High level conclusions

Fuzzers reach 54.99% code coverage.

Fuzzers reach 54.74% of cyclomatic complexity.

Fuzzers reach 59.04% of all functions.

Fuzzer fuzz_client is blocked:

The runtime code coverage of fuzz_client covers 15.03% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3427 / 5804

Cyclomatic complexity statically reachable by fuzzers

14585 / 26640

Runtime code coverage of functions

3192 / 5804

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_certificate_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	40	41.6%
gold	[1:9]	16	16.6%
yellow	[10:29]	1	1.04%
greenyellow	[30:49]	5	5.20%
lawngreen	50+	34	35.4%
All colors	96	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	77	UA_CertificateUtils_verifyApplicationUri	call site: 00077	UA_String_clear
11	42	LLVMFuzzerTestOneInput	call site: 00042	UA_OpenSSL_LoadCertificate
5	9	UA_OpenSSL_LoadPemCertificate	call site: 00009	X509_get_pubkey
2	62	UA_CertificateUtils_getKeySize	call site: 00062	EVP_PKEY_free
1	4	UA_OpenSSL_LoadCertificate	call site: 00004	d2i_X509
1	17	UA_OpenSSL_LoadCrl	call site: 00017	d2i_X509_CRL
1	27	UA_CertificateUtils_getSubjectName	call site: 00027	UA_copy
1	32	LLVMFuzzerTestOneInput	call site: 00032	UA_clear

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

36

Reachable functions

60

Percentage of reachable functions covered

40.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/crypto/openssl/certificategroup.c	7
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	6
/src/open62541/src/ua_types.c	3
/work/open62541/src_generated/open62541/types_generated.h	3
/src/open62541/deps/libc_time.c	3
/usr/include/openssl/x509v3.h	3

Fuzzer: fuzz_xml_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	8.82%
gold	[1:9]	1	0.73%
yellow	[10:29]	3	2.20%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	120	88.2%
All colors	136	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	123	LLVMFuzzerTestOneInput	call site: 00123
2	109	LLVMFuzzerTestOneInput	call site: 00109	UA_calcSizeXml
2	112	UA_encodeXml	call site: 00112	UA_ByteString_clear
2	117	LLVMFuzzerTestOneInput	call site: 00117
1	88	UA_decodeXml	call site: 00088	UA_STRING
1	104	LLVMFuzzerTestOneInput	call site: 00104	UA_clear
1	107	UA_ByteString_allocBuffer	call site: 00107

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

4

Reachable functions

59

Percentage of reachable functions covered

93.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_xml.c	9
/src/open62541/deps/yxml.c	34
/src/open62541/src/ua_types.c	4

Fuzzer: fuzz_src_ua_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	100.%
All colors	17	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

3

Reachable functions

13

Percentage of reachable functions covered

76.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	3
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_mdns_xht

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	3.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	96.4%
All colors	28	100

Runtime coverage analysis

Covered functions

13

Functions that are reachable but not covered

6

Reachable functions

19

Percentage of reachable functions covered

68.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	1
/work/open62541/src_generated/mdnsd/sdtxt.c	5
/work/open62541/src_generated/mdnsd/xht.c	7

Fuzzer: fuzz_pubsub_connection_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	27.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	72.2%
All colors	36	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	9	UA_PubSubConnectionConfig_copy	call site: 00009	UA_String_copy
2	24	UA_PubSubConnectionConfig_clear	call site: 00024	UA_String_clear
1	14	UA_PubSubConnectionConfig_copy	call site: 00014	UA_copy
1	20	UA_Array_copy	call site: 00020	UA_Array_delete
1	22	UA_Array_delete	call site: 00022	UA_PubSubConnectionConfig_clear
1	29	UA_PubSubConnectionConfig_clear	call site: 00029	UA_clear
1	32	UA_PubSubConnectionConfig_clear	call site: 00032	UA_Array_delete

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

0

Reachable functions

19

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	1
/src/open62541/src/ua_types_encoding_binary.c	3
/src/open62541/src/ua_types.c	4
/src/open62541/src/pubsub/ua_pubsub_connection.c	2
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/pubsub/ua_pubsub_manager.c	2
/src/open62541/src/util/ua_util.c	2

Fuzzer: fuzz_eventfilter_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	363	64.1%
gold	[1:9]	2	0.35%
yellow	[10:29]	1	0.17%
greenyellow	[30:49]	1	0.17%
lawngreen	50+	199	35.1%
All colors	566	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
107	346	UA_ExtensionObject_setValue	call site: 00346	buildEnumDefinitionFromProperties
105	156	stringOrder	call site: 00156	UA_Server_readBrowseName
39	116	lookupRefType	call site: 00116	UA_Server_browseRecursive
39	306	UA_QualifiedName_parseEx	call site: 00306	UA_DataType_toStructureDescription
14	265	Variant_clear	call site: 00265	readExternalValueAttribute
13	280	UA_Array_copy	call site: 00280	UA_findDataTypeWithCustom
11	294	UA_findDataTypeWithCustom	call site: 00294	UA_DataType_toDescription
7	45	UA_String_unescape	call site: 00045	UA_NamespaceMapping_uri2Index
4	40	parse_nodeid	call site: 00040	UA_String_unescape
2	262	UA_Array_delete	call site: 00262	Variant_clear
2	526	UA_Array_append	call site: 00526	UA_Array_delete
1	37	UA_EventFilter_lex	call site: 00037	UA_NodeId_parseEx

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

142

Reachable functions

265

Percentage of reachable functions covered

46.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	1
/src/open62541/src/ua_types.c	52
/work/open62541/src_generated/open62541/types_generated.h	58
/src/open62541/src/util/ua_eventfilter_grammar.c	14
/src/open62541/src/util/ua_eventfilter_lex.c	2
/src/open62541/src/util/ua_eventfilter_parser.c	14
/src/open62541/include/open62541/plugin/log.h	1
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/util/ua_types_lex.c	19
/src/open62541/src/util/ua_util.c	6
/src/open62541/deps/base64.c	1
/src/open62541/src/util/ua_util_internal.h	5
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5

Fuzzer: fuzz_base64_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	1
/src/open62541/deps/base64.c	2

Fuzzer: fuzz_binary_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3823	21.8%
gold	[1:9]	17	0.09%
yellow	[10:29]	6	0.03%
greenyellow	[30:49]	8	0.04%
lawngreen	50+	13648	77.9%
All colors	17502	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1017	15984	initPubSubNS0	call site: 15984	addDataSetReaderConfig
184	15626	policyUriContains	call site: 15626	Service_ActivateSession
138	17062	initPubSubNS0	call site: 17062	UA_Server_addPublishedDataSet
130	1013	copyAttributeIntoNode	call site: 01013	UA_MonitoredItem_processSampledValue
119	1309	UA_KeyValueMap_clear	call site: 01309	recordModelChangeEvent
87	519	Variant_clear	call site: 00519	UA_DataType_toDescription
80	1431	endModelChange	call site: 01431	UA_ModelChangeAccumulator_finalize
80	15544	UA_KeyValueMap_setScalar	call site: 15544	UA_Session_remove
62	1246	browseRecursive	call site: 01246	UA_Server_readBrowseName
59	15020	notifySubscription	call site: 15020	UA_Subscription_delete
52	1528	deleteNodeOperation_inner	call site: 01528	deleteNodeSet
49	14954	UA_Subscription_delete	call site: 14954	deleteMonitoredItem

Runtime coverage analysis

Covered functions

2356

Functions that are reachable but not covered

725

Reachable functions

2902

Percentage of reachable functions covered

75.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_message.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	84
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	121
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	35
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	41
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_pubsub_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	9.09%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	1.51%
greenyellow	[30:49]	2	3.03%
lawngreen	50+	57	86.3%
All colors	66	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	57	UA_DataSetMessage_clear	call site: 00057	UA_DataValue_clear
1	39	NetworkMessage_decodeJsonInternal	call site: 00039	decodeFieldsInternal
1	53	UA_NetworkMessage_decodeJson	call site: 00053	UA_Array_delete
1	60	UA_NetworkMessage_clear	call site: 00060	UA_clear
1	62	UA_NetworkMessage_clear	call site: 00062	UA_clear

Runtime coverage analysis

Covered functions

142

Functions that are reachable but not covered

3

Reachable functions

30

Percentage of reachable functions covered

90.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	2
/src/open62541/src/ua_types_encoding_json.c	7
/src/open62541/deps/cj5.c	7
/src/open62541/src/pubsub/../ua_types_encoding_json.h	2
/src/open62541/src/ua_types_encoding_json.h	2
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	2
/src/open62541/src/ua_types.c	2
/work/open62541/src_generated/open62541/types_generated.h	3

Fuzzer: fuzz_process_request

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3824	21.8%
gold	[1:9]	9	0.05%
yellow	[10:29]	14	0.07%
greenyellow	[30:49]	2	0.01%
lawngreen	50+	13676	78.0%
All colors	17525	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
933	16042	findSingleChildNode	call site: 16042	addDataSetReaderConfig
245	15173	ctxClear	call site: 15173	processSecureChannelMessage
138	17060	initPubSubNS0	call site: 17060	UA_Server_addPublishedDataSet
130	1011	copyAttributeIntoNode	call site: 01011	UA_MonitoredItem_processSampledValue
104	1322	getNodeContext	call site: 01322	recordModelChangeEvent
87	517	Variant_clear	call site: 00517	UA_DataType_toDescription
81	14813	UA_SecureChannel_clear	call site: 14813	sendServiceMessage
80	1429	endModelChange	call site: 01429	UA_ModelChangeAccumulator_finalize
64	15676	selectEndpointAndTokenPolicy	call site: 15676	checkActivateSessionX509
62	1244	browseRecursive	call site: 01244	UA_Server_readBrowseName
53	15982	initPubSubNS0	call site: 15982	addPubSubConnectionConfig
49	14742	UA_Session_detachFromSecureChannel	call site: 14742	sendResponse

Runtime coverage analysis

Covered functions

2396

Functions that are reachable but not covered

712

Reachable functions

2908

Percentage of reachable functions covered

75.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_process_request.cc	2
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	84
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	121
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	35
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	32
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	41
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_config_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4338	23.9%
gold	[1:9]	78	0.43%
yellow	[10:29]	17	0.09%
greenyellow	[30:49]	3	0.01%
lawngreen	50+	13665	75.4%
All colors	18101	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1017	16598	initPubSubNS0	call site: 16598	addDataSetReaderConfig
434	15724	UA_Session_clear	call site: 15724	processSecureChannelMessage
302	16160	UA_KeyValueMap_setScalar	call site: 16160	createServerConnection
185	15363	UA_Session_detachFromSecureChannel	call site: 15363	shutdownSecureChannel
151	1641	copyAttributeIntoNode	call site: 01641	UA_MonitoredItem_processSampledValue
137	17676	initPubSubNS0	call site: 17676	UA_Server_addPublishedDataSet
119	1929	UA_KeyValueMap_clear	call site: 01929	recordModelChangeEvent
87	1148	Variant_clear	call site: 01148	UA_DataType_toDescription
80	2051	endModelChange	call site: 02051	UA_ModelChangeAccumulator_finalize
65	15639	notifySubscription	call site: 15639	cleanupSessionEntry
62	1866	browseRecursive	call site: 01866	UA_Server_readBrowseName
52	2148	deleteNodeOperation_inner	call site: 02148	deleteNodeSet

Runtime coverage analysis

Covered functions

2277

Functions that are reachable but not covered

860

Reachable functions

2995

Percentage of reachable functions covered

71.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_config_json.cc	1
/src/open62541/plugins/ua_config_json.c	33
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	84
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	122
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	14
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/deps/cj5.c	10
/src/open62541/deps/utf8.h	1
/src/open62541/src/ua_types_encoding_json.c	13
/src/open62541/plugins/crypto/openssl/securitypolicy_basic128rsa15.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256sha256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes128sha256rsaoaep.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes256sha256rsapss.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256.c	2
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	10
/src/open62541/plugins/crypto/openssl/certificategroup.c	5
/usr/include/openssl/x509.h	6
/src/open62541/plugins/crypto/ua_filestore_common.c	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	35
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	41
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_mdns_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	41.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.76%
greenyellow	[30:49]	1	0.76%
lawngreen	50+	74	56.9%
All colors	130	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	73	_a_match	call site: 00073	_conflict
17	50	_r_next	call site: 00050	_r_send
6	37	mdnsd_in	call site: 00037	_is_local_ipv4
4	104	_cache	call site: 00104	_q_answer
3	95	mdnsd_in	call site: 00095	_conflict
2	122	_q_next	call site: 00122	_q_answer
2	127	mdnsd_free	call site: 00127	_free_record
1	33	inet_anyaddr	call site: 00033	htons
1	44	mdnsd_in	call site: 00044	vsyslog

Runtime coverage analysis

Covered functions

20

Functions that are reachable but not covered

33

Reachable functions

53

Percentage of reachable functions covered

37.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	1
/work/open62541/src_generated/mdnsd/1035.c	6
/work/open62541/src_generated/mdnsd/mdnsd.c	26
/work/open62541/src_generated/mdnsd/inet.c	3
/work/open62541/src_generated/mdnsd/log.c	1

Fuzzer: fuzz_json_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	4.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	96.0%
All colors	25	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear

Runtime coverage analysis

Covered functions

115

Functions that are reachable but not covered

0

Reachable functions

15

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	2
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	1

Fuzzer: fuzz_json_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	20.0%
gold	[1:9]	1	1.81%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	78.1%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	29	LLVMFuzzerTestOneInput	call site: 00029	UA_calcSizeJson
3	42	LLVMFuzzerTestOneInput	call site: 00042
2	36	LLVMFuzzerTestOneInput	call site: 00036
1	24	LLVMFuzzerTestOneInput	call site: 00024	UA_clear
1	27	UA_ByteString_allocBuffer	call site: 00027

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

3

Reachable functions

25

Percentage of reachable functions covered

88.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	3

Fuzzer: fuzz_parse_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	370	66.0%
gold	[1:9]	3	0.53%
yellow	[10:29]	3	0.53%
greenyellow	[30:49]	2	0.35%
lawngreen	50+	182	32.5%
All colors	560	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
146	305	UA_STRING	call site: 00305	buildEnumDefinitionFromProperties
105	158	stringOrder	call site: 00158	UA_Server_readBrowseName
40	264	UA_Array_delete	call site: 00264	UA_DataType_toDescription
39	118	lookupRefType	call site: 00118	UA_Server_browseRecursive
7	12	UA_String_unescape	call site: 00012	UA_NamespaceMapping_uri2Index
4	7	parse_nodeid	call site: 00007	UA_String_unescape
3	482	nodeId_printEscape	call site: 00482	UA_String_escapedSize
3	495	nodeId_printEscape	call site: 00495	UA_String_escapeInsert
3	522	printRelativePath	call site: 00522	UA_String_clear
2	102	parse_qn	call site: 00102	UA_QualifiedName_clear
1	4	LLVMFuzzerTestOneInput	call site: 00004	UA_NodeId_parseEx
1	24	UA_readNumberWithBase	call site: 00024	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

150

Reachable functions

265

Percentage of reachable functions covered

43.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_parse_string.cc	1
/src/open62541/src/ua_types.c	58
/work/open62541/src_generated/open62541/types_generated.h	63
/src/open62541/src/util/ua_types_lex.c	21
/src/open62541/src/util/ua_util.c	13
/src/open62541/deps/base64.c	2
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/deps/parse_num.c	2
/src/open62541/deps/libc_time.c	3
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1461	92.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	93	5.88%
greenyellow	[30:49]	19	1.20%
lawngreen	50+	6	0.37%
All colors	1579	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
588	548	UA_SecureChannel_clear	call site: 00548	__Client_networkCallback
305	1142	cleanupSession	call site: 01142	__Client_Subscriptions_backgroundPublish
162	363	UA_Array_delete	call site: 00363	__Client_Subscriptions_backgroundPublish
138	172	notifyClientState	call site: 00172	__UA_Client_startup
95	76	__Client_Service	call site: 00076	connectSync
74	1448	processServiceResponse	call site: 01448	connectActivity
50	312	UA_UNLOCK	call site: 00312	__Client_Subscriptions_backgroundPublish
23	38	setLocalCertificate_none	call site: 00038	UA_OpenSSL_LoadLocalCertificate
4	1569	UA_ClientConfig_clear	call site: 01569	UA_DataType_clear
3	539	UA_SecureChannel_deleteBuffered	call site: 00539	UA_Chunk_delete
3	544	UA_NamespaceMapping_delete	call site: 00544	UA_Array_delete
2	17	UA_ConnectionManager_new_POSIX_TCP	call site: 00017	UA_copy

Runtime coverage analysis

Covered functions

97

Functions that are reachable but not covered

390

Reachable functions

459

Percentage of reachable functions covered

15.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_client.cc	1
/src/open62541/tests/testing-plugins/test_helpers.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/plugins/ua_config_default.c	1
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	49
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	51
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	8
/src/open62541/src/client/ua_client.c	33
/src/open62541/src/ua_securechannel.c	32
/src/open62541/src/client/ua_client_connect.c	54
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/client/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/work/open62541/src_generated/open62541/transport_generated.h	4
/src/open62541/src/ua_securechannel_http.c	7
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/src/client/ua_client_subscriptions.c	29
/src/open62541/deps/ziptree.c	8
/src/open62541/src/util/ua_util.c	15
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	1
/src/open62541/src/client/ua_client_connect_http.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	2
/usr/include/openssl/asn1.h	1
/src/open62541/src/client/../ua_securechannel.h	3
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/client/ua_client_discovery.c	1
/usr/include/openssl/x509v3.h	3
/src/open62541/src/util/ua_encryptedsecret.c	8
/src/open62541/src/util/../ua_securechannel.h	1
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/cj5.c	7

Fuzzer: fuzz_pubsub_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	24	15.6%
gold	[1:9]	5	3.26%
yellow	[10:29]	5	3.26%
greenyellow	[30:49]	5	3.26%
lawngreen	50+	114	74.5%
All colors	153	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	106	stringOrder	call site: 00106	nodeIdOrder
7	98	UA_DataSetMessage_keyFrame_decodeBinary	call site: 00098	decodeRawField
1	145	UA_DataSetMessage_clear	call site: 00145	UA_clear
1	147	UA_NetworkMessage_clear	call site: 00147	UA_clear
1	149	UA_NetworkMessage_clear	call site: 00149	UA_clear

Runtime coverage analysis

Covered functions

82

Functions that are reachable but not covered

8

Reachable functions

42

Percentage of reachable functions covered

80.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	22
/src/open62541/src/pubsub/../util/ua_util_internal.h	3
/src/open62541/src/ua_types_encoding_binary.c	2
/src/open62541/src/ua_types.c	7
/work/open62541/src_generated/open62541/types_generated.h	4

Fuzzer: fuzz_datatype_description

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	37	25.0%
gold	[1:9]	10	6.75%
yellow	[10:29]	1	0.67%
greenyellow	[30:49]	1	0.67%
lawngreen	50+	99	66.8%
All colors	148	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	92	parse_qn	call site: 00092	UA_String_unescape
2	18	fromDescription	call site: 00018	UA_QualifiedName_printEx
2	23	reverse	call site: 00023	UA_ByteString_allocBuffer
2	124	UA_DataType_toStructureDescription	call site: 00124	UA_StructureDescription_clear
2	133	UA_DataType_toStructureDescription	call site: 00133	UA_StructureDescription_clear
1	15	fromDescription	call site: 00015	UA_copy
1	30	UA_DataType_clear	call site: 00030	UA_clear
1	39	UA_DataType_fromEnumDescription	call site: 00039	UA_DataType_clear
1	52	UA_DataType_fromStructureDescription	call site: 00052	UA_order
1	58	guidOrder	call site: 00058	stringOrder
1	60	stringOrder	call site: 00060	nodeIdOrder
1	71	UA_DataType_fromStructureDescription	call site: 00071	UA_DataType_clear

Runtime coverage analysis

Covered functions

93

Functions that are reachable but not covered

11

Reachable functions

75

Percentage of reachable functions covered

85.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_datatype_description.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	22
/src/open62541/src/ua_types_encoding_binary.c	3
/work/open62541/src_generated/open62541/types_generated.h	19
/src/open62541/src/ua_types_definition.c	11
/src/open62541/deps/itoa.c	3
/src/open62541/src/util/ua_util_internal.h	2
/src/open62541/src/util/ua_types_lex.c	4
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_attributeoperand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	383	75.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	10	1.97%
greenyellow	[30:49]	8	1.57%
lawngreen	50+	106	20.9%
All colors	507	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
151	247	UA_STRING	call site: 00247	buildEnumDefinitionFromProperties
104	98	stringOrder	call site: 00098	UA_Server_readBrowseName
40	206	UA_Array_delete	call site: 00206	UA_DataType_toDescription
39	58	lookupRefType	call site: 00058	UA_Server_browseRecursive
7	15	UA_String_unescape	call site: 00015	UA_NamespaceMapping_uri2Index
6	33	parse_nodeid_body	call site: 00033	UA_readNumberWithBase
5	416	nodeId_printEscape	call site: 00416	UA_String_escapedSize
5	480	UA_AttributeOperand_print	call site: 00480	UA_STRING
3	10	parse_nodeid	call site: 00010	UA_String_unescape
3	445	printRelativePath	call site: 00445	UA_STRING
2	203	UA_ByteString_allocBuffer	call site: 00203	UA_Variant_copyRange
2	402	parse_relativepathElement	call site: 00402	UA_RelativePathElement_clear

Runtime coverage analysis

Covered functions

83

Functions that are reachable but not covered

159

Reachable functions

229

Percentage of reachable functions covered

30.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/work/open62541/src_generated/open62541/types_generated.h	49
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/ua_types.c	58
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/src/util/ua_util.c	14
/src/open62541/deps/base64.c	2
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_server_services

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4236	23.6%
gold	[1:9]	89	0.49%
yellow	[10:29]	31	0.17%
greenyellow	[30:49]	37	0.20%
lawngreen	50+	13502	75.4%
All colors	17895	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1017	15982	initPubSubNS0	call site: 15982	addDataSetReaderConfig
254	15173	ctxClear	call site: 15173	processSecureChannelMessage
138	17060	initPubSubNS0	call site: 17060	UA_Server_addPublishedDataSet
130	1011	copyAttributeIntoNode	call site: 01011	UA_MonitoredItem_processSampledValue
119	1307	UA_KeyValueMap_clear	call site: 01307	recordModelChangeEvent
119	15664	Service_ActivateSession_inner	call site: 15664	UA_Session_attachToSecureChannel
114	14813	UA_SecureChannel_clear	call site: 14813	shutdownSecureChannel
108	15432	findSessionByToken	call site: 15432	processServiceInternal
87	517	Variant_clear	call site: 00517	UA_DataType_toDescription
81	17742	Service_CreateMonitoredItems	call site: 17742	Operation_CreateMonitoredItem
80	1429	endModelChange	call site: 01429	UA_ModelChangeAccumulator_finalize
62	1244	browseRecursive	call site: 01244	UA_Server_readBrowseName

Runtime coverage analysis

Covered functions

2370

Functions that are reachable but not covered

803

Reachable functions

3067

Percentage of reachable functions covered

73.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_server_services.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	88
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	180
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	16
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	12
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	43
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	8
/src/open62541/src/server/ua_subscription_event.c	14
/src/open62541/src/server/ua_server_auditing.c	15
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	25
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	13
/src/open62541/src/server/ua_services_subscription.c	9
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	7
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	21
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	2
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	41
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_base64_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	1
/src/open62541/deps/base64.c	1

Fuzzer: fuzz_binary_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	21.3%
gold	[1:9]	2	3.27%
yellow	[10:29]	1	1.63%
greenyellow	[30:49]	1	1.63%
lawngreen	50+	44	72.1%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	19	UA_encodeBinaryInternal	call site: 00019	exchangeBuffer
2	28	LLVMFuzzerTestOneInput	call site: 00028	UA_calcSizeBinary
2	31	UA_encodeBinary	call site: 00031	UA_ByteString_clear
1	26	UA_ByteString_allocBuffer	call site: 00026	UA_delete
1	49	copySubString	call site: 00049	UA_Variant_copyRange
1	53	UA_Variant_copyRange	call site: 00053	Variant_clear
1	56	UA_DataValue_copyRange	call site: 00056	Variant_clear
1	58	LLVMFuzzerTestOneInput	call site: 00058	UA_clear

Runtime coverage analysis

Covered functions

141

Functions that are reachable but not covered

3

Reachable functions

39

Percentage of reachable functions covered

92.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	17
/src/open62541/src/ua_types_encoding_binary.c	8
/src/open62541/src/util/ua_util_internal.h	2
/work/open62541/src_generated/open62541/types_generated.h	6

Fuzzer: fuzz_tcp_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4087	23.1%
gold	[1:9]	14	0.07%
yellow	[10:29]	1	0.00%
greenyellow	[30:49]	2	0.01%
lawngreen	50+	13519	76.7%
All colors	17623	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1017	15983	initPubSubNS0	call site: 15983	addDataSetReaderConfig
277	15543	UA_KeyValueMap_setScalar	call site: 15543	Service_ActivateSession
238	15303	processHEL	call site: 15303	processMSG
138	17061	initPubSubNS0	call site: 17061	UA_Server_addPublishedDataSet
130	1012	copyAttributeIntoNode	call site: 01012	UA_MonitoredItem_processSampledValue
119	1308	UA_KeyValueMap_clear	call site: 01308	recordModelChangeEvent
109	15175	extractCompleteChunk	call site: 15175	unpackPayloadMSG
96	14814	UA_SecureChannel_clear	call site: 14814	shutdownSecureChannel
80	1430	endModelChange	call site: 01430	UA_ModelChangeAccumulator_finalize
65	15019	notifySubscription	call site: 15019	cleanupSessionEntry
62	1245	browseRecursive	call site: 01245	UA_Server_readBrowseName
60	545	UA_findDataTypeWithCustom	call site: 00545	UA_DataType_toDescription

Runtime coverage analysis

Covered functions

2327

Functions that are reachable but not covered

793

Reachable functions

2927

Percentage of reachable functions covered

72.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	2
/src/open62541/tests/fuzz/custom_memory_manager.c	2
/src/open62541/plugins/include/open62541/server_config_default.h	1
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	84
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	119
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	24
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	35
/src/open62541/src/server/ua_server_async.c	19
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	47
/src/open62541/src/server/ua_server_utils.c	19
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1675
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	25
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	9
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	22
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	11
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	41
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
UA_Server_loadNodeset	/src/open62541/src/util/nodeset_loader/ua_nodeset_loader.c	3	['N/A', 'size_t', 'N/A']	53	0	116	20	8	704	0	4556	741
MdnsdDriver_start	/src/open62541/drivers/discovery_mdns_mdnsd.c	1	['N/A']	13	0	472	65	24	245	0	1441	528
UA_PubSubConnection_connectUDP	/src/open62541/src/pubsub/ua_pubsub_connection.c	3	['N/A', 'N/A', 'bool']	59	0	316	39	16	609	0	4210	242

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3627 / 5804

Cyclomatic complexity statically reachable by fuzzers

16080 / 26640

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/open62541/tests/fuzz/fuzz_certificate_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_CertificateUtils_verifyApplicationUri', 'LLVMFuzzerTestOneInput', 'UA_OpenSSL_LoadPemCertificate', 'UA_CertificateUtils_getKeySize', 'UA_OpenSSL_LoadCertificate', 'UA_OpenSSL_LoadCrl', 'UA_CertificateUtils_getSubjectName']

/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_encodeXml', 'UA_decodeXml', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_src_ua_util.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_mdns_xht.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_PubSubConnectionConfig_copy', 'UA_PubSubConnectionConfig_clear', 'UA_Array_copy', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_ExtensionObject_setValue', 'stringOrder', 'lookupRefType', 'UA_QualifiedName_parseEx', 'Variant_clear', 'UA_Array_copy', 'UA_findDataTypeWithCustom', 'UA_String_unescape', 'parse_nodeid', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_base64_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_binary_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'policyUriContains', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'Variant_clear', 'endModelChange', 'UA_KeyValueMap_setScalar', 'browseRecursive', 'notifySubscription']

/src/open62541/tests/fuzz/fuzz_pubsub_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_DataSetMessage_clear', 'NetworkMessage_decodeJsonInternal', 'UA_NetworkMessage_decodeJson', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_process_request.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['findSingleChildNode', 'ctxClear', 'initPubSubNS0', 'copyAttributeIntoNode', 'getNodeContext', 'Variant_clear', 'UA_SecureChannel_clear', 'endModelChange', 'selectEndpointAndTokenPolicy', 'browseRecursive']

/src/open62541/tests/fuzz/fuzz_config_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_Session_clear', 'UA_KeyValueMap_setScalar', 'UA_Session_detachFromSecureChannel', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'Variant_clear', 'endModelChange', 'notifySubscription']

/src/open62541/tests/fuzz/fuzz_mdns_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_a_match', '_r_next', 'mdnsd_in', '_cache', '_q_next', 'mdnsd_free', 'inet_anyaddr']

/src/open62541/tests/fuzz/fuzz_json_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_parse_string.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid', 'nodeId_printEscape', 'printRelativePath', 'parse_qn']

/src/open62541/tests/fuzz/fuzz_client.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_SecureChannel_clear', 'cleanupSession', 'UA_Array_delete', 'notifyClientState', '__Client_Service', 'processServiceResponse', 'UA_UNLOCK', 'setLocalCertificate_none', 'UA_ClientConfig_clear', 'UA_SecureChannel_deleteBuffered']

/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'UA_DataSetMessage_keyFrame_decodeBinary', 'UA_DataSetMessage_clear', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_datatype_description.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse_qn', 'fromDescription', 'reverse', 'UA_DataType_toStructureDescription', 'UA_DataType_clear', 'UA_DataType_fromEnumDescription', 'UA_DataType_fromStructureDescription', 'guidOrder']

/src/open62541/tests/fuzz/fuzz_attributeoperand.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid_body', 'nodeId_printEscape', 'UA_AttributeOperand_print', 'parse_nodeid', 'printRelativePath']

/src/open62541/tests/fuzz/fuzz_server_services.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'ctxClear', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'Service_ActivateSession_inner', 'UA_SecureChannel_clear', 'findSessionByToken', 'Variant_clear', 'Service_CreateMonitoredItems']

/src/open62541/tests/fuzz/fuzz_base64_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_binary_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'LLVMFuzzerTestOneInput', 'UA_encodeBinary', 'UA_ByteString_allocBuffer', 'copySubString', 'UA_Variant_copyRange', 'UA_DataValue_copyRange']

/src/open62541/tests/fuzz/fuzz_tcp_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_KeyValueMap_setScalar', 'processHEL', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'extractCompleteChunk', 'UA_SecureChannel_clear', 'endModelChange', 'notifySubscription']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
UA_CertificateUtils_verifyApplicationUri	38	12	31.57%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_certificate_parse', 'fuzz_tcp_message', 'fuzz_process_request']
UA_CertificateUtils_getThumbprint	33	3	9.090%	['fuzz_certificate_parse']
clearStructure	35	19	54.28%	['fuzz_parse_string', 'fuzz_binary_message', 'fuzz_xml_decode_encode', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_json_decode_encode', 'fuzz_config_json', 'fuzz_pubsub_binary', 'fuzz_client', 'fuzz_binary_decode', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_json_decode', 'fuzz_tcp_message', 'fuzz_process_request', 'fuzz_pubsub_json', 'fuzz_pubsub_connection_config']
structureOrder	51	28	54.90%	['fuzz_attributeoperand', 'fuzz_json_decode_encode', 'fuzz_xml_decode_encode', 'fuzz_binary_decode']
decodeMatrixVariant	40	10	25.0%	['fuzz_xml_decode_encode']
decodeJsonStructureInternal	81	39	48.14%	['fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_pubsub_json', 'fuzz_eventfilter_parse']
lookupRefType	38	12	31.57%	['fuzz_parse_string', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_process_request']
UA_KeyValueRestriction_validate	35	15	42.85%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
UA_EventLoopPOSIX_start	77	38	49.35%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
openSignalPipe	33	17	51.51%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
format_string_loop	239	110	46.02%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
print_integer_finalization	51	16	31.37%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
addDriver	32	12	37.5%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
auditEvent	87	4	4.597%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
UA_Node_insertOrUpdateLocale	37	14	37.83%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
validateCertificate	94	15	15.95%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
compatibleValue	37	10	27.02%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
Operation_WriteWithNode	64	26	40.62%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
readValueAttributeComplete	33	18	54.54%	['fuzz_parse_string', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_process_request']
copyAttributeIntoNode	209	57	27.27%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
writeNodeValueAttribute	91	39	42.85%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
triggerImmediateDataChange	33	4	12.12%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
callEarlyConstructors	66	35	53.03%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
addNode_raw	73	35	47.94%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
useVariableTypeAttributes	52	20	38.46%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
typeCheckVariableNode	81	28	34.56%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
recursiveCallConstructors	92	42	45.65%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
UA_Server_addMethodNodeEx_finish	90	41	45.55%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
browseResolvedNode	39	21	53.84%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
browseWithNode	65	27	41.53%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
UA_Session_detachFromSecureChannel	33	16	48.48%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
UA_SecureChannel_generateLocalKeys	39	13	33.33%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
generateRemoteKeys	44	13	29.54%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
hideBytesAsym	50	15	30.0%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
signAndEncryptAsym	47	4	8.510%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
signAndEncryptSym	57	4	7.017%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
setBufPos	40	5	12.5%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
decryptAndVerifyChunk	115	43	37.39%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
activateSession_default	73	29	39.72%	['fuzz_process_request']
UA_AsyncManager_cancelSession	41	16	39.02%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
Service_Read	52	18	34.61%	['fuzz_process_request']
Service_HistoryRead	121	9	7.438%	['fuzz_process_request']
Service_HistoryUpdate	64	11	17.18%	['fuzz_process_request']
process_RegisterServer	104	5	4.807%	['fuzz_server_services', 'fuzz_process_request']
UA_Session_remove	66	33	50.0%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
Service_Cancel	32	15	46.87%	['fuzz_server_services', 'fuzz_process_request']
Service_CreateSession_inner	158	75	47.46%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
signCreateSessionResponse	35	3	8.571%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
Service_ActivateSession_inner	231	103	44.58%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
selectTokenPolicy	69	27	39.13%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
Service_Publish	76	12	15.78%	['fuzz_process_request']
Operation_TransferSubscription	114	10	8.771%	['fuzz_process_request']
Operation_BrowseNext	54	10	18.51%	['fuzz_process_request']
walkBrowsePathElement	95	52	54.73%	['fuzz_parse_string', 'fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_attributeoperand', 'fuzz_eventfilter_parse', 'fuzz_tcp_message', 'fuzz_process_request']
reloadCertificates	64	18	28.12%	['fuzz_config_json']
readCertificates	49	23	46.93%	['fuzz_config_json']
ApplicationTypeField_parseJson	35	16	45.71%	['fuzz_config_json']
loadCertificateFile	37	19	51.35%	['fuzz_config_json']
UA_TrustListDataType_add	73	32	43.83%	['fuzz_config_json']
mdnsd_in	96	38	39.58%	['fuzz_mdns_message']
UA_encodeJson	33	17	51.51%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_json_decode_encode', 'fuzz_config_json', 'fuzz_client', 'fuzz_tcp_message', 'fuzz_process_request']
DiagnosticInfo_encodeJson	35	12	34.28%	['fuzz_json_decode_encode']
processServiceResponse	41	10	24.39%	['fuzz_client']
__Client_Service	61	8	13.11%	['fuzz_client']
createSubscriptionObject	56	18	32.14%	['fuzz_server_services']
process_FindServersOnNetwork	50	4	8.0%	['fuzz_server_services']
Service_CreateMonitoredItems	34	18	52.94%	['fuzz_server_services']
Service_ModifySubscription	41	12	29.26%	['fuzz_server_services']
TCP_registerListenSocket	167	72	43.11%	['fuzz_tcp_message']
TCP_sendWithConnection	42	23	54.76%	['fuzz_tcp_message']
UA_PubSubManager_setState	36	16	44.44%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']
UA_Server_run_startup	154	70	45.45%	['fuzz_tcp_message']
UA_HttpProtocolManager_validateConfig	70	4	5.714%	['fuzz_tcp_message']
startHttp	37	8	21.62%	['fuzz_tcp_message']
startWebSocketTransport	51	7	13.72%	['fuzz_binary_message', 'fuzz_server_services', 'fuzz_config_json', 'fuzz_tcp_message', 'fuzz_process_request']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/open62541/drivers/discovery_mdns_mdnsd.c	[]	[]
/src/open62541/arch/posix/eventloop_posix_eth.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/util/nodeset_loader/ua_nodeset.c	[]	[]
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	['fuzz_src_ua_util']	['fuzz_src_ua_util']
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	['fuzz_json_decode_encode']	['fuzz_json_decode_encode']
/src/open62541/include/open62541/plugin/log.h	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/work/open62541/src_generated/open62541/statuscodes.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message']
/src/open62541/arch/posix/eventloop_posix_udp.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_subscription_event.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/src/server/ua_services_nodemanagement.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/ua_filestore_common.c	['fuzz_config_json']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp384.c	[]	[]
/src/open62541/src/server/ua_subscription.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/work/open62541/src_generated/open62541/types_generated.h	['fuzz_certificate_parse', 'fuzz_xml_decode_encode', 'fuzz_pubsub_connection_config', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_parse_string', 'fuzz_client', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_binary_decode', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_xml_decode_encode', 'fuzz_pubsub_connection_config', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_parse_string', 'fuzz_client', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_binary_decode', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_config_json.cc	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/server/ua_services_securechannel.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_tcp_message']
/src/open62541/plugins/include/open62541/server_config_default.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/util/nodeset_loader/ua_nodeset_loader.c	[]	[]
/src/open62541/src/server/ua_server_modelchange.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/work/open62541/src_generated/mdnsd/sdtxt.c	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/tests/testing-plugins/testing_networklayers.c	['fuzz_binary_message', 'fuzz_process_request']	['fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	['fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_pubsub_binary', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_pubsub_json', 'fuzz_pubsub_binary']
/src/open62541/deps/itoa.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_client', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_parse_string', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services']
/src/open62541/src/client/ua_client_subscriptions.c	['fuzz_client']	['fuzz_client']
/src/open62541/tests/fuzz/fuzz_binary_message.cc	['fuzz_binary_message']	['fuzz_binary_message']
/src/open62541/src/pubsub/../util/ua_util_internal.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_pubsub_binary', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_attributeoperand']
/src/open62541/deps/cj5.c	['fuzz_eventfilter_parse', 'fuzz_pubsub_json', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_client']	['fuzz_eventfilter_parse', 'fuzz_pubsub_json', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_json_decode_encode']
/src/open62541/arch/posix/eventloop_posix.h	[]	[]
/src/open62541/src/client/ua_client_connect_http.c	['fuzz_client']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	['fuzz_certificate_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_binary_message', 'fuzz_process_request']
/src/open62541/src/server/ua_services_attribute.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/pubsub/ua_pubsub_writer.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/src/server/ua_server_discovery.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_ecccurve448.c	[]	[]
/src/open62541/src/ua_securechannel_http.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/src/util/ua_eventfilter_grammar.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/server/ua_server_async.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/client/ua_client_util.c	[]	[]
/src/open62541/src/pubsub/../ua_types_encoding_json.h	['fuzz_pubsub_json']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256.c	['fuzz_config_json']	[]
/src/open62541/deps/mp_printf.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/util/ua_eventfilter_lex.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccbrainpoolp384r1.c	[]	[]
/src/open62541/include/open62541/client_subscriptions.h	[]	[]
/src/open62541/src/pubsub/ua_pubsub_manager.c	['fuzz_pubsub_connection_config', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_pubsub_connection_config', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_services_subscription.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/deps/musl_inet_pton.c	[]	[]
/src/open62541/src/server/ua_subscription_datachange.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	['fuzz_pubsub_json']	['fuzz_pubsub_json']
/src/open62541/plugins/ua_accesscontrol_default.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/work/open62541/src_generated/mdnsd/log.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	['fuzz_config_json']	['fuzz_config_json']
/work/open62541/src_generated/open62541/config.h	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_client', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_server_auditing.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services']
/src/open62541/src/server/ua_services_session.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256_aesgcm.c	[]	[]
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	['fuzz_base64_encode']	['fuzz_base64_encode']
/src/open62541/arch/common/timer.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	['fuzz_base64_decode']	['fuzz_base64_decode']
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	['fuzz_attributeoperand']	['fuzz_attributeoperand']
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	['fuzz_tcp_message']	['fuzz_tcp_message']
/src/open62541/deps/dtoa.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/src/server/ua_server_internal.h	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	['fuzz_pubsub_connection_config']	['fuzz_pubsub_connection_config']
/src/open62541/src/server/ua_transport_tcp.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/certificategroup.c	['fuzz_certificate_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_config_json']
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	['fuzz_xml_decode_encode']	['fuzz_xml_decode_encode']
/work/open62541/src_generated/mdnsd/xht.c	['fuzz_mdns_xht']	['fuzz_mdns_xht']
/src/open62541/deps/pcg_basic.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256_chachapoly.c	[]	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_ecccurve25519.c	[]	[]
/usr/include/openssl/asn1.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/deps/libc_time.c	['fuzz_certificate_parse', 'fuzz_parse_string']	['fuzz_certificate_parse', 'fuzz_parse_string']
/src/open62541/src/server/ua_services_monitoreditem.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_server_services']
/src/open62541/src/pubsub/ua_pubsub_dataset.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	['fuzz_certificate_parse']	['fuzz_certificate_parse']
/src/open62541/src/pubsub/ua_pubsub_ns0.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/work/open62541/src_generated/open62541/namespace0_generated.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_json_decode.cc	['fuzz_json_decode']	['fuzz_json_decode']
/src/open62541/plugins/crypto/openssl/securitypolicy_pubsub_aesctr.c	[]	[]
/src/open62541/src/ua_securechannel.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message']
/src/open62541/src/server/ua_server_nodes.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/util/ua_encryptedsecret.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	['fuzz_binary_decode']	['fuzz_binary_decode']
/src/open62541/src/pubsub/ua_pubsub_internal.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/work/open62541/src_generated/mdnsd/mdnsd.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/plugins/ua_log_syslog.c	[]	[]
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/arch/posix/clock_posix.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_server_ns0_diagnostics.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/plugins/historydata/ua_history_data_gathering_default.c	[]	[]
/src/open62541/tests/fuzz/fuzz_process_request.cc	['fuzz_process_request']	['fuzz_process_request']
/src/open62541/plugins/historydata/ua_history_data_backend_memory.c	[]	[]
/src/open62541/src/ua_securechannel.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_subscription.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_services.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services']
/src/open62541/deps/utf8.c	[]	[]
/src/open62541/arch/posix/eventloop_posix.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/create_certificate.c	[]	[]
/src/open62541/arch/posix/eventloop_posix_interrupt.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/work/open62541/src_generated/mdnsd/1035.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/src/client/ua_client.c	['fuzz_client']	['fuzz_client']
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	['fuzz_pubsub_binary']	['fuzz_pubsub_binary']
/src/open62541/deps/base64.c	['fuzz_eventfilter_parse', 'fuzz_base64_encode', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_client', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_base64_decode', 'fuzz_tcp_message']	['fuzz_eventfilter_parse', 'fuzz_base64_encode', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_base64_decode', 'fuzz_tcp_message']
/src/open62541/src/pubsub/../server/ua_server_internal.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/testing-plugins/test_helpers.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/pubsub/ua_pubsub_reader.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/arch/common/eventloop_common.c	[]	[]
/src/open62541/src/client/../util/ua_util_internal.h	['fuzz_client']	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_attributeoperand']
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	['fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_pubsub_json']
/src/open62541/arch/posix/eventloop_posix_tcp.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_services_view.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/custom_memory_manager.c	['fuzz_certificate_parse', 'fuzz_src_ua_util', 'fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_src_ua_util', 'fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_binary_decode', 'fuzz_tcp_message']
/src/open62541/src/pubsub/ua_pubsub_connection.c	['fuzz_pubsub_connection_config', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_pubsub_connection_config']
/src/open62541/plugins/crypto/ua_securitypolicy_filestore.c	[]	[]
/src/open62541/src/server/ua_server_config.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_transport_tcp_reverse.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/ua_config_json.c	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/src/util/ua_eventfilter_parser.c	['fuzz_eventfilter_parse']	['fuzz_eventfilter_parse']
/src/open62541/src/server/ua_session.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/server/ua_services_method.c	[]	[]
/src/open62541/src/server/ua_services_discovery.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_process_request', 'fuzz_server_services']
/src/open62541/src/server/ua_transport_http.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/usr/include/openssl/x509.h	['fuzz_config_json']	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256.c	['fuzz_config_json']	[]
/src/open62541/src/ua_types.c	['fuzz_certificate_parse', 'fuzz_xml_decode_encode', 'fuzz_pubsub_connection_config', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_parse_string', 'fuzz_client', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_binary_decode', 'fuzz_tcp_message']	['fuzz_certificate_parse', 'fuzz_xml_decode_encode', 'fuzz_pubsub_connection_config', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_parse_string', 'fuzz_client', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_binary_decode', 'fuzz_tcp_message']
/src/open62541/plugins/ua_log_stdout.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/client/ua_client_discovery.c	['fuzz_client']	[]
/src/open62541/src/client/../ua_securechannel.h	['fuzz_client']	['fuzz_binary_message']
/src/open62541/src/ua_securechannel_crypto.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message']
/src/open62541/plugins/historydata/ua_history_database_default.c	[]	[]
/src/open62541/src/util/ua_util_internal.h	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_client', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_binary_decode', 'fuzz_tcp_message']	['fuzz_eventfilter_parse', 'fuzz_parse_string', 'fuzz_attributeoperand']
/src/open62541/plugins/ua_config_default.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/deps/yxml.h	[]	[]
/src/open62541/src/util/ua_types_lex.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/deps/yxml.c	['fuzz_xml_decode_encode', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_xml_decode_encode', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_aes256sha256rsapss.c	['fuzz_config_json']	[]
/usr/include/openssl/x509v3.h	['fuzz_certificate_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/src/server/ua_server_ns0.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/client/ua_client_connect.c	['fuzz_client']	['fuzz_client']
/src/open62541/src/server/ua_server.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256sha256.c	['fuzz_config_json']	[]
/src/open62541/tests/fuzz/fuzz_client.cc	['fuzz_client']	['fuzz_client']
/src/open62541/plugins/crypto/ua_certificategroup_none.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']
/work/open62541/src_generated/open62541/transport_generated.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message']
/src/open62541/src/util/ua_util.c	['fuzz_src_ua_util', 'fuzz_pubsub_connection_config', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_client', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_src_ua_util', 'fuzz_pubsub_connection_config', 'fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_client', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/src/client/ua_client_highlevel.c	[]	[]
/src/open62541/plugins/crypto/openssl/securitypolicy_eccbrainpoolp256r1.c	[]	[]
/src/open62541/src/server/ua_server_utils.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/plugins/crypto/openssl/securitypolicy_basic128rsa15.c	['fuzz_config_json']	[]
/src/open62541/src/ua_types_encoding_xml.c	['fuzz_xml_decode_encode', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_xml_decode_encode', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/deps/utf8.h	['fuzz_config_json']	['fuzz_config_json']
/src/open62541/include/open62541/server.h	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_server_services', 'fuzz_tcp_message']	[]
/src/open62541/src/ua_types_encoding_json.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_pubsub_json', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_json_decode_encode', 'fuzz_client', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_eventfilter_parse', 'fuzz_pubsub_json', 'fuzz_config_json', 'fuzz_json_decode', 'fuzz_json_decode_encode']
/src/open62541/deps/ziptree.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_client', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/ua_types_definition.c	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_datatype_description', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_datatype_description']
/src/open62541/tests/fuzz/fuzz_datatype_description.cc	['fuzz_datatype_description']	['fuzz_datatype_description']
/src/open62541/plugins/ua_nodestore_ziptree.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_parse_string.cc	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/plugins/crypto/openssl/securitypolicy_aes128sha256rsaoaep.c	['fuzz_config_json']	[]
/src/open62541/src/server/ua_transport_ws.c	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/tests/fuzz/fuzz_server_services.cc	['fuzz_server_services']	['fuzz_server_services']
/src/open62541/tests/testing-plugins/testing_clock.c	[]	[]
/work/open62541/src_generated/mdnsd/inet.c	['fuzz_mdns_message']	['fuzz_mdns_message']
/src/open62541/deps/parse_num.c	['fuzz_parse_string']	['fuzz_parse_string']
/src/open62541/include/open62541/plugin/nodestore.h	['fuzz_eventfilter_parse', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_parse_string', 'fuzz_attributeoperand', 'fuzz_server_services', 'fuzz_tcp_message']	['fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_server_services', 'fuzz_tcp_message']
/src/open62541/src/ua_types_encoding_binary.c	['fuzz_pubsub_connection_config', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_config_json', 'fuzz_client', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_decode', 'fuzz_tcp_message']	['fuzz_pubsub_connection_config', 'fuzz_binary_message', 'fuzz_process_request', 'fuzz_pubsub_binary', 'fuzz_datatype_description', 'fuzz_server_services', 'fuzz_binary_decode', 'fuzz_tcp_message']
/src/open62541/src/util/nodeset_loader/ua_nodeset_loader_apply.c	[]	[]

Directories in report

Directory
/src/open62541/src/
/src/open62541/src/pubsub/../
/src/open62541/deps/
/src/open62541/src/client/
/src/open62541/plugins/crypto/openssl/
/src/open62541/include/open62541/plugin/
/src/open62541/arch/common/
/src/open62541/src/util/
/src/open62541/src/pubsub/../server/
/src/open62541/tests/fuzz/
/src/open62541/src/server/
/src/open62541/plugins/historydata/
/src/open62541/tests/testing-plugins/
/src/open62541/src/client/../util/
/work/open62541/src_generated/open62541/
/src/open62541/plugins/
/usr/include/openssl/
/work/open62541/src_generated/mdnsd/
/src/open62541/drivers/
/src/open62541/src/util/nodeset_loader/
/src/open62541/src/pubsub/../util/
/src/open62541/arch/posix/
/src/open62541/include/open62541/
/src/open62541/src/client/../
/src/open62541/plugins/crypto/
/src/open62541/plugins/include/open62541/
/src/open62541/src/pubsub/