps/base64.c	2

Fuzzer: fuzz_mdns_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	53	41.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.77%
greenyellow	[30:49]	1	0.77%
lawngreen	50+	74	57.3%
All colors	129	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	73	_a_match	call site: 00073	_conflict
17	50	_r_next	call site: 00050	_r_send
6	37	mdnsd_in	call site: 00037	_is_local_ipv4
4	104	_cache	call site: 00104	_q_answer
3	95	mdnsd_in	call site: 00095	_conflict
2	126	mdnsd_free	call site: 00126	_free_record
1	33	inet_anyaddr	call site: 00033	htons
1	44	mdnsd_in	call site: 00044	vsyslog
1	122	_q_next	call site: 00122	_q_answer

Runtime coverage analysis

Covered functions

20

Functions that are reachable but not covered

33

Reachable functions

53

Percentage of reachable functions covered

37.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	1
/work/open62541/src_generated/mdnsd/1035.c	6
/work/open62541/src_generated/mdnsd/mdnsd.c	26
/work/open62541/src_generated/mdnsd/inet.c	3
/work/open62541/src_generated/mdnsd/log.c	1

Fuzzer: fuzz_base64_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	1
/src/open62541/deps/base64.c	1

Fuzzer: fuzz_pubsub_connection_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	29.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	70.5%
All colors	34	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	7	UA_PubSubConnectionConfig_copy	call site: 00007	UA_String_copy
2	22	UA_PubSubConnectionConfig_clear	call site: 00022	UA_String_clear
1	12	UA_PubSubConnectionConfig_copy	call site: 00012	UA_copy
1	18	UA_Array_copy	call site: 00018	UA_Array_delete
1	20	UA_Array_delete	call site: 00020	UA_PubSubConnectionConfig_clear
1	27	UA_PubSubConnectionConfig_clear	call site: 00027	UA_clear
1	30	UA_PubSubConnectionConfig_clear	call site: 00030	UA_Array_delete

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

0

Reachable functions

18

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	1
/src/open62541/src/ua_types_encoding_binary.c	3
/src/open62541/src/ua_types.c	4
/src/open62541/src/pubsub/ua_pubsub_connection.c	2
/src/open62541/src/pubsub/ua_pubsub_manager.c	2
/work/open62541/src_generated/open62541/types_generated.h	4
/src/open62541/src/util/ua_util.c	2

Fuzzer: fuzz_tcp_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3806	22.0%
gold	[1:9]	12	0.06%
yellow	[10:29]	1	0.00%
greenyellow	[30:49]	2	0.01%
lawngreen	50+	13467	77.8%
All colors	17288	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
865	15841	initPubSubNS0	call site: 15841	addDataSetReaderConfig
269	15414	UA_KeyValueMap_setScalar	call site: 15414	Service_ActivateSession
236	15176	processHEL	call site: 15176	processMSG
130	1007	copyAttributeIntoNode	call site: 01007	UA_MonitoredItem_processSampledValue
116	1303	UA_KeyValueMap_clear	call site: 01303	recordModelChangeEvent
114	16751	initPubSubNS0	call site: 16751	UA_Server_addPublishedDataSet
109	15048	extractCompleteChunk	call site: 15048	unpackPayloadMSG
85	14747	UA_NamespaceMapping_delete	call site: 14747	UA_Subscription_delete
79	1422	endModelChange	call site: 01422	UA_ModelChangeAccumulator_finalize
62	1240	browseRecursive	call site: 01240	UA_Server_readBrowseName
58	545	UA_findDataTypeWithCustom	call site: 00545	UA_DataType_toDescription
52	1518	deleteNodeOperation_inner	call site: 01518	deleteNodeSet

Runtime coverage analysis

Covered functions

2324

Functions that are reachable but not covered

745

Reachable functions

2866

Percentage of reachable functions covered

74.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	2
/src/open62541/tests/fuzz/custom_memory_manager.c	2
/src/open62541/plugins/include/open62541/server_config_default.h	1
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	120
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	23
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_server_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	19
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	1
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	23
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	9
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	11
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_config_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4060	22.8%
gold	[1:9]	62	0.34%
yellow	[10:29]	8	0.04%
greenyellow	[30:49]	17	0.09%
lawngreen	50+	13611	76.6%
All colors	17758	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
865	16449	initPubSubNS0	call site: 16449	addDataSetReaderConfig
444	15578	UA_Session_detachFromSecureChannel	call site: 15578	processSecureChannelMessage
294	16024	UA_KeyValueMap_setScalar	call site: 16024	createServerConnection
153	15292	UA_Session_detachSubscription	call site: 15292	UA_Subscription_delete
151	1630	copyAttributeIntoNode	call site: 01630	UA_MonitoredItem_processSampledValue
116	1918	UA_KeyValueMap_clear	call site: 01918	recordModelChangeEvent
114	17359	initPubSubNS0	call site: 17359	UA_Server_addPublishedDataSet
83	1144	Variant_clear	call site: 01144	UA_DataType_toDescription
79	2037	endModelChange	call site: 02037	UA_ModelChangeAccumulator_finalize
62	1855	browseRecursive	call site: 01855	UA_Server_readBrowseName
52	2133	deleteNodeOperation_inner	call site: 02133	deleteNodeSet
52	15525	notifySubscription	call site: 15525	UA_Session_detachFromSecureChannel

Runtime coverage analysis

Covered functions

2275

Functions that are reachable but not covered

809

Reachable functions

2935

Percentage of reachable functions covered

72.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_config_json.cc	1
/src/open62541/plugins/ua_config_json.c	33
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	123
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	14
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/deps/cj5.c	10
/src/open62541/deps/utf8.h	1
/src/open62541/src/ua_types_encoding_json.c	13
/src/open62541/plugins/crypto/openssl/securitypolicy_basic128rsa15.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256sha256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes128sha256rsaoaep.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes256sha256rsapss.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256.c	2
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	10
/src/open62541/plugins/crypto/openssl/certificategroup.c	5
/usr/include/openssl/x509.h	6
/src/open62541/plugins/crypto/ua_filestore_common.c	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	14
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_server_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	1
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	22
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_binary_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3857	22.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13306	77.5%
All colors	17163	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
865	15841	initPubSubNS0	call site: 15841	addDataSetReaderConfig
385	15027	UA_KeyValueMap_getScalar	call site: 15027	processSecureChannelMessage
284	15414	UA_KeyValueMap_setScalar	call site: 15414	Service_ActivateSession
153	14679	UA_Session_detachSubscription	call site: 14679	UA_Subscription_delete
130	1007	copyAttributeIntoNode	call site: 01007	UA_MonitoredItem_processSampledValue
116	1303	UA_KeyValueMap_clear	call site: 01303	recordModelChangeEvent
114	16751	initPubSubNS0	call site: 16751	UA_Server_addPublishedDataSet
85	518	Variant_clear	call site: 00518	UA_DataType_toDescription
79	1422	endModelChange	call site: 01422	UA_ModelChangeAccumulator_finalize
62	1240	browseRecursive	call site: 01240	UA_Server_readBrowseName
60	14965	UA_Session_detachFromSecureChannel	call site: 14965	shutdownSecureChannel
52	1518	deleteNodeOperation_inner	call site: 01518	deleteNodeSet

Runtime coverage analysis

Covered functions

2198

Functions that are reachable but not covered

774

Reachable functions

2841

Percentage of reachable functions covered

72.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_message.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	122
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	14
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_server_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	1
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	22
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	29
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_src_ua_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	100.%
All colors	17	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

3

Reachable functions

13

Percentage of reachable functions covered

76.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	3
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_datatype_description

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	37	25.3%
gold	[1:9]	10	6.84%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	99	67.8%
All colors	146	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	91	parse_qn	call site: 00091	UA_String_unescape
2	18	fromDescription	call site: 00018	UA_QualifiedName_printEx
2	23	reverse	call site: 00023	UA_ByteString_allocBuffer
2	122	UA_DataType_toStructureDescription	call site: 00122	UA_StructureDescription_clear
2	131	UA_DataType_toStructureDescription	call site: 00131	UA_StructureDescription_clear
1	15	fromDescription	call site: 00015	UA_copy
1	30	UA_DataType_clear	call site: 00030	UA_clear
1	39	UA_DataType_fromEnumDescription	call site: 00039	UA_DataType_clear
1	50	UA_DataType_fromStructureDescription	call site: 00050	UA_DataType_clear
1	52	UA_DataType_fromStructureDescription	call site: 00052	UA_order
1	58	guidOrder	call site: 00058	stringOrder
1	60	stringOrder	call site: 00060	nodeIdOrder

Runtime coverage analysis

Covered functions

93

Functions that are reachable but not covered

10

Reachable functions

74

Percentage of reachable functions covered

86.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_datatype_description.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	21
/src/open62541/src/ua_types_encoding_binary.c	3
/work/open62541/src_generated/open62541/types_generated.h	19
/src/open62541/src/ua_types_definition.c	11
/src/open62541/deps/itoa.c	3
/src/open62541/src/util/ua_util_internal.h	2
/src/open62541/src/util/ua_types_lex.c	4
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_process_request

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3533	20.5%
gold	[1:9]	5	0.02%
yellow	[10:29]	7	0.04%
greenyellow	[30:49]	11	0.06%
lawngreen	50+	13634	79.3%
All colors	17190	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
810	15895	findSingleChildNode	call site: 15895	addDataSetReaderConfig
244	15046	ctxClear	call site: 15046	processSecureChannelMessage
130	1006	copyAttributeIntoNode	call site: 01006	UA_MonitoredItem_processSampledValue
114	16750	initPubSubNS0	call site: 16750	UA_Server_addPublishedDataSet
102	1316	getNodeContext	call site: 01316	recordModelChangeEvent
85	517	Variant_clear	call site: 00517	UA_DataType_toDescription
85	14746	UA_NamespaceMapping_delete	call site: 14746	UA_Subscription_delete
79	1421	endModelChange	call site: 01421	UA_ModelChangeAccumulator_finalize
64	15546	selectEndpointAndTokenPolicy	call site: 15546	UA_Session_attachToSecureChannel
62	1239	browseRecursive	call site: 01239	UA_Server_readBrowseName
49	14678	UA_Session_detachSubscription	call site: 14678	sendResponse
49	14911	notifySubscription	call site: 14911	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2393

Functions that are reachable but not covered

664

Reachable functions

2848

Percentage of reachable functions covered

76.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_process_request.cc	2
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	82
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	122
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	29
/src/open62541/src/server/ua_server_async.c	14
/src/open62541/src/server/ua_server_ns0.c	13
/src/open62541/src/server/ua_services_nodemanagement.c	71
/src/open62541/src/server/ua_server_nodes.c	36
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	1
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	22
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	31
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	4
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	24
/src/open62541/src/pubsub/ua_pubsub_ns0.c	36
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	10
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	21
/src/open62541/src/pubsub/ua_pubsub_writer.c	12
/src/open62541/src/pubsub/ua_pubsub_dataset.c	16
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	25
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_binary_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	21.3%
gold	[1:9]	2	3.27%
yellow	[10:29]	1	1.63%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	45	73.7%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	19	UA_encodeBinaryInternal	call site: 00019	exchangeBuffer
2	28	LLVMFuzzerTestOneInput	call site: 00028	UA_calcSizeBinary
2	31	UA_encodeBinary	call site: 00031	UA_ByteString_clear
1	26	UA_ByteString_allocBuffer	call site: 00026	UA_delete
1	49	copySubString	call site: 00049	UA_Variant_copyRange
1	53	UA_Variant_copyRange	call site: 00053	Variant_clear
1	56	UA_DataValue_copyRange	call site: 00056	Variant_clear
1	58	LLVMFuzzerTestOneInput	call site: 00058	UA_clear

Runtime coverage analysis

Covered functions

141

Functions that are reachable but not covered

3

Reachable functions

39

Percentage of reachable functions covered

92.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	17
/src/open62541/src/ua_types_encoding_binary.c	8
/src/open62541/src/util/ua_util_internal.h	2
/work/open62541/src_generated/open62541/types_generated.h	6

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
MdnsdDriver_start	/src/open62541/drivers/discovery_mdns_mdnsd.c	1	['N/A']	13	0	472	65	24	245	0	1435	526
startHttp	/src/open62541/src/server/ua_transport_http.c	1	['N/A']	66	0	141	18	8	792	0	4740	229
DataValue_decodeJson	/src/open62541/src/ua_types_encoding_json.c	3	['N/A', 'N/A', 'N/A']	11	0	271	14	5	67	0	451	195

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3495 / 5627

Cyclomatic complexity statically reachable by fuzzers

14877 / 24918

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/open62541/tests/fuzz/fuzz_mdns_xht.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_attributeoperand.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid_body', 'nodeId_printEscape', 'UA_AttributeOperand_print', 'parse_nodeid', 'printRelativePath']

/src/open62541/tests/fuzz/fuzz_json_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'UA_DataSetMessage_keyFrame_decodeBinary', 'UA_DataSetMessage_clear', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_encodeXml', 'UA_decodeXml', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_ExtensionObject_setValue', 'stringOrder', 'lookupRefType', 'UA_QualifiedName_parseEx', 'UA_Array_copy', 'Variant_clear', 'UA_String_unescape', 'parse_nodeid', 'UA_Array_delete', 'UA_Array_append']

/src/open62541/tests/fuzz/fuzz_parse_string.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid', 'nodeId_printEscape', 'printRelativePath', 'parse_qn']

/src/open62541/tests/fuzz/fuzz_client.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_NamespaceMapping_delete', 'cleanupSession', 'UA_Array_delete', 'notifyClientState', '__Client_Service', 'processServiceResponse', 'UA_UNLOCK', 'setLocalCertificate_none', 'UA_ClientConfig_clear', 'UA_SecureChannel_deleteBuffered']

/src/open62541/tests/fuzz/fuzz_certificate_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_CertificateUtils_verifyApplicationUri', 'LLVMFuzzerTestOneInput', 'UA_OpenSSL_LoadPemCertificate', 'UA_CertificateUtils_getKeySize', 'UA_OpenSSL_LoadCertificate', 'UA_OpenSSL_LoadCrl', 'UA_CertificateUtils_getSubjectName']

/src/open62541/tests/fuzz/fuzz_pubsub_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_DataSetMessage_clear', 'UA_NetworkMessage_decodeJson', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_server_services.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'ctxClear', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'Service_ActivateSession_inner', 'findSessionByToken', 'Variant_clear', 'UA_NamespaceMapping_delete', 'endModelChange']

/src/open62541/tests/fuzz/fuzz_base64_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_mdns_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_a_match', '_r_next', 'mdnsd_in', '_cache', 'mdnsd_free', 'inet_anyaddr', '_q_next']

/src/open62541/tests/fuzz/fuzz_base64_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_PubSubConnectionConfig_copy', 'UA_PubSubConnectionConfig_clear', 'UA_Array_copy', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_tcp_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_KeyValueMap_setScalar', 'processHEL', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'extractCompleteChunk', 'UA_NamespaceMapping_delete', 'endModelChange', 'browseRecursive']

/src/open62541/tests/fuzz/fuzz_config_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_Session_detachFromSecureChannel', 'UA_KeyValueMap_setScalar', 'UA_Session_detachSubscription', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'Variant_clear', 'endModelChange', 'browseRecursive']

/src/open62541/tests/fuzz/fuzz_binary_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_KeyValueMap_getScalar', 'UA_KeyValueMap_setScalar', 'UA_Session_detachSubscription', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'Variant_clear', 'endModelChange', 'browseRecursive']

/src/open62541/tests/fuzz/fuzz_src_ua_util.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_datatype_description.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse_qn', 'fromDescription', 'reverse', 'UA_DataType_toStructureDescription', 'UA_DataType_clear', 'UA_DataType_fromEnumDescription', 'UA_DataType_fromStructureDescription']

/src/open62541/tests/fuzz/fuzz_process_request.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['findSingleChildNode', 'ctxClear', 'copyAttributeIntoNode', 'initPubSubNS0', 'getNodeContext', 'Variant_clear', 'UA_NamespaceMapping_delete', 'endModelChange', 'selectEndpointAndTokenPolicy', 'browseRecursive']

/src/open62541/tests/fuzz/fuzz_binary_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'LLVMFuzzerTestOneInput', 'UA_encodeBinary', 'UA_ByteString_allocBuffer', 'copySubString', 'UA_Variant_copyRange', 'UA_DataValue_copyRange']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
clearStructure	35	19	54.28%	['fuzz_client', 'fuzz_tcp_message', 'fuzz_json_decode', 'fuzz_pubsub_connection_config', 'fuzz_parse_string', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_datatype_description', 'fuzz_pubsub_binary', 'fuzz_eventfilter_parse', 'fuzz_xml_decode_encode', 'fuzz_binary_decode', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_pubsub_json']
structureOrder	51	28	54.90%	['fuzz_xml_decode_encode', 'fuzz_binary_decode', 'fuzz_attributeoperand']
lookupRefType	38	12	31.57%	['fuzz_tcp_message', 'fuzz_parse_string', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_attributeoperand', 'fuzz_server_services']
decodeJsonStructureInternal	81	39	48.14%	['fuzz_json_decode', 'fuzz_pubsub_json']
UA_encodeJson	33	17	51.51%	['fuzz_json_decode_encode', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
ExtensionObject_encodeJson	48	11	22.91%	['fuzz_json_decode_encode']
decodeMatrixVariant	36	10	27.77%	['fuzz_xml_decode_encode']
processServiceResponse	41	10	24.39%	['fuzz_client']
__Client_Service	61	8	13.11%	['fuzz_client']
UA_CertificateUtils_verifyApplicationUri	36	12	33.33%	['fuzz_certificate_parse', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
UA_CertificateUtils_getThumbprint	33	3	9.090%	['fuzz_certificate_parse']
UA_KeyValueRestriction_validate	35	15	42.85%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
UA_EventLoopPOSIX_start	77	38	49.35%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
openSignalPipe	33	17	51.51%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
format_string_loop	239	110	46.02%	['fuzz_client', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
print_integer_finalization	51	16	31.37%	['fuzz_client', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
addDriver	32	12	37.5%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
auditEvent	87	4	4.597%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
UA_Node_insertOrUpdateLocale	37	14	37.83%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
createSubscriptionObject	56	18	32.14%	['fuzz_server_services']
compatibleValue	37	10	27.02%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
Operation_WriteWithNode	64	26	40.62%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
readValueAttributeComplete	33	18	54.54%	['fuzz_tcp_message', 'fuzz_parse_string', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_attributeoperand', 'fuzz_server_services']
copyAttributeIntoNode	209	57	27.27%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
writeNodeValueAttribute	90	39	43.33%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
triggerImmediateDataChange	33	4	12.12%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
process_FindServersOnNetwork	44	4	9.090%	['fuzz_server_services']
process_RegisterServer	104	5	4.807%	['fuzz_process_request', 'fuzz_server_services']
Service_CreateMonitoredItems	34	18	52.94%	['fuzz_server_services']
callEarlyConstructors	66	35	53.03%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
addNode_raw	73	35	47.94%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
useVariableTypeAttributes	51	20	39.21%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
typeCheckVariableNode	81	28	34.56%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
recursiveCallConstructors	91	41	45.05%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
UA_Server_addMethodNodeEx_finish	90	41	45.55%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
Service_Cancel	32	15	46.87%	['fuzz_process_request', 'fuzz_server_services']
Service_ActivateSession_inner	205	89	43.41%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
Service_ModifySubscription	44	12	27.27%	['fuzz_server_services']
browseResolvedNode	39	21	53.84%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
browseWithNode	65	27	41.53%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
walkBrowsePathElement	95	52	54.73%	['fuzz_tcp_message', 'fuzz_parse_string', 'fuzz_binary_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_eventfilter_parse', 'fuzz_attributeoperand', 'fuzz_server_services']
UA_Session_detachFromSecureChannel	33	16	48.48%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
mdnsd_in	96	38	39.58%	['fuzz_mdns_message']
TCP_registerListenSocket	167	72	43.11%	['fuzz_tcp_message']
TCP_sendWithConnection	42	23	54.76%	['fuzz_tcp_message']
UA_PubSubManager_setState	36	16	44.44%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
UA_Server_run_startup	154	70	45.45%	['fuzz_tcp_message']
UA_HttpProtocolManager_validateConfig	70	4	5.714%	['fuzz_tcp_message']
startHttp	37	8	21.62%	['fuzz_tcp_message']
deleteServerSecureChannel	44	22	50.0%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
processSecureChannelMessage	57	12	21.05%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
startWebSocketTransport	51	7	13.72%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
UA_SecureChannel_getCompleteMessage	107	26	24.29%	['fuzz_client', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
reloadCertificates	64	18	28.12%	['fuzz_config_json']
readCertificates	49	23	46.93%	['fuzz_config_json']
ApplicationTypeField_parseJson	35	16	45.71%	['fuzz_config_json']
UA_TrustListDataType_add	73	32	43.83%	['fuzz_config_json']
activateSession_default	73	29	39.72%	['fuzz_process_request']
Service_Read	46	18	39.13%	['fuzz_process_request']
Service_HistoryRead	116	9	7.758%	['fuzz_process_request']
Service_HistoryUpdate	64	11	17.18%	['fuzz_process_request']
Service_CreateSession_inner	158	75	47.46%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
signCreateSessionResponse	35	3	8.571%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
selectTokenPolicy	69	27	39.13%	['fuzz_tcp_message', 'fuzz_config_json', 'fuzz_process_request', 'fuzz_binary_message', 'fuzz_server_services']
Service_Publish	76	12	15.78%	['fuzz_process_request']
Operation_TransferSubscription	117	10	8.547%	['fuzz_process_request']
Operation_BrowseNext	54	10	18.51%	['fuzz_process_request']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/open62541/src/server/ua_services_nodemanagement.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/deps/utf8.h	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/src/server/ua_services_session.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_process_request']
/src/open62541/tests/fuzz/custom_memory_manager.c	['fuzz_attributeoperand', 'fuzz_pubsub_binary', 'fuzz_certificate_parse', 'fuzz_pubsub_json', 'fuzz_tcp_message', 'fuzz_src_ua_util', 'fuzz_datatype_description', 'fuzz_binary_decode']	['fuzz_attributeoperand', 'fuzz_pubsub_binary', 'fuzz_certificate_parse', 'fuzz_pubsub_json', 'fuzz_tcp_message', 'fuzz_src_ua_util', 'fuzz_datatype_description', 'fuzz_binary_decode']
/src/open62541/drivers/discovery_mdns_mdnsd.c	[]	[]
/work/open62541/src_generated/mdnsd/inet.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/server/ua_server_modelchange.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/work/open62541/src_generated/open62541/transport_generated.h	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/work/open62541/src_generated/mdnsd/1035.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/ua_types_encoding_binary.c	['fuzz_pubsub_binary', 'fuzz_client', 'fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request', 'fuzz_binary_decode']	['fuzz_pubsub_binary', 'fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_datatype_description', 'fuzz_process_request', 'fuzz_binary_decode']
/src/open62541/plugins/historydata/ua_history_data_gathering_default.c	[]	[]
/src/open62541/src/server/ua_server_discovery.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	['fuzz_src_ua_util']	['fuzz_src_ua_util']
/src/open62541/tests/fuzz/fuzz_parse_string.cc	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/src/server/ua_server_config.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_services.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_process_request']
/src/open62541/src/ua_types.c	['fuzz_attributeoperand', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_xml_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_certificate_parse', 'fuzz_pubsub_json', 'fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request', 'fuzz_binary_decode']	['fuzz_attributeoperand', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_xml_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_certificate_parse', 'fuzz_pubsub_json', 'fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request', 'fuzz_binary_decode']
/src/open62541/deps/yxml.c	['fuzz_xml_decode_encode', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_xml_decode_encode', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/ua_securechannel.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_process_request']
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/src/ua_types_encoding_json.c	['fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_client', 'fuzz_pubsub_json', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_pubsub_json', 'fuzz_config_json']
/src/open62541/plugins/crypto/openssl/securitypolicy_aes128sha256rsaoaep.c	['fuzz_config_json']	[]
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	['fuzz_pubsub_binary', 'fuzz_pubsub_json', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_pubsub_binary', 'fuzz_pubsub_json']
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/plugins/ua_accesscontrol_default.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_transport_ws.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/arch/posix/eventloop_posix.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/ua_types_encoding_xml.c	['fuzz_xml_decode_encode', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_xml_decode_encode', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/ua_securechannel.h	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/arch/posix/eventloop_posix_tcp.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/arch/posix/eventloop_posix_udp.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	['fuzz_client', 'fuzz_certificate_parse', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_certificate_parse', 'fuzz_process_request']
/src/open62541/src/pubsub/ua_pubsub_internal.h	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/work/open62541/src_generated/mdnsd/xht.c	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/plugins/crypto/ua_certificategroup_none.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_server_ns0_diagnostics.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_process_request']
/src/open62541/src/pubsub/../server/ua_server_internal.h	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_services_attribute.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_subscription.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/plugins/crypto/ua_securitypolicy_filestore.c	[]	[]
/src/open62541/include/open62541/plugin/nodestore.h	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	['fuzz_pubsub_connection_config']	['fuzz_pubsub_connection_config']
/src/open62541/src/server/ua_subscription.h	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/src/client/ua_client_discovery.c	['fuzz_client']	[]
/src/open62541/plugins/ua_config_default.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/work/open62541/src_generated/mdnsd/sdtxt.c	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	['fuzz_pubsub_json']	['fuzz_pubsub_json']
/src/open62541/src/util/ua_encryptedsecret.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/plugins/ua_log_stdout.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/include/open62541/client_subscriptions.h	[]	[]
/src/open62541/src/util/ua_util_internal.h	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request', 'fuzz_binary_decode']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string']
/src/open62541/arch/posix/eventloop_posix.h	[]	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256.c	['fuzz_config_json']	[]
/src/open62541/src/pubsub/ua_pubsub_writer.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp384.c	[]	[]
/src/open62541/plugins/crypto/openssl/certificategroup.c	['fuzz_client', 'fuzz_certificate_parse', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_certificate_parse', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/pubsub/ua_pubsub_connection.c	['fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_pubsub_connection_config']
/src/open62541/src/util/ua_eventfilter_grammar.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/tests/fuzz/fuzz_json_decode.cc	['fuzz_json_decode']	['fuzz_json_decode']
/work/open62541/src_generated/open62541/types_generated.h	['fuzz_attributeoperand', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_xml_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_certificate_parse', 'fuzz_pubsub_json', 'fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request', 'fuzz_binary_decode']	['fuzz_attributeoperand', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_pubsub_binary', 'fuzz_xml_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_certificate_parse', 'fuzz_pubsub_json', 'fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request', 'fuzz_binary_decode']
/work/open62541/src_generated/mdnsd/log.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/ua_types_definition.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request']	['fuzz_datatype_description']
/src/open62541/src/server/ua_services_method.c	[]	[]
/src/open62541/src/client/ua_client.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/server/ua_server_nodes.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/pubsub/../ua_types_encoding_json.h	['fuzz_pubsub_json']	[]
/src/open62541/arch/posix/eventloop_posix_eth.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	['fuzz_tcp_message']	['fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256sha256.c	['fuzz_config_json']	[]
/src/open62541/tests/fuzz/fuzz_process_request.cc	['fuzz_process_request']	['fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_client.cc	['fuzz_client']	['fuzz_client']
/src/open62541/deps/libc_time.c	['fuzz_parse_string', 'fuzz_certificate_parse']	['fuzz_parse_string', 'fuzz_certificate_parse']
/src/open62541/src/util/ua_types_lex.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request']
/src/open62541/plugins/ua_log_syslog.c	[]	[]
/src/open62541/src/pubsub/ua_pubsub_reader.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/tests/testing-plugins/test_helpers.c	['fuzz_client']	['fuzz_client']
/src/open62541/tests/fuzz/fuzz_datatype_description.cc	['fuzz_datatype_description']	['fuzz_datatype_description']
/src/open62541/deps/dtoa.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/src/util/ua_util.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_src_ua_util', 'fuzz_datatype_description', 'fuzz_process_request']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_src_ua_util', 'fuzz_datatype_description', 'fuzz_process_request']
/src/open62541/arch/common/eventloop_common.c	[]	[]
/src/open62541/src/util/ua_eventfilter_lex.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	['fuzz_binary_decode']	['fuzz_binary_decode']
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	['fuzz_pubsub_binary']	['fuzz_pubsub_binary']
/src/open62541/arch/posix/clock_posix.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	['fuzz_base64_decode']	['fuzz_base64_decode']
/src/open62541/include/open62541/server.h	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/tests/fuzz/fuzz_binary_message.cc	['fuzz_binary_message']	['fuzz_binary_message']
/src/open62541/plugins/crypto/ua_filestore_common.c	['fuzz_config_json']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256.c	['fuzz_config_json']	[]
/src/open62541/deps/itoa.c	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_datatype_description', 'fuzz_process_request']	['fuzz_attributeoperand', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_datatype_description', 'fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_server_services.cc	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/deps/pcg_basic.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/pubsub/ua_pubsub_manager.c	['fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_pubsub_connection_config', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_services_monitoreditem.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services']
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	['fuzz_pubsub_json', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_pubsub_json']
/src/open62541/src/pubsub/ua_pubsub_dataset.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256_aesgcm.c	[]	[]
/src/open62541/src/server/ua_server_auditing.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_process_request']
/src/open62541/arch/common/timer.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/plugins/ua_nodestore_ziptree.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/tests/fuzz/fuzz_config_json.cc	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/arch/posix/eventloop_posix_interrupt.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/work/open62541/src_generated/open62541/config.h	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/plugins/crypto/openssl/securitypolicy_basic128rsa15.c	['fuzz_config_json']	[]
/src/open62541/src/ua_securechannel_http.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/plugins/crypto/openssl/create_certificate.c	[]	[]
/src/open62541/src/server/ua_server_async.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/client/ua_client_highlevel.c	[]	[]
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/plugins/ua_config_json.c	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/deps/ziptree.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/deps/mp_printf.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_services_subscription.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/plugins/crypto/openssl/securitypolicy_ecccurve448.c	[]	[]
/src/open62541/src/server/ua_subscription_event.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	['fuzz_json_decode_encode']	['fuzz_json_decode_encode']
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	['fuzz_attributeoperand']	['fuzz_attributeoperand']
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	['fuzz_certificate_parse']	['fuzz_certificate_parse']
/src/open62541/src/server/ua_transport_http.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/usr/include/openssl/asn1.h	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/src/ua_securechannel_crypto.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/deps/utf8.c	[]	[]
/src/open62541/src/client/ua_client_util.c	[]	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_eccbrainpoolp384r1.c	[]	[]
/src/open62541/tests/testing-plugins/testing_clock.c	[]	[]
/src/open62541/src/client/../util/ua_util_internal.h	['fuzz_client']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string']
/src/open62541/plugins/crypto/openssl/securitypolicy_aes256sha256rsapss.c	['fuzz_config_json']	[]
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	['fuzz_xml_decode_encode']	['fuzz_xml_decode_encode']
/src/open62541/src/server/ua_server_ns0.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_services_view.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/tests/testing-plugins/testing_networklayers.c	['fuzz_binary_message', 'fuzz_process_request']	['fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/client/ua_client_subscriptions.c	['fuzz_client']	['fuzz_client']
/work/open62541/src_generated/mdnsd/mdnsd.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256_chachapoly.c	[]	[]
/src/open62541/src/client/ua_client_connect_http.c	['fuzz_client']	[]
/src/open62541/src/server/ua_transport_tcp_reverse.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/plugins/crypto/openssl/securitypolicy_ecccurve25519.c	[]	[]
/src/open62541/src/server/ua_services_securechannel.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_tcp_message']
/src/open62541/plugins/include/open62541/server_config_default.h	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_services_discovery.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_process_request']
/src/open62541/src/pubsub/ua_pubsub_ns0.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccbrainpoolp256r1.c	[]	[]
/src/open62541/deps/base64.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_client', 'fuzz_server_services', 'fuzz_base64_encode', 'fuzz_base64_decode', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_base64_encode', 'fuzz_base64_decode', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/util/ua_eventfilter_parser.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/client/../ua_securechannel.h	['fuzz_client']	[]
/work/open62541/src_generated/open62541/statuscodes.c	['fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/usr/include/openssl/x509.h	['fuzz_config_json']	[]
/src/open62541/src/server/ua_session.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_server.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/deps/cj5.c	['fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_client', 'fuzz_pubsub_json', 'fuzz_config_json']	['fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_eventfilter_parse', 'fuzz_pubsub_json', 'fuzz_config_json']
/src/open62541/plugins/historydata/ua_history_database_default.c	[]	[]
/src/open62541/include/open62541/plugin/log.h	['fuzz_eventfilter_parse', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_eventfilter_parse', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/usr/include/openssl/x509v3.h	['fuzz_certificate_parse', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/src/server/ua_server_utils.c	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/deps/parse_num.c	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/src/server/ua_server_internal.h	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/plugins/historydata/ua_history_data_backend_memory.c	[]	[]
/src/open62541/src/server/ua_transport_tcp.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/deps/musl_inet_pton.c	[]	[]
/src/open62541/src/client/ua_client_connect.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/server/ua_subscription_datachange.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	[]
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	['fuzz_base64_encode']	['fuzz_base64_encode']
/work/open62541/src_generated/open62541/namespace0_generated.c	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/pubsub/../util/ua_util_internal.h	['fuzz_pubsub_binary', 'fuzz_server_services', 'fuzz_tcp_message', 'fuzz_config_json', 'fuzz_binary_message', 'fuzz_process_request']	['fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_parse_string']

Directories in report

Directory
/src/open62541/src/server/
/src/open62541/arch/posix/
/src/open62541/src/pubsub/../util/
/src/open62541/src/client/
/usr/include/openssl/
/work/open62541/src_generated/mdnsd/
/src/open62541/drivers/
/src/open62541/include/open62541/plugin/
/src/open62541/src/pubsub/../server/
/src/open62541/arch/common/
/src/open62541/plugins/
/src/open62541/tests/testing-plugins/
/src/open62541/include/open62541/
/src/open62541/tests/fuzz/
/src/open62541/deps/
/src/open62541/plugins/crypto/openssl/
/src/open62541/src/client/../
/src/open62541/plugins/crypto/
/src/open62541/src/pubsub/../
/src/open62541/plugins/historydata/
/src/open62541/plugins/include/open62541/
/src/open62541/src/pubsub/
/work/open62541/src_generated/open62541/
/src/open62541/src/util/
/src/open62541/src/
/src/open62541/src/client/../util/