High level conclusions

Fuzzers reach 53.92% code coverage.

Fuzzers reach 52.96% of cyclomatic complexity.

Fuzzers reach 57.88% of all functions.

Fuzzer fuzz_client is blocked:

The runtime code coverage of fuzz_client covers 15.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3522 / 6084

Cyclomatic complexity statically reachable by fuzzers

14965 / 28254

Runtime code coverage of functions

3281 / 6084

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_base64_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	1
/src/open62541/deps/base64.c	2

Fuzzer: fuzz_mdns_xht

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	3.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	96.4%
All colors	28	100

Runtime coverage analysis

Covered functions

13

Functions that are reachable but not covered

6

Reachable functions

19

Percentage of reachable functions covered

68.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	1
/work/open62541/src_generated/mdnsd/sdtxt.c	5
/work/open62541/src_generated/mdnsd/xht.c	7

Fuzzer: fuzz_pubsub_connection_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	27.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	72.2%
All colors	36	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	9	UA_PubSubConnectionConfig_copy	call site: 00009	UA_String_copy
2	24	UA_PubSubConnectionConfig_clear	call site: 00024	UA_String_clear
1	14	UA_PubSubConnectionConfig_copy	call site: 00014	UA_copy
1	20	UA_Array_copy	call site: 00020	UA_Array_delete
1	22	UA_Array_delete	call site: 00022	UA_PubSubConnectionConfig_clear
1	29	UA_PubSubConnectionConfig_clear	call site: 00029	UA_clear
1	32	UA_PubSubConnectionConfig_clear	call site: 00032	UA_Array_delete

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

0

Reachable functions

19

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	1
/src/open62541/src/ua_types_encoding_binary.c	3
/src/open62541/src/ua_types.c	4
/src/open62541/src/pubsub/ua_pubsub_connection.c	2
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/pubsub/ua_pubsub_manager.c	2
/src/open62541/src/util/ua_util.c	2

Fuzzer: fuzz_src_ua_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	100.%
All colors	17	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

3

Reachable functions

13

Percentage of reachable functions covered

76.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	3
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_pubsub_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	9.09%
gold	[1:9]	1	1.51%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	3.03%
lawngreen	50+	57	86.3%
All colors	66	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	57	UA_DataSetMessage_clear	call site: 00057	UA_DataValue_clear
1	39	NetworkMessage_decodeJsonInternal	call site: 00039	decodeFieldsInternal
1	53	UA_NetworkMessage_decodeJson	call site: 00053	UA_Array_delete
1	60	UA_NetworkMessage_clear	call site: 00060	UA_clear
1	62	UA_NetworkMessage_clear	call site: 00062	UA_clear

Runtime coverage analysis

Covered functions

142

Functions that are reachable but not covered

3

Reachable functions

30

Percentage of reachable functions covered

90.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	2
/src/open62541/src/ua_types_encoding_json.c	7
/src/open62541/deps/cj5.c	7
/src/open62541/src/pubsub/../ua_types_encoding_json.h	2
/src/open62541/src/ua_types_encoding_json.h	2
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	2
/src/open62541/src/ua_types.c	2
/work/open62541/src_generated/open62541/types_generated.h	3

Fuzzer: fuzz_attributeoperand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	384	75.5%
gold	[1:9]	1	0.19%
yellow	[10:29]	8	1.57%
greenyellow	[30:49]	9	1.77%
lawngreen	50+	106	20.8%
All colors	508	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
151	248	UA_STRING	call site: 00248	buildEnumDefinitionFromProperties
105	98	stringOrder	call site: 00098	UA_Server_readBrowseName
40	207	UA_Array_delete	call site: 00207	UA_DataType_toDescription
39	58	lookupRefType	call site: 00058	UA_Server_browseRecursive
7	15	UA_String_unescape	call site: 00015	UA_NamespaceMapping_uri2Index
6	33	parse_nodeid_body	call site: 00033	UA_readNumberWithBase
5	417	nodeId_printEscape	call site: 00417	UA_String_escapedSize
5	481	UA_AttributeOperand_print	call site: 00481	UA_STRING
3	10	parse_nodeid	call site: 00010	UA_String_unescape
3	446	printRelativePath	call site: 00446	UA_STRING
2	204	UA_ByteString_allocBuffer	call site: 00204	UA_Variant_copyRange
2	403	parse_relativepathElement	call site: 00403	UA_RelativePathElement_clear

Runtime coverage analysis

Covered functions

83

Functions that are reachable but not covered

159

Reachable functions

229

Percentage of reachable functions covered

30.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/work/open62541/src_generated/open62541/types_generated.h	49
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/ua_types.c	58
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/src/util/ua_util.c	14
/src/open62541/deps/base64.c	2
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_pubsub_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	23	15.0%
gold	[1:9]	3	1.96%
yellow	[10:29]	6	3.92%
greenyellow	[30:49]	6	3.92%
lawngreen	50+	115	75.1%
All colors	153	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	104	stringOrder	call site: 00104	nodeIdOrder
5	96	UA_DataSetMessage_keyFrame_decodeBinary	call site: 00096	decodeRawField
1	102	guidOrder	call site: 00102	stringOrder
1	145	UA_DataSetMessage_clear	call site: 00145	UA_clear
1	147	UA_NetworkMessage_clear	call site: 00147	UA_clear
1	149	UA_NetworkMessage_clear	call site: 00149	UA_clear

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

7

Reachable functions

42

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	22
/src/open62541/src/pubsub/../util/ua_util_internal.h	3
/src/open62541/src/ua_types_encoding_binary.c	2
/src/open62541/src/ua_types.c	7
/work/open62541/src_generated/open62541/types_generated.h	4

Fuzzer: fuzz_datatype_description

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	40	27.0%
gold	[1:9]	7	4.72%
yellow	[10:29]	1	0.67%
greenyellow	[30:49]	1	0.67%
lawngreen	50+	99	66.8%
All colors	148	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	92	parse_qn	call site: 00092	UA_String_unescape
2	18	fromDescription	call site: 00018	UA_QualifiedName_printEx
2	23	reverse	call site: 00023	UA_ByteString_allocBuffer
2	105	parse_qn	call site: 00105	UA_QualifiedName_clear
2	124	UA_DataType_toStructureDescription	call site: 00124	UA_StructureDescription_clear
2	133	UA_DataType_toStructureDescription	call site: 00133	UA_StructureDescription_clear
2	140	UA_DataType_toSimpleTypeDescription	call site: 00140	UA_SimpleTypeDescription_clear
1	15	fromDescription	call site: 00015	UA_copy
1	30	UA_DataType_clear	call site: 00030	UA_clear
1	39	UA_DataType_fromEnumDescription	call site: 00039	UA_DataType_clear
1	50	UA_DataType_fromStructureDescription	call site: 00050	UA_DataType_clear
1	52	UA_DataType_fromStructureDescription	call site: 00052	UA_order

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

13

Reachable functions

75

Percentage of reachable functions covered

82.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_datatype_description.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	22
/src/open62541/src/ua_types_encoding_binary.c	3
/work/open62541/src_generated/open62541/types_generated.h	19
/src/open62541/src/ua_types_definition.c	11
/src/open62541/deps/itoa.c	3
/src/open62541/src/util/ua_util_internal.h	2
/src/open62541/src/util/ua_types_lex.c	4
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_config_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4401	23.4%
gold	[1:9]	80	0.42%
yellow	[10:29]	18	0.09%
greenyellow	[30:49]	2	0.01%
lawngreen	50+	14294	76.0%
All colors	18795	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1013	17262	initPubSubNS0	call site: 17262	addDataSetReaderConfig
804	16321	notifySubscription	call site: 16321	createServerConnection
187	16035	UA_Session_detachFromSecureChannel	call site: 16035	shutdownSecureChannel
184	1866	browseRecursive	call site: 01866	recordModelChangeEvent
179	1641	copyAttributeIntoNode	call site: 01641	UA_MonitoredItem_processSampledValue
138	18346	initPubSubNS0	call site: 18346	UA_Server_addPublishedDataSet
87	1149	Variant_clear	call site: 01149	UA_DataType_toDescription
80	2053	endModelChange	call site: 02053	UA_ModelChangeAccumulator_finalize
52	2150	deleteNodeOperation_inner	call site: 02150	deleteNodeSet
49	16252	UA_Subscription_delete	call site: 16252	deleteMonitoredItem
48	17144	UA_WebSocketProtocolManager_new	call site: 17144	createWebSocketServerConnection
39	1069	RefTree_clear	call site: 01069	readWithReadValue

Runtime coverage analysis

Covered functions

2312

Functions that are reachable but not covered

869

Reachable functions

3071

Percentage of reachable functions covered

71.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_config_json.cc	1
/src/open62541/plugins/ua_config_json.c	33
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	84
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	122
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	14
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/deps/cj5.c	10
/src/open62541/deps/utf8.h	1
/src/open62541/src/ua_types_encoding_json.c	13
/src/open62541/plugins/crypto/openssl/securitypolicy_basic128rsa15.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256sha256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes128sha256rsaoaep.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes256sha256rsapss.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256.c	2
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	10
/src/open62541/plugins/crypto/openssl/certificategroup.c	5
/usr/include/openssl/x509.h	6
/src/open62541/plugins/crypto/ua_filestore_common.c	1
/src/open62541/src/server/ua_server.c	14
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	48
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	23
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_msg_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3729	20.4%
gold	[1:9]	13421	73.5%
yellow	[10:29]	134	0.73%
greenyellow	[30:49]	44	0.24%
lawngreen	50+	909	4.98%
All colors	18237	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
932	16707	findSingleChildNode	call site: 16707	addDataSetReaderConfig
139	17734	initPubSubNS0	call site: 17734	UA_Server_addPublishedDataSet
130	1015	copyAttributeIntoNode	call site: 01015	UA_MonitoredItem_processSampledValue
110	15958	processSecureChannelMessage	call site: 15958	processOPN
106	1326	getNodeContext	call site: 01326	recordModelChangeEvent
87	522	Variant_clear	call site: 00522	UA_DataType_toDescription
80	1435	endModelChange	call site: 01435	UA_ModelChangeAccumulator_finalize
65	16340	selectEndpointAndTokenPolicy	call site: 16340	checkActivateSessionX509
62	1248	browseRecursive	call site: 01248	UA_Server_readBrowseName
51	16110	Service_CreateSession_inner	call site: 16110	validateCertificate
51	16649	initPubSubNS0	call site: 16649	addPubSubConnectionConfig
50	15704	notifySubscription	call site: 15704	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2581

Functions that are reachable but not covered

673

Reachable functions

3005

Percentage of reachable functions covered

77.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_msg_message.cc	8
/work/open62541/src_generated/open62541/types_generated.h	124
/src/open62541/src/ua_types.c	84
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	2
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	48
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	23
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	32
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_mdns_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	41.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.53%
lawngreen	50+	74	56.9%
All colors	130	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	73	_a_match	call site: 00073	_conflict
17	50	_r_next	call site: 00050	_r_send
6	37	mdnsd_in	call site: 00037	_is_local_ipv4
4	104	_cache	call site: 00104	_q_answer
3	95	mdnsd_in	call site: 00095	_conflict
2	122	_q_next	call site: 00122	_q_answer
2	127	mdnsd_free	call site: 00127	_free_record
1	33	inet_anyaddr	call site: 00033	htons
1	44	mdnsd_in	call site: 00044	vsyslog

Runtime coverage analysis

Covered functions

20

Functions that are reachable but not covered

33

Reachable functions

53

Percentage of reachable functions covered

37.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	1
/work/open62541/src_generated/mdnsd/1035.c	6
/work/open62541/src_generated/mdnsd/mdnsd.c	26
/work/open62541/src_generated/mdnsd/inet.c	3
/work/open62541/src_generated/mdnsd/log.c	1

Fuzzer: fuzz_client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1461	92.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	93	5.88%
greenyellow	[30:49]	19	1.20%
lawngreen	50+	6	0.37%
All colors	1579	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
587	547	UA_SecureChannel_clear	call site: 00547	__Client_networkCallback
307	1140	cleanupSession	call site: 01140	__Client_Subscriptions_backgroundPublish
162	362	UA_Array_delete	call site: 00362	__Client_Subscriptions_backgroundPublish
137	172	notifyClientState	call site: 00172	__UA_Client_startup
95	76	__Client_Service	call site: 00076	connectSync
74	1448	processServiceResponse	call site: 01448	connectActivity
50	311	UA_UNLOCK	call site: 00311	__Client_Subscriptions_backgroundPublish
23	38	setLocalCertificate_none	call site: 00038	UA_OpenSSL_LoadLocalCertificate
4	1569	UA_ClientConfig_clear	call site: 01569	UA_DataType_clear
3	538	UA_SecureChannel_deleteBuffered	call site: 00538	UA_Chunk_delete
3	543	UA_NamespaceMapping_delete	call site: 00543	UA_Array_delete
2	17	UA_ConnectionManager_new_POSIX_TCP	call site: 00017	UA_copy

Runtime coverage analysis

Covered functions

97

Functions that are reachable but not covered

391

Reachable functions

460

Percentage of reachable functions covered

15.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_client.cc	1
/src/open62541/tests/testing-plugins/test_helpers.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/plugins/ua_config_default.c	1
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	49
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	51
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	8
/src/open62541/src/client/ua_client.c	33
/src/open62541/src/ua_securechannel.c	32
/src/open62541/src/client/ua_client_connect.c	54
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/client/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/work/open62541/src_generated/open62541/transport_generated.h	4
/src/open62541/src/ua_securechannel_http.c	7
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/src/client/ua_client_subscriptions.c	29
/src/open62541/deps/ziptree.c	8
/src/open62541/src/util/ua_util.c	15
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	1
/src/open62541/src/client/ua_client_connect_http.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	2
/usr/include/openssl/asn1.h	1
/src/open62541/src/client/../ua_securechannel.h	3
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/client/ua_client_discovery.c	1
/usr/include/openssl/x509v3.h	3
/src/open62541/src/util/ua_encryptedsecret.c	8
/src/open62541/src/util/../ua_securechannel.h	1
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/cj5.c	7

Fuzzer: fuzz_binary_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	21.3%
gold	[1:9]	2	3.27%
yellow	[10:29]	1	1.63%
greenyellow	[30:49]	1	1.63%
lawngreen	50+	44	72.1%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	19	UA_encodeBinaryInternal	call site: 00019	exchangeBuffer
2	28	LLVMFuzzerTestOneInput	call site: 00028	UA_calcSizeBinary
2	31	UA_encodeBinary	call site: 00031	UA_ByteString_clear
1	26	UA_ByteString_allocBuffer	call site: 00026	UA_delete
1	49	copySubString	call site: 00049	UA_Variant_copyRange
1	53	UA_Variant_copyRange	call site: 00053	Variant_clear
1	56	UA_DataValue_copyRange	call site: 00056	Variant_clear
1	58	LLVMFuzzerTestOneInput	call site: 00058	UA_clear

Runtime coverage analysis

Covered functions

142

Functions that are reachable but not covered

3

Reachable functions

39

Percentage of reachable functions covered

92.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	17
/src/open62541/src/ua_types_encoding_binary.c	8
/src/open62541/src/util/ua_util_internal.h	2
/work/open62541/src_generated/open62541/types_generated.h	6

Fuzzer: fuzz_xml_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	8.82%
gold	[1:9]	1	0.73%
yellow	[10:29]	3	2.20%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	120	88.2%
All colors	136	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	123	LLVMFuzzerTestOneInput	call site: 00123
2	109	LLVMFuzzerTestOneInput	call site: 00109	UA_calcSizeXml
2	112	UA_encodeXml	call site: 00112	UA_ByteString_clear
2	117	LLVMFuzzerTestOneInput	call site: 00117
1	88	UA_decodeXml	call site: 00088	UA_STRING
1	104	LLVMFuzzerTestOneInput	call site: 00104	UA_clear
1	107	UA_ByteString_allocBuffer	call site: 00107

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

4

Reachable functions

59

Percentage of reachable functions covered

93.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_xml.c	9
/src/open62541/deps/yxml.c	34
/src/open62541/src/ua_types.c	4

Fuzzer: fuzz_json_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	4.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	96.0%
All colors	25	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear

Runtime coverage analysis

Covered functions

115

Functions that are reachable but not covered

0

Reachable functions

15

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	2
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	1

Fuzzer: fuzz_parse_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	371	66.1%
gold	[1:9]	3	0.53%
yellow	[10:29]	3	0.53%
greenyellow	[30:49]	2	0.35%
lawngreen	50+	182	32.4%
All colors	561	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
146	306	UA_STRING	call site: 00306	buildEnumDefinitionFromProperties
106	158	stringOrder	call site: 00158	UA_Server_readBrowseName
40	265	UA_Array_delete	call site: 00265	UA_DataType_toDescription
39	118	lookupRefType	call site: 00118	UA_Server_browseRecursive
7	12	UA_String_unescape	call site: 00012	UA_NamespaceMapping_uri2Index
4	7	parse_nodeid	call site: 00007	UA_String_unescape
3	483	nodeId_printEscape	call site: 00483	UA_String_escapedSize
3	496	nodeId_printEscape	call site: 00496	UA_String_escapeInsert
3	523	printRelativePath	call site: 00523	UA_String_clear
2	102	parse_qn	call site: 00102	UA_QualifiedName_clear
1	4	LLVMFuzzerTestOneInput	call site: 00004	UA_NodeId_parseEx
1	24	UA_readNumberWithBase	call site: 00024	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

150

Reachable functions

265

Percentage of reachable functions covered

43.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_parse_string.cc	1
/src/open62541/src/ua_types.c	58
/work/open62541/src_generated/open62541/types_generated.h	63
/src/open62541/src/util/ua_types_lex.c	21
/src/open62541/src/util/ua_util.c	13
/src/open62541/deps/base64.c	2
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/deps/parse_num.c	2
/src/open62541/deps/libc_time.c	3
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_base64_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	1
/src/open62541/deps/base64.c	1

Fuzzer: fuzz_json_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	20.0%
gold	[1:9]	1	1.81%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	78.1%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	29	LLVMFuzzerTestOneInput	call site: 00029	UA_calcSizeJson
3	42	LLVMFuzzerTestOneInput	call site: 00042
2	36	LLVMFuzzerTestOneInput	call site: 00036
1	24	LLVMFuzzerTestOneInput	call site: 00024	UA_clear
1	27	UA_ByteString_allocBuffer	call site: 00027

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

3

Reachable functions

25

Percentage of reachable functions covered

88.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	3

Fuzzer: fuzz_eventfilter_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	364	64.1%
gold	[1:9]	2	0.35%
yellow	[10:29]	1	0.17%
greenyellow	[30:49]	1	0.17%
lawngreen	50+	199	35.0%
All colors	567	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
107	347	UA_ExtensionObject_setValue	call site: 00347	buildEnumDefinitionFromProperties
106	156	stringOrder	call site: 00156	UA_Server_readBrowseName
39	116	lookupRefType	call site: 00116	UA_Server_browseRecursive
39	307	UA_QualifiedName_parseEx	call site: 00307	UA_DataType_toStructureDescription
14	266	Variant_clear	call site: 00266	readExternalValueAttribute
13	281	UA_Array_copy	call site: 00281	UA_findDataTypeWithCustom
11	295	UA_findDataTypeWithCustom	call site: 00295	UA_DataType_toDescription
7	45	UA_String_unescape	call site: 00045	UA_NamespaceMapping_uri2Index
4	40	parse_nodeid	call site: 00040	UA_String_unescape
2	263	UA_Array_delete	call site: 00263	Variant_clear
2	527	UA_Array_append	call site: 00527	UA_Array_delete
1	37	UA_EventFilter_lex	call site: 00037	UA_NodeId_parseEx

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

142

Reachable functions

265

Percentage of reachable functions covered

46.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	1
/src/open62541/src/ua_types.c	52
/work/open62541/src_generated/open62541/types_generated.h	58
/src/open62541/src/util/ua_eventfilter_grammar.c	14
/src/open62541/src/util/ua_eventfilter_lex.c	2
/src/open62541/src/util/ua_eventfilter_parser.c	14
/src/open62541/include/open62541/plugin/log.h	1
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/util/ua_types_lex.c	19
/src/open62541/src/util/ua_util.c	6
/src/open62541/deps/base64.c	1
/src/open62541/src/util/ua_util_internal.h	5
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/config.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	23
/src/open62541/src/server/ua_server_utils.c	2
/src/open62541/src/ua_types_definition.c	5

Fuzzer: fuzz_binary_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4124	22.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.01%
lawngreen	50+	14069	77.3%
All colors	18195	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	16648	initPubSubNS0	call site: 16648	addDataSetReaderConfig
514	15968	processHEL	call site: 15968	processMSG
187	1014	copyAttributeIntoNode	call site: 01014	UA_MonitoredItem_processSampledValue
184	1247	browseRecursive	call site: 01247	recordModelChangeEvent
139	17733	initPubSubNS0	call site: 17733	UA_Server_addPublishedDataSet
112	15834	extractCompleteChunk	call site: 15834	unpackPayloadMSG
98	15488	UA_SecureChannel_clear	call site: 15488	shutdownSecureChannel
87	521	Variant_clear	call site: 00521	UA_DataType_toDescription
80	1434	endModelChange	call site: 01434	UA_ModelChangeAccumulator_finalize
67	15703	notifySubscription	call site: 15703	UA_Session_remove
52	1531	deleteNodeOperation_inner	call site: 01531	deleteNodeSet
49	15634	UA_Subscription_delete	call site: 15634	deleteMonitoredItem

Runtime coverage analysis

Covered functions

2288

Functions that are reachable but not covered

805

Reachable functions

2978

Percentage of reachable functions covered

72.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_message.cc	1
/work/open62541/src_generated/open62541/types_generated.h	121
/src/open62541/src/ua_types.c	84
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	14
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	48
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	23
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_certificate_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	40	41.6%
gold	[1:9]	17	17.7%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	5.20%
lawngreen	50+	34	35.4%
All colors	96	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	77	UA_CertificateUtils_verifyApplicationUri	call site: 00077	UA_String_clear
11	42	LLVMFuzzerTestOneInput	call site: 00042	UA_OpenSSL_LoadCertificate
5	9	UA_OpenSSL_LoadPemCertificate	call site: 00009	X509_get_pubkey
2	62	UA_CertificateUtils_getKeySize	call site: 00062	EVP_PKEY_free
1	4	UA_OpenSSL_LoadCertificate	call site: 00004	d2i_X509
1	17	UA_OpenSSL_LoadCrl	call site: 00017	d2i_X509_CRL
1	27	UA_CertificateUtils_getSubjectName	call site: 00027	UA_copy
1	32	LLVMFuzzerTestOneInput	call site: 00032	UA_clear

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

36

Reachable functions

60

Percentage of reachable functions covered

40.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/crypto/openssl/certificategroup.c	7
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	6
/src/open62541/src/ua_types.c	3
/work/open62541/src_generated/open62541/types_generated.h	3
/src/open62541/deps/libc_time.c	3
/usr/include/openssl/x509v3.h	3

Fuzzer: fuzz_server_services

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4303	23.1%
gold	[1:9]	85	0.45%
yellow	[10:29]	43	0.23%
greenyellow	[30:49]	28	0.15%
lawngreen	50+	14133	76.0%
All colors	18592	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	16645	initPubSubNS0	call site: 16645	addDataSetReaderConfig
260	15830	ctxClear	call site: 15830	processSecureChannelMessage
184	1244	browseRecursive	call site: 01244	recordModelChangeEvent
156	1011	copyAttributeIntoNode	call site: 01011	UA_MonitoredItem_processSampledValue
139	17730	initPubSubNS0	call site: 17730	UA_Server_addPublishedDataSet
120	16324	Service_ActivateSession_inner	call site: 16324	UA_Session_attachToSecureChannel
119	16095	findSessionByToken	call site: 16095	processServiceInternal
116	15485	UA_SecureChannel_clear	call site: 15485	shutdownSecureChannel
87	518	Variant_clear	call site: 00518	UA_DataType_toDescription
81	18439	Service_CreateMonitoredItems	call site: 18439	Operation_CreateMonitoredItem
80	1431	endModelChange	call site: 01431	UA_ModelChangeAccumulator_finalize
67	15761	auditSecurityEvent	call site: 15761	UA_Session_remove

Runtime coverage analysis

Covered functions

2408

Functions that are reachable but not covered

810

Reachable functions

3143

Percentage of reachable functions covered

74.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_server_services.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	88
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	180
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	12
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	44
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	48
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	8
/src/open62541/src/server/ua_subscription_event.c	14
/src/open62541/src/server/ua_server_auditing.c	15
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	13
/src/open62541/src/server/ua_services_subscription.c	9
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	7
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	21
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	2
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_process_request

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3891	21.3%
gold	[1:9]	7	0.03%
yellow	[10:29]	15	0.08%
greenyellow	[30:49]	1	0.00%
lawngreen	50+	14307	78.5%
All colors	18221	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
932	16703	findSingleChildNode	call site: 16703	addDataSetReaderConfig
252	15830	ctxClear	call site: 15830	processSecureChannelMessage
139	17730	initPubSubNS0	call site: 17730	UA_Server_addPublishedDataSet
130	1011	copyAttributeIntoNode	call site: 01011	UA_MonitoredItem_processSampledValue
106	1322	getNodeContext	call site: 01322	recordModelChangeEvent
87	518	Variant_clear	call site: 00518	UA_DataType_toDescription
81	15485	UA_SecureChannel_clear	call site: 15485	sendServiceMessage
80	1431	endModelChange	call site: 01431	UA_ModelChangeAccumulator_finalize
65	16336	selectEndpointAndTokenPolicy	call site: 16336	checkActivateSessionX509
62	1244	browseRecursive	call site: 01244	UA_Server_readBrowseName
51	16106	Service_CreateSession_inner	call site: 16106	validateCertificate
51	16645	initPubSubNS0	call site: 16645	addPubSubConnectionConfig

Runtime coverage analysis

Covered functions

2474

Functions that are reachable but not covered

715

Reachable functions

2985

Percentage of reachable functions covered

76.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_process_request.cc	2
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	84
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	121
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	48
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	23
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	32
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_tcp_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4156	22.6%
gold	[1:9]	13	0.07%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.01%
lawngreen	50+	14160	77.2%
All colors	18331	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	16646	initPubSubNS0	call site: 16646	addDataSetReaderConfig
279	16204	UA_KeyValueMap_setScalar	call site: 16204	Service_ActivateSession
236	15966	processHEL	call site: 15966	processMSG
139	17731	initPubSubNS0	call site: 17731	UA_Server_addPublishedDataSet
130	1012	copyAttributeIntoNode	call site: 01012	UA_MonitoredItem_processSampledValue
121	1308	UA_KeyValueMap_clear	call site: 01308	recordModelChangeEvent
112	15832	extractCompleteChunk	call site: 15832	unpackPayloadMSG
98	15486	UA_SecureChannel_clear	call site: 15486	shutdownSecureChannel
80	1432	endModelChange	call site: 01432	UA_ModelChangeAccumulator_finalize
67	15701	notifySubscription	call site: 15701	UA_Session_remove
62	1245	browseRecursive	call site: 01245	UA_Server_readBrowseName
60	546	UA_findDataTypeWithCustom	call site: 00546	UA_DataType_toDescription

Runtime coverage analysis

Covered functions

2404

Functions that are reachable but not covered

801

Reachable functions

3010

Percentage of reachable functions covered

73.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	2
/src/open62541/tests/fuzz/custom_memory_manager.c	2
/src/open62541/plugins/include/open62541/server_config_default.h	1
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	84
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	119
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	28
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	19
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	48
/src/open62541/src/server/ua_server_utils.c	19
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	10
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	11
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	2
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_opn_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4010	22.0%
gold	[1:9]	13427	73.7%
yellow	[10:29]	101	0.55%
greenyellow	[30:49]	45	0.24%
lawngreen	50+	634	3.48%
All colors	18217	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	16648	initPubSubNS0	call site: 16648	addDataSetReaderConfig
195	16287	policyUriContains	call site: 16287	Service_ActivateSession
187	1014	copyAttributeIntoNode	call site: 01014	UA_MonitoredItem_processSampledValue
184	1247	browseRecursive	call site: 01247	recordModelChangeEvent
139	17733	initPubSubNS0	call site: 17733	UA_Server_addPublishedDataSet
119	16065	processOPN	call site: 16065	processMSG
99	16186	UA_SecurityPolicy_isEnhancedSecurity	call site: 16186	UA_Session_remove
98	15488	UA_SecureChannel_clear	call site: 15488	shutdownSecureChannel
87	521	Variant_clear	call site: 00521	UA_DataType_toDescription
80	1434	endModelChange	call site: 01434	UA_ModelChangeAccumulator_finalize
64	15882	unpackPayloadOPN	call site: 15882	unpackPayloadMSG
60	15703	notifySubscription	call site: 15703	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2356

Functions that are reachable but not covered

776

Reachable functions

2993

Percentage of reachable functions covered

74.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_opn_message.cc	9
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/config.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	84
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	120
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	28
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/src/server/ua_server.c	14
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	16
/src/open62541/src/server/ua_server_ns0.c	14
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	48
/src/open62541/src/server/ua_server_utils.c	18
/src/open62541/src/ua_types_definition.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	23
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	6
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../util/ua_util_internal.h	6
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
UA_Server_loadNodeset	/src/open62541/src/util/nodeset_loader/ua_nodeset_loader.c	3	['N/A', 'size_t', 'N/A']	53	0	116	20	8	705	0	4614	741
moveOrCopyMethodCallback	/src/open62541/drivers/file_transfer/file_transfer_directory.c	11	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'N/A']	68	0	853	138	55	659	0	3927	601
MdnsdDriver_start	/src/open62541/drivers/discovery_mdns_mdnsd.c	1	['N/A']	13	0	472	65	24	245	0	1441	528

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3802 / 6084

Cyclomatic complexity statically reachable by fuzzers

16817 / 28254

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/open62541/tests/fuzz/fuzz_base64_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_mdns_xht.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_PubSubConnectionConfig_copy', 'UA_PubSubConnectionConfig_clear', 'UA_Array_copy', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_src_ua_util.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_pubsub_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_DataSetMessage_clear', 'NetworkMessage_decodeJsonInternal', 'UA_NetworkMessage_decodeJson', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_attributeoperand.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid_body', 'nodeId_printEscape', 'UA_AttributeOperand_print', 'parse_nodeid', 'printRelativePath']

/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'UA_DataSetMessage_keyFrame_decodeBinary', 'guidOrder', 'UA_DataSetMessage_clear', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_datatype_description.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse_qn', 'fromDescription', 'reverse', 'UA_DataType_toStructureDescription', 'UA_DataType_toSimpleTypeDescription', 'UA_DataType_clear', 'UA_DataType_fromEnumDescription']

/src/open62541/tests/fuzz/fuzz_config_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'notifySubscription', 'UA_Session_detachFromSecureChannel', 'browseRecursive', 'copyAttributeIntoNode', 'Variant_clear', 'endModelChange', 'deleteNodeOperation_inner', 'UA_Subscription_delete']

/src/open62541/tests/fuzz/fuzz_msg_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['findSingleChildNode', 'initPubSubNS0', 'copyAttributeIntoNode', 'processSecureChannelMessage', 'getNodeContext', 'Variant_clear', 'endModelChange', 'selectEndpointAndTokenPolicy', 'browseRecursive', 'Service_CreateSession_inner']

/src/open62541/tests/fuzz/fuzz_mdns_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_a_match', '_r_next', 'mdnsd_in', '_cache', '_q_next', 'mdnsd_free', 'inet_anyaddr']

/src/open62541/tests/fuzz/fuzz_client.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_SecureChannel_clear', 'cleanupSession', 'UA_Array_delete', 'notifyClientState', '__Client_Service', 'processServiceResponse', 'UA_UNLOCK', 'setLocalCertificate_none', 'UA_ClientConfig_clear', 'UA_SecureChannel_deleteBuffered']

/src/open62541/tests/fuzz/fuzz_binary_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'LLVMFuzzerTestOneInput', 'UA_encodeBinary', 'UA_ByteString_allocBuffer', 'copySubString', 'UA_Variant_copyRange', 'UA_DataValue_copyRange']

/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_encodeXml', 'UA_decodeXml', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_json_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

/src/open62541/tests/fuzz/fuzz_parse_string.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid', 'nodeId_printEscape', 'printRelativePath', 'parse_qn']

/src/open62541/tests/fuzz/fuzz_base64_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_ExtensionObject_setValue', 'stringOrder', 'lookupRefType', 'UA_QualifiedName_parseEx', 'Variant_clear', 'UA_Array_copy', 'UA_findDataTypeWithCustom', 'UA_String_unescape', 'parse_nodeid', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_binary_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'processHEL', 'copyAttributeIntoNode', 'browseRecursive', 'extractCompleteChunk', 'UA_SecureChannel_clear', 'Variant_clear', 'endModelChange', 'notifySubscription']

/src/open62541/tests/fuzz/fuzz_certificate_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_CertificateUtils_verifyApplicationUri', 'LLVMFuzzerTestOneInput', 'UA_OpenSSL_LoadPemCertificate', 'UA_CertificateUtils_getKeySize', 'UA_OpenSSL_LoadCertificate', 'UA_OpenSSL_LoadCrl', 'UA_CertificateUtils_getSubjectName']

/src/open62541/tests/fuzz/fuzz_server_services.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'ctxClear', 'browseRecursive', 'copyAttributeIntoNode', 'Service_ActivateSession_inner', 'findSessionByToken', 'UA_SecureChannel_clear', 'Variant_clear', 'Service_CreateMonitoredItems']

/src/open62541/tests/fuzz/fuzz_process_request.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['findSingleChildNode', 'ctxClear', 'initPubSubNS0', 'copyAttributeIntoNode', 'getNodeContext', 'Variant_clear', 'UA_SecureChannel_clear', 'endModelChange', 'selectEndpointAndTokenPolicy', 'browseRecursive']

/src/open62541/tests/fuzz/fuzz_tcp_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_KeyValueMap_setScalar', 'processHEL', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'extractCompleteChunk', 'UA_SecureChannel_clear', 'endModelChange', 'notifySubscription']

/src/open62541/tests/fuzz/fuzz_opn_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'policyUriContains', 'copyAttributeIntoNode', 'browseRecursive', 'processOPN', 'UA_SecurityPolicy_isEnhancedSecurity', 'UA_SecureChannel_clear', 'Variant_clear', 'endModelChange']