High level conclusions

Fuzzers reach 53.93% code coverage.

Fuzzers reach 61.13% of cyclomatic complexity.

Fuzzers reach 57.85% of all functions.

Fuzzer fuzz_client is blocked:

The runtime code coverage of fuzz_client covers 14.98% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

3552 / 6139

Cyclomatic complexity statically reachable by fuzzers

21296 / 34836

Runtime code coverage of functions

3311 / 6139

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz_mdns_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	41.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	1.53%
lawngreen	50+	74	56.9%
All colors	130	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	73	_a_match	call site: 00073	_conflict
17	50	_r_next	call site: 00050	_r_send
6	37	mdnsd_in	call site: 00037	_is_local_ipv4
4	104	_cache	call site: 00104	_q_answer
3	95	mdnsd_in	call site: 00095	_conflict
2	122	_q_next	call site: 00122	_q_answer
2	127	mdnsd_free	call site: 00127	_free_record
1	33	inet_anyaddr	call site: 00033	htons
1	44	mdnsd_in	call site: 00044	vsyslog

Runtime coverage analysis

Covered functions

20

Functions that are reachable but not covered

33

Reachable functions

53

Percentage of reachable functions covered

37.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_message.cc	1
/work/open62541/src_generated/mdnsd/1035.c	6
/work/open62541/src_generated/mdnsd/mdnsd.c	26
/work/open62541/src_generated/mdnsd/inet.c	3
/work/open62541/src_generated/mdnsd/log.c	1

Fuzzer: fuzz_client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1483	92.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	95	5.92%
greenyellow	[30:49]	20	1.24%
lawngreen	50+	6	0.37%
All colors	1604	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
593	553	UA_SecureChannel_clear	call site: 00553	__Client_networkCallback
311	1152	cleanupSession	call site: 01152	__Client_Subscriptions_backgroundPublish
165	365	UA_Array_delete	call site: 00365	__Client_Subscriptions_backgroundPublish
139	172	notifyClientState	call site: 00172	__UA_Client_startup
95	76	__Client_Service	call site: 00076	connectSync
80	1464	processServiceResponse	call site: 01464	connectActivity
51	313	UA_UNLOCK	call site: 00313	__Client_Subscriptions_backgroundPublish
23	38	setLocalCertificate_none	call site: 00038	UA_OpenSSL_LoadLocalCertificate
4	1594	UA_ClientConfig_clear	call site: 01594	UA_DataType_clear
3	544	UA_SecureChannel_deleteBuffered	call site: 00544	UA_Chunk_delete
3	549	UA_NamespaceMapping_delete	call site: 00549	UA_Array_delete
2	17	UA_ConnectionManager_new_POSIX_TCP	call site: 00017	UA_copy

Runtime coverage analysis

Covered functions

98

Functions that are reachable but not covered

397

Reachable functions

467

Percentage of reachable functions covered

14.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_client.cc	1
/src/open62541/tests/testing-plugins/test_helpers.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/plugins/ua_config_default.c	1
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/arch/posix.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	49
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	51
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	8
/src/open62541/src/client/ua_client.c	34
/src/open62541/src/ua_securechannel.c	32
/src/open62541/src/client/ua_client_connect.c	58
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/client/../util/ua_util_internal.h	3
/work/open62541/src_generated/open62541/statuscodes.c	1
/work/open62541/src_generated/open62541/transport_generated.h	4
/src/open62541/src/ua_securechannel_http.c	7
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/src/client/ua_client_subscriptions.c	30
/src/open62541/deps/ziptree.c	8
/src/open62541/src/util/ua_util.c	15
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	1
/src/open62541/src/client/ua_client_connect_http.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	2
/usr/include/openssl/asn1.h	1
/src/open62541/src/client/../ua_securechannel.h	3
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/client/ua_client_discovery.c	1
/usr/include/openssl/x509v3.h	3
/src/open62541/src/util/ua_encryptedsecret.c	8
/src/open62541/src/util/../ua_securechannel.h	1
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/cj5.c	7

Fuzzer: fuzz_parse_string

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	403	67.9%
gold	[1:9]	3	0.50%
yellow	[10:29]	4	0.67%
greenyellow	[30:49]	2	0.33%
lawngreen	50+	181	30.5%
All colors	593	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
176	308	UA_STRING	call site: 00308	buildEnumDefinitionFromProperties
108	158	stringOrder	call site: 00158	UA_Server_readBrowseName
40	267	UA_Array_delete	call site: 00267	UA_DataType_toDescription
39	118	lookupRefType	call site: 00118	UA_Server_browseRecursive
7	12	UA_String_unescape	call site: 00012	UA_NamespaceMapping_uri2Index
4	7	parse_nodeid	call site: 00007	UA_String_unescape
3	515	nodeId_printEscape	call site: 00515	UA_String_escapedSize
3	528	nodeId_printEscape	call site: 00528	UA_String_escapeInsert
3	555	printRelativePath	call site: 00555	UA_String_clear
2	519	UA_String_escapedSize	call site: 00519	isReservedPercentExtended
1	4	LLVMFuzzerTestOneInput	call site: 00004	UA_NodeId_parseEx
1	24	UA_readNumberWithBase	call site: 00024	UA_NamespaceMapping_remote2Local

Runtime coverage analysis

Covered functions

108

Functions that are reachable but not covered

155

Reachable functions

270

Percentage of reachable functions covered

42.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_parse_string.cc	1
/src/open62541/src/ua_types.c	58
/work/open62541/src_generated/open62541/types_generated.h	63
/src/open62541/src/util/ua_types_lex.c	21
/src/open62541/src/util/ua_util.c	13
/src/open62541/deps/base64.c	2
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/deps/parse_num.c	2
/src/open62541/deps/libc_time.c	3
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/arch/posix.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	26
/src/open62541/src/server/ua_server_utils.c	4
/src/open62541/src/ua_types_description.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_attributeoperand

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	406	75.3%
gold	[1:9]	3	0.55%
yellow	[10:29]	7	1.29%
greenyellow	[30:49]	3	0.55%
lawngreen	50+	120	22.2%
All colors	539	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
181	250	UA_STRING	call site: 00250	buildEnumDefinitionFromProperties
105	100	nodeIdOrder	call site: 00100	UA_Server_readBrowseName
40	209	UA_Array_delete	call site: 00209	UA_DataType_toDescription
28	69	guidOrder	call site: 00069	browseRecursive
10	58	lookupRefType	call site: 00058	UA_Server_browseRecursive
7	15	UA_String_unescape	call site: 00015	UA_NamespaceMapping_uri2Index
5	449	nodeId_printEscape	call site: 00449	UA_String_escapedSize
5	512	UA_AttributeOperand_print	call site: 00512	UA_STRING
3	10	parse_nodeid	call site: 00010	UA_String_unescape
3	477	printRelativePath	call site: 00477	UA_STRING
2	206	UA_ByteString_allocBuffer	call site: 00206	UA_Variant_copyRange
2	465	UA_String_escapeInsert	call site: 00465	isReservedAndExtended

Runtime coverage analysis

Covered functions

85

Functions that are reachable but not covered

162

Reachable functions

234

Percentage of reachable functions covered

30.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_attributeoperand.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/work/open62541/src_generated/open62541/types_generated.h	49
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/ua_types.c	58
/src/open62541/src/util/ua_util_internal.h	6
/src/open62541/src/util/ua_util.c	14
/src/open62541/deps/base64.c	2
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/arch/posix.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	26
/src/open62541/src/server/ua_server_utils.c	4
/src/open62541/src/ua_types_description.c	5
/src/open62541/deps/itoa.c	3

Fuzzer: fuzz_json_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	11	20.0%
gold	[1:9]	1	1.81%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	78.1%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	29	LLVMFuzzerTestOneInput	call site: 00029	UA_calcSizeJson
3	42	LLVMFuzzerTestOneInput	call site: 00042
2	36	LLVMFuzzerTestOneInput	call site: 00036
1	24	LLVMFuzzerTestOneInput	call site: 00024	UA_clear
1	27	UA_ByteString_allocBuffer	call site: 00027

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

3

Reachable functions

25

Percentage of reachable functions covered

88.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_json.c	4
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	3

Fuzzer: fuzz_base64_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	2	100.%
All colors	2	100

Runtime coverage analysis

Covered functions

2

Functions that are reachable but not covered

0

Reachable functions

2

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_decode.cc	1
/src/open62541/deps/base64.c	1

Fuzzer: fuzz_server_services

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10041	35.6%
gold	[1:9]	90	0.31%
yellow	[10:29]	41	0.14%
greenyellow	[30:49]	23	0.08%
lawngreen	50+	17986	63.8%
All colors	28181	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	26185	initPubSubNS0	call site: 26185	addDataSetReaderConfig
260	25335	ctxClear	call site: 25335	processSecureChannelMessage
184	1275	browseRecursive	call site: 01275	recordModelChangeEvent
157	1041	copyAttributeIntoNode	call site: 01041	UA_MonitoredItem_processSampledValue
148	25839	Service_ActivateSession_inner	call site: 25839	UA_Session_attachToSecureChannel
136	27270	initPubSubNS0	call site: 27270	UA_Server_addPublishedDataSet
128	25600	findSessionByToken	call site: 25600	processServiceInternal
117	24989	UA_SecureChannel_clear	call site: 24989	shutdownSecureChannel
83	1462	endModelChange	call site: 01462	UA_ModelChangeAccumulator_finalize
81	28028	Service_CreateMonitoredItems	call site: 28028	Operation_CreateMonitoredItem
70	27765	process_RegisterServer	call site: 27765	addServerOnNetwork
68	25265	auditSecurityEvent	call site: 25265	UA_Session_remove

Runtime coverage analysis

Covered functions

2413

Functions that are reachable but not covered

827

Reachable functions

3165

Percentage of reachable functions covered

73.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_server_services.cc	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/arch/posix.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	89
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	182
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	12
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	44
/src/open62541/src/server/ua_server_async.c	18
/src/open62541/src/server/ua_server_ns0.c	15
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	51
/src/open62541/src/server/ua_server_utils.c	20
/src/open62541/src/ua_types_description.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	8
/src/open62541/src/server/ua_subscription_event.c	14
/src/open62541/src/server/ua_server_auditing.c	15
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	25
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	8
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	13
/src/open62541/src/server/ua_services_subscription.c	9
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	7
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	28
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	2
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../server/../util/ua_util_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/../util/ua_util_internal.h	5
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_tcp_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9861	35.3%
gold	[1:9]	13	0.04%
yellow	[10:29]	10	0.03%
greenyellow	[30:49]	18	0.06%
lawngreen	50+	18001	64.5%
All colors	27903	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	26186	initPubSubNS0	call site: 26186	addDataSetReaderConfig
309	25717	UA_KeyValueMap_setScalar	call site: 25717	Service_ActivateSession
242	25473	processHEL	call site: 25473	processMSG
136	27271	initPubSubNS0	call site: 27271	UA_Server_addPublishedDataSet
131	1042	copyAttributeIntoNode	call site: 01042	UA_MonitoredItem_processSampledValue
121	1339	UA_KeyValueMap_clear	call site: 01339	recordModelChangeEvent
113	25337	extractCompleteChunk	call site: 25337	unpackPayloadMSG
99	24990	UA_SecureChannel_clear	call site: 24990	shutdownSecureChannel
83	1463	endModelChange	call site: 01463	UA_ModelChangeAccumulator_finalize
66	548	UA_findDataTypeWithCustom	call site: 00548	UA_DataType_toDescription
66	25206	notifySubscription	call site: 25206	UA_Session_remove
62	1276	browseRecursive	call site: 01276	UA_Server_readBrowseName

Runtime coverage analysis

Covered functions

2418

Functions that are reachable but not covered

808

Reachable functions

3032

Percentage of reachable functions covered

73.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_tcp_message.cc	2
/src/open62541/tests/fuzz/custom_memory_manager.c	2
/src/open62541/plugins/include/open62541/server_config_default.h	1
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/arch/posix.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	85
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	120
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	28
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	20
/src/open62541/src/server/ua_server_ns0.c	17
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	51
/src/open62541/src/server/ua_server_utils.c	21
/src/open62541/src/ua_types_description.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	25
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	10
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	16
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	2
/src/open62541/src/server/ua_server_discovery.c	2
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../server/../util/ua_util_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/../util/ua_util_internal.h	5
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_mdns_xht

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	3.57%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	27	96.4%
All colors	28	100

Runtime coverage analysis

Covered functions

13

Functions that are reachable but not covered

6

Reachable functions

19

Percentage of reachable functions covered

68.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_mdns_xht.cc	1
/work/open62541/src_generated/mdnsd/sdtxt.c	5
/work/open62541/src_generated/mdnsd/xht.c	7

Fuzzer: fuzz_process_request

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9560	34.4%
gold	[1:9]	7	0.02%
yellow	[10:29]	10	0.03%
greenyellow	[30:49]	5	0.01%
lawngreen	50+	18179	65.4%
All colors	27761	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
930	26246	findSingleChildNode	call site: 26246	addDataSetReaderConfig
252	25335	ctxClear	call site: 25335	processSecureChannelMessage
136	27270	initPubSubNS0	call site: 27270	UA_Server_addPublishedDataSet
131	1041	copyAttributeIntoNode	call site: 01041	UA_MonitoredItem_processSampledValue
106	1353	getNodeContext	call site: 01353	recordModelChangeEvent
83	1462	endModelChange	call site: 01462	UA_ModelChangeAccumulator_finalize
81	24989	UA_SecureChannel_clear	call site: 24989	sendServiceMessage
66	547	UA_findDataTypeWithCustom	call site: 00547	UA_DataType_toDescription
62	1275	browseRecursive	call site: 01275	UA_Server_readBrowseName
61	25864	Service_ActivateSession_inner	call site: 25864	checkActivateSessionX509
54	26185	initPubSubNS0	call site: 26185	addPubSubConnectionConfig
51	25614	Service_CreateSession_inner	call site: 25614	validateCertificate

Runtime coverage analysis

Covered functions

2483

Functions that are reachable but not covered

720

Reachable functions

2998

Percentage of reachable functions covered

75.98%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_process_request.cc	2
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/arch/posix.h	7
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	85
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	121
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	15
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	51
/src/open62541/src/server/ua_server_utils.c	20
/src/open62541/src/ua_types_description.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	32
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../server/../util/ua_util_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/../util/ua_util_internal.h	5
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_msg_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9347	33.6%
gold	[1:9]	17269	62.1%
yellow	[10:29]	136	0.48%
greenyellow	[30:49]	46	0.16%
lawngreen	50+	979	3.52%
All colors	27777	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
930	26250	findSingleChildNode	call site: 26250	addDataSetReaderConfig
136	27274	initPubSubNS0	call site: 27274	UA_Server_addPublishedDataSet
131	1045	copyAttributeIntoNode	call site: 01045	UA_MonitoredItem_processSampledValue
108	25465	processSecureChannelMessage	call site: 25465	processOPN
106	1357	getNodeContext	call site: 01357	recordModelChangeEvent
66	551	UA_findDataTypeWithCustom	call site: 00551	UA_DataType_toDescription
62	1279	browseRecursive	call site: 01279	UA_Server_readBrowseName
61	25868	Service_ActivateSession_inner	call site: 25868	checkActivateSessionX509
54	26189	initPubSubNS0	call site: 26189	addPubSubConnectionConfig
51	25618	Service_CreateSession_inner	call site: 25618	validateCertificate
49	25140	UA_Subscription_delete	call site: 25140	deleteMonitoredItem
49	25209	notifySubscription	call site: 25209	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2613

Functions that are reachable but not covered

664

Reachable functions

3018

Percentage of reachable functions covered

78.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_msg_message.cc	8
/work/open62541/src_generated/open62541/types_generated.h	124
/src/open62541/src/ua_types.c	85
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/arch/posix.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	2
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	11
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/src/server/ua_server.c	15
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	15
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	51
/src/open62541/src/server/ua_server_utils.c	20
/src/open62541/src/ua_types_description.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	32
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../server/../util/ua_util_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/../util/ua_util_internal.h	5
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_certificate_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	40	41.6%
gold	[1:9]	16	16.6%
yellow	[10:29]	1	1.04%
greenyellow	[30:49]	5	5.20%
lawngreen	50+	34	35.4%
All colors	96	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
18	77	UA_CertificateUtils_verifyApplicationUri	call site: 00077	UA_String_clear
11	42	LLVMFuzzerTestOneInput	call site: 00042	UA_OpenSSL_LoadCertificate
5	9	UA_OpenSSL_LoadPemCertificate	call site: 00009	X509_get_pubkey
2	62	UA_CertificateUtils_getKeySize	call site: 00062	EVP_PKEY_free
1	4	UA_OpenSSL_LoadCertificate	call site: 00004	d2i_X509
1	17	UA_OpenSSL_LoadCrl	call site: 00017	d2i_X509_CRL
1	27	UA_CertificateUtils_getSubjectName	call site: 00027	UA_copy
1	32	LLVMFuzzerTestOneInput	call site: 00032	UA_clear

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

36

Reachable functions

60

Percentage of reachable functions covered

40.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_certificate_parse.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/crypto/openssl/certificategroup.c	7
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	6
/src/open62541/src/ua_types.c	3
/work/open62541/src_generated/open62541/types_generated.h	3
/src/open62541/deps/libc_time.c	3
/usr/include/openssl/x509v3.h	3

Fuzzer: fuzz_config_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10088	35.6%
gold	[1:9]	75	0.26%
yellow	[10:29]	12	0.04%
greenyellow	[30:49]	7	0.02%
lawngreen	50+	18152	64.0%
All colors	28334	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	26800	initPubSubNS0	call site: 26800	addDataSetReaderConfig
841	25824	notifySubscription	call site: 25824	createServerConnection
189	25536	UA_Session_detachFromSecureChannel	call site: 25536	shutdownSecureChannel
184	1899	browseRecursive	call site: 01899	recordModelChangeEvent
180	1673	copyAttributeIntoNode	call site: 01673	UA_MonitoredItem_processSampledValue
136	27885	initPubSubNS0	call site: 27885	UA_Server_addPublishedDataSet
83	2086	endModelChange	call site: 02086	UA_ModelChangeAccumulator_finalize
65	1181	UA_findDataTypeWithCustom	call site: 01181	UA_DataType_toDescription
52	2186	deleteNodeOperation_inner	call site: 02186	deleteNodeSet
49	25755	UA_Subscription_delete	call site: 25755	deleteMonitoredItem
48	26684	UA_WebSocketProtocolManager_new	call site: 26684	createWebSocketServerConnection
39	1072	RefTree_clear	call site: 01072	readWithReadValue

Runtime coverage analysis

Covered functions

2317

Functions that are reachable but not covered

877

Reachable functions

3084

Percentage of reachable functions covered

71.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_config_json.cc	1
/src/open62541/plugins/ua_config_json.c	33
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/arch/posix.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	85
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	122
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	32
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	14
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/deps/cj5.c	10
/src/open62541/deps/utf8.h	1
/src/open62541/src/ua_types_encoding_json.c	13
/src/open62541/plugins/crypto/openssl/securitypolicy_basic128rsa15.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_basic256sha256.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes128sha256rsaoaep.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_aes256sha256rsapss.c	1
/src/open62541/plugins/crypto/openssl/securitypolicy_eccnistp256.c	2
/src/open62541/plugins/crypto/ua_certificategroup_filestore.c	10
/src/open62541/plugins/crypto/openssl/certificategroup.c	5
/usr/include/openssl/x509.h	6
/src/open62541/plugins/crypto/ua_filestore_common.c	1
/src/open62541/src/server/ua_server.c	14
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	15
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	51
/src/open62541/src/server/ua_server_utils.c	20
/src/open62541/src/ua_types_description.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../server/../util/ua_util_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/../util/ua_util_internal.h	5
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4

Fuzzer: fuzz_pubsub_binary

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	23	15.0%
gold	[1:9]	5	3.26%
yellow	[10:29]	5	3.26%
greenyellow	[30:49]	6	3.92%
lawngreen	50+	114	74.5%
All colors	153	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	104	stringOrder	call site: 00104	nodeIdOrder
5	96	UA_DataSetMessage_keyFrame_decodeBinary	call site: 00096	decodeRawField
1	102	guidOrder	call site: 00102	stringOrder
1	145	UA_DataSetMessage_clear	call site: 00145	UA_clear
1	147	UA_NetworkMessage_clear	call site: 00147	UA_clear
1	149	UA_NetworkMessage_clear	call site: 00149	UA_clear

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

7

Reachable functions

42

Percentage of reachable functions covered

83.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	22
/src/open62541/src/pubsub/../util/ua_util_internal.h	3
/src/open62541/src/ua_types_encoding_binary.c	2
/src/open62541/src/ua_types.c	7
/work/open62541/src_generated/open62541/types_generated.h	4

Fuzzer: fuzz_json_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	4.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	24	96.0%
All colors	25	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1	23	LLVMFuzzerTestOneInput	call site: 00023	UA_clear

Runtime coverage analysis

Covered functions

116

Functions that are reachable but not covered

0

Reachable functions

15

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_json_decode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	2
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/ua_types.c	1

Fuzzer: fuzz_datatype_description

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	34	21.9%
gold	[1:9]	15	9.67%
yellow	[10:29]	2	1.29%
greenyellow	[30:49]	3	1.93%
lawngreen	50+	101	65.1%
All colors	155	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	95	parse_qn	call site: 00095	UA_String_unescape
2	18	fromDescription	call site: 00018	UA_QualifiedName_printEx
2	23	reverse	call site: 00023	UA_ByteString_allocBuffer
2	128	UA_DataType_toStructureDescription	call site: 00128	UA_StructureDescription_clear
1	15	fromDescription	call site: 00015	UA_copy
1	30	UA_DataType_clear	call site: 00030	UA_clear
1	54	UA_DataType_fromStructureDescription	call site: 00054	UA_order
1	60	guidOrder	call site: 00060	stringOrder
1	62	stringOrder	call site: 00062	nodeIdOrder
1	73	UA_DataType_fromStructureDescription	call site: 00073	UA_DataType_clear
1	76	UA_DataType_fromStructureDescription	call site: 00076	UA_DataType_clear
1	80	UA_DataType_toDescription	call site: 00080	UA_new

Runtime coverage analysis

Covered functions

92

Functions that are reachable but not covered

11

Reachable functions

74

Percentage of reachable functions covered

85.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_datatype_description.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	21
/src/open62541/src/ua_types_encoding_binary.c	3
/work/open62541/src_generated/open62541/types_generated.h	19
/src/open62541/src/ua_types_description.c	11
/src/open62541/deps/itoa.c	3
/src/open62541/src/util/ua_util_internal.h	2
/src/open62541/src/util/ua_types_lex.c	4
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_eventfilter_parse

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	396	66.1%
gold	[1:9]	1	0.16%
yellow	[10:29]	2	0.33%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	200	33.3%
All colors	599	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
133	353	UA_ExtensionObject_setValue	call site: 00353	buildEnumDefinitionFromProperties
108	156	stringOrder	call site: 00156	UA_Server_readBrowseName
43	309	UA_QualifiedName_parseEx	call site: 00309	UA_DataType_toStructureDescription
39	116	lookupRefType	call site: 00116	UA_Server_browseRecursive
14	268	Variant_clear	call site: 00268	readExternalValueAttribute
13	283	UA_Array_copy	call site: 00283	UA_findDataTypeWithCustom
11	297	UA_findDataTypeWithCustom	call site: 00297	UA_DataType_toDescription
7	45	UA_String_unescape	call site: 00045	UA_NamespaceMapping_uri2Index
4	40	parse_nodeid	call site: 00040	UA_String_unescape
2	265	UA_Array_delete	call site: 00265	Variant_clear
2	559	UA_Array_append	call site: 00559	UA_Array_delete
1	37	UA_EventFilter_lex	call site: 00037	UA_NodeId_parseEx

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

147

Reachable functions

270

Percentage of reachable functions covered

45.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc	1
/src/open62541/src/ua_types.c	52
/work/open62541/src_generated/open62541/types_generated.h	58
/src/open62541/src/util/ua_eventfilter_grammar.c	14
/src/open62541/src/util/ua_eventfilter_lex.c	2
/src/open62541/src/util/ua_eventfilter_parser.c	14
/src/open62541/include/open62541/plugin/log.h	1
/src/open62541/src/ua_types_encoding_json.c	2
/src/open62541/deps/cj5.c	7
/src/open62541/src/util/ua_types_lex.c	19
/src/open62541/src/util/ua_util.c	6
/src/open62541/deps/base64.c	1
/src/open62541/src/util/ua_util_internal.h	5
/src/open62541/src/server/ua_services_view.c	19
/src/open62541/src/server/ua_server.c	2
/work/open62541/src_generated/open62541/arch/posix.h	3
/src/open62541/include/open62541/plugin/nodestore.h	3
/src/open62541/src/server/ua_server_nodes.c	7
/src/open62541/deps/ziptree.c	6
/src/open62541/src/server/ua_server_internal.h	4
/src/open62541/src/server/ua_services_attribute.c	26
/src/open62541/src/server/ua_server_utils.c	4
/src/open62541/src/ua_types_description.c	5

Fuzzer: fuzz_pubsub_connection_config

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	10	27.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	26	72.2%
All colors	36	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	9	UA_PubSubConnectionConfig_copy	call site: 00009	UA_String_copy
2	24	UA_PubSubConnectionConfig_clear	call site: 00024	UA_String_clear
1	14	UA_PubSubConnectionConfig_copy	call site: 00014	UA_copy
1	20	UA_Array_copy	call site: 00020	UA_Array_delete
1	22	UA_Array_delete	call site: 00022	UA_PubSubConnectionConfig_clear
1	29	UA_PubSubConnectionConfig_clear	call site: 00029	UA_clear
1	32	UA_PubSubConnectionConfig_clear	call site: 00032	UA_Array_delete

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

0

Reachable functions

19

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc	1
/src/open62541/src/ua_types_encoding_binary.c	3
/src/open62541/src/ua_types.c	4
/src/open62541/src/pubsub/ua_pubsub_connection.c	2
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/pubsub/ua_pubsub_manager.c	2
/src/open62541/src/util/ua_util.c	2

Fuzzer: fuzz_xml_decode_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	12	8.82%
gold	[1:9]	1	0.73%
yellow	[10:29]	3	2.20%
greenyellow	[30:49]	1	0.73%
lawngreen	50+	119	87.5%
All colors	136	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	123	LLVMFuzzerTestOneInput	call site: 00123
2	109	LLVMFuzzerTestOneInput	call site: 00109	UA_calcSizeXml
2	112	UA_encodeXml	call site: 00112	UA_ByteString_clear
2	117	LLVMFuzzerTestOneInput	call site: 00117
1	88	UA_decodeXml	call site: 00088	UA_STRING
1	104	LLVMFuzzerTestOneInput	call site: 00104	UA_clear
1	107	UA_ByteString_allocBuffer	call site: 00107

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

4

Reachable functions

59

Percentage of reachable functions covered

93.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc	1
/work/open62541/src_generated/open62541/types_generated.h	5
/src/open62541/src/ua_types_encoding_xml.c	9
/src/open62541/deps/yxml.c	34
/src/open62541/src/ua_types.c	4

Fuzzer: fuzz_src_ua_util

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17	100.%
All colors	17	100

Runtime coverage analysis

Covered functions

8

Functions that are reachable but not covered

3

Reachable functions

13

Percentage of reachable functions covered

76.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_src_ua_util.cc	3
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/util/ua_util.c	4

Fuzzer: fuzz_pubsub_json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	9.09%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	1.51%
lawngreen	50+	59	89.3%
All colors	66	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	57	UA_DataSetMessage_clear	call site: 00057	UA_DataValue_clear
1	39	NetworkMessage_decodeJsonInternal	call site: 00039	decodeFieldsInternal
1	53	UA_NetworkMessage_decodeJson	call site: 00053	UA_Array_delete
1	60	UA_NetworkMessage_clear	call site: 00060	UA_clear
1	62	UA_NetworkMessage_clear	call site: 00062	UA_clear

Runtime coverage analysis

Covered functions

141

Functions that are reachable but not covered

4

Reachable functions

30

Percentage of reachable functions covered

86.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_pubsub_json.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	2
/src/open62541/src/ua_types_encoding_json.c	7
/src/open62541/deps/cj5.c	7
/src/open62541/src/pubsub/../ua_types_encoding.h	2
/src/open62541/src/ua_types_encoding.h	2
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	2
/src/open62541/src/ua_types.c	2
/work/open62541/src_generated/open62541/types_generated.h	3

Fuzzer: fuzz_opn_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9703	34.9%
gold	[1:9]	17271	62.2%
yellow	[10:29]	101	0.36%
greenyellow	[30:49]	45	0.16%
lawngreen	50+	637	2.29%
All colors	27757	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	26188	initPubSubNS0	call site: 26188	addDataSetReaderConfig
224	25801	policyUriContains	call site: 25801	Service_ActivateSession
188	1044	copyAttributeIntoNode	call site: 01044	UA_MonitoredItem_processSampledValue
184	1278	browseRecursive	call site: 01278	recordModelChangeEvent
136	27273	initPubSubNS0	call site: 27273	UA_Server_addPublishedDataSet
127	25570	processOPN	call site: 25570	processMSG
100	25699	UA_SecurityPolicy_isEnhancedSecurity	call site: 25699	UA_Session_remove
99	24992	UA_SecureChannel_clear	call site: 24992	shutdownSecureChannel
83	1465	endModelChange	call site: 01465	UA_ModelChangeAccumulator_finalize
66	550	UA_findDataTypeWithCustom	call site: 00550	UA_DataType_toDescription
65	25387	unpackPayloadOPN	call site: 25387	unpackPayloadMSG
59	25208	notifySubscription	call site: 25208	UA_Subscription_delete

Runtime coverage analysis

Covered functions

2362

Functions that are reachable but not covered

784

Reachable functions

3006

Percentage of reachable functions covered

73.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_opn_message.cc	9
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/arch/posix.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/src/ua_types.c	85
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/work/open62541/src_generated/open62541/types_generated.h	120
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	5
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/src/server/ua_server.c	14
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	15
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	51
/src/open62541/src/server/ua_server_utils.c	20
/src/open62541/src/ua_types_description.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../server/../util/ua_util_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/../util/ua_util_internal.h	5
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Fuzzer: fuzz_base64_encode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	3	100.%
All colors	3	100

Runtime coverage analysis

Covered functions

3

Functions that are reachable but not covered

0

Reachable functions

3

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_base64_encode.cc	1
/src/open62541/deps/base64.c	2

Fuzzer: fuzz_binary_decode

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	13	20.9%
gold	[1:9]	2	3.22%
yellow	[10:29]	2	3.22%
greenyellow	[30:49]	1	1.61%
lawngreen	50+	44	70.9%
All colors	62	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	20	UA_encodeBinaryInternal	call site: 00020	exchangeBuffer
2	29	LLVMFuzzerTestOneInput	call site: 00029	calcSizeBinaryInternal
2	32	UA_encodeBinary	call site: 00032	UA_ByteString_clear
1	27	UA_ByteString_allocBuffer	call site: 00027	UA_delete
1	50	copySubString	call site: 00050	UA_Variant_copyRange
1	54	UA_Variant_copyRange	call site: 00054	Variant_clear
1	57	UA_DataValue_copyRange	call site: 00057	Variant_clear
1	59	LLVMFuzzerTestOneInput	call site: 00059	UA_clear

Runtime coverage analysis

Covered functions

144

Functions that are reachable but not covered

3

Reachable functions

40

Percentage of reachable functions covered

92.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_decode.cc	1
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/src/ua_types.c	17
/src/open62541/src/ua_types_encoding_binary.c	9
/src/open62541/src/util/ua_util_internal.h	2
/work/open62541/src_generated/open62541/types_generated.h	6

Fuzzer: fuzz_binary_message

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9815	35.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.00%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	17919	64.6%
All colors	27735	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1014	26188	initPubSubNS0	call site: 26188	addDataSetReaderConfig
550	25475	processHEL	call site: 25475	processMSG
188	1044	copyAttributeIntoNode	call site: 01044	UA_MonitoredItem_processSampledValue
184	1278	browseRecursive	call site: 01278	recordModelChangeEvent
136	27273	initPubSubNS0	call site: 27273	UA_Server_addPublishedDataSet
113	25339	extractCompleteChunk	call site: 25339	unpackPayloadMSG
99	24992	UA_SecureChannel_clear	call site: 24992	shutdownSecureChannel
83	1465	endModelChange	call site: 01465	UA_ModelChangeAccumulator_finalize
66	550	UA_findDataTypeWithCustom	call site: 00550	UA_DataType_toDescription
66	25208	notifySubscription	call site: 25208	UA_Session_remove
52	1565	deleteNodeOperation_inner	call site: 01565	deleteNodeSet
49	25139	UA_Subscription_delete	call site: 25139	deleteMonitoredItem

Runtime coverage analysis

Covered functions

2293

Functions that are reachable but not covered

813

Reachable functions

2991

Percentage of reachable functions covered

72.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/open62541/tests/fuzz/fuzz_binary_message.cc	1
/work/open62541/src_generated/open62541/types_generated.h	121
/src/open62541/src/ua_types.c	85
/src/open62541/tests/fuzz/custom_memory_manager.c	1
/src/open62541/plugins/include/open62541/server_config_default.h	2
/src/open62541/plugins/ua_config_default.c	7
/src/open62541/plugins/ua_nodestore_ziptree.c	1
/src/open62541/plugins/ua_log_stdout.c	2
/src/open62541/arch/posix/eventloop_posix.c	1
/work/open62541/src_generated/open62541/arch/posix.h	5
/src/open62541/arch/common/timer.c	1
/src/open62541/arch/posix/eventloop_posix_tcp.c	1
/src/open62541/arch/posix/eventloop_posix_udp.c	1
/src/open62541/arch/posix/eventloop_posix_eth.c	1
/src/open62541/arch/posix/eventloop_posix_interrupt.c	2
/src/open62541/include/open62541/plugin/log.h	6
/src/open62541/arch/posix/clock_posix.c	1
/src/open62541/deps/mp_printf.c	13
/src/open62541/deps/dtoa.c	10
/src/open62541/src/util/ua_util.c	30
/src/open62541/src/util/ua_util_internal.h	16
/src/open62541/deps/itoa.c	3
/src/open62541/deps/base64.c	2
/src/open62541/plugins/crypto/ua_certificategroup_none.c	1
/src/open62541/src/server/ua_server_config.c	1
/src/open62541/plugins/crypto/ua_securitypolicy_none.c	2
/src/open62541/plugins/crypto/openssl/securitypolicy_common.c	10
/src/open62541/plugins/ua_accesscontrol_default.c	1
/src/open62541/include/open62541/server.h	1
/src/open62541/src/server/ua_server.c	14
/src/open62541/src/server/../util/ua_util_internal.h	4
/work/open62541/src_generated/open62541/statuscodes.c	1
/src/open62541/deps/pcg_basic.c	2
/src/open62541/src/server/ua_session.c	11
/src/open62541/src/server/ua_server_modelchange.c	19
/src/open62541/src/server/ua_subscription.c	36
/src/open62541/src/server/ua_server_async.c	17
/src/open62541/src/server/ua_server_ns0.c	15
/src/open62541/src/server/ua_services_nodemanagement.c	72
/src/open62541/src/server/ua_server_nodes.c	49
/src/open62541/src/server/ua_services_view.c	46
/src/open62541/deps/ziptree.c	11
/src/open62541/include/open62541/plugin/nodestore.h	7
/src/open62541/src/server/ua_server_internal.h	20
/src/open62541/src/server/ua_services_attribute.c	51
/src/open62541/src/server/ua_server_utils.c	20
/src/open62541/src/ua_types_description.c	5
/src/open62541/src/util/ua_types_lex.c	12
/src/open62541/src/server/ua_subscription_datachange.c	8
/src/open62541/src/server/ua_subscription.h	7
/src/open62541/src/server/ua_subscription_event.c	12
/src/open62541/src/server/ua_server_auditing.c	14
/work/open62541/src_generated/open62541/namespace0_generated.c	1749
/src/open62541/src/ua_types_encoding_xml.c	3
/src/open62541/deps/yxml.c	34
/src/open62541/src/server/ua_services_session.c	24
/src/open62541/src/server/ua_transport_tcp.c	22
/src/open62541/src/server/ua_transport_http.c	7
/src/open62541/src/ua_securechannel_http.c	6
/src/open62541/src/ua_types_encoding_json.c	11
/src/open62541/src/ua_types_encoding_binary.c	7
/src/open62541/src/ua_securechannel.c	30
/src/open62541/src/ua_securechannel_crypto.c	23
/src/open62541/src/ua_securechannel.h	1
/src/open62541/src/server/ua_services_monitoreditem.c	1
/src/open62541/src/server/ua_services_subscription.c	1
/src/open62541/src/server/ua_services_securechannel.c	5
/work/open62541/src_generated/open62541/transport_generated.h	3
/src/open62541/src/server/ua_services.c	6
/src/open62541/plugins/crypto/openssl/certificategroup.c	3
/usr/include/openssl/x509v3.h	3
/usr/include/openssl/asn1.h	1
/src/open62541/src/server/ua_services_discovery.c	9
/src/open62541/src/server/../ua_securechannel.h	3
/src/open62541/src/server/ua_server_ns0_diagnostics.c	1
/src/open62541/src/util/ua_encryptedsecret.c	6
/src/open62541/src/util/../ua_securechannel.h	2
/src/open62541/src/server/ua_transport_ws.c	6
/src/open62541/src/server/ua_transport_tcp_reverse.c	1
/src/open62541/src/server/ua_server_discovery.c	1
/src/open62541/src/pubsub/ua_pubsub_manager.c	26
/src/open62541/src/pubsub/ua_pubsub_ns0.c	42
/src/open62541/src/pubsub/../server/ua_server_internal.h	4
/src/open62541/src/pubsub/ua_pubsub_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_connection.c	10
/src/open62541/src/pubsub/../server/../util/ua_util_internal.h	3
/src/open62541/src/pubsub/ua_pubsub_readergroup.c	10
/src/open62541/src/pubsub/ua_pubsub_reader.c	15
/src/open62541/src/pubsub/ua_pubsub_writergroup.c	24
/src/open62541/src/pubsub/ua_pubsub_writer.c	17
/src/open62541/src/pubsub/ua_pubsub_dataset.c	19
/src/open62541/src/pubsub/ua_pubsub_networkmessage_binary.c	26
/src/open62541/src/pubsub/../util/ua_util_internal.h	5
/src/open62541/src/pubsub/ua_pubsub_networkmessage_json.c	4
/src/open62541/tests/testing-plugins/testing_networklayers.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
UA_Server_loadNodeset	/src/open62541/src/util/nodeset_loader/ua_nodeset_loader.c	3	['N/A', 'size_t', 'N/A']	53	0	116	20	8	709	0	4673	758
moveOrCopyMethodCallback	/src/open62541/drivers/file_transfer/file_transfer_directory.c	11	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'size_t', 'N/A', 'size_t', 'N/A']	68	0	853	138	55	662	0	3961	602
MdnsdDriver_start	/src/open62541/drivers/discovery_mdns_mdnsd.c	1	['N/A']	14	0	472	65	24	249	0	1461	515

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3828 / 6139

Cyclomatic complexity statically reachable by fuzzers

23153 / 34836

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

/src/open62541/tests/fuzz/fuzz_mdns_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_a_match', '_r_next', 'mdnsd_in', '_cache', '_q_next', 'mdnsd_free', 'inet_anyaddr']

/src/open62541/tests/fuzz/fuzz_client.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_SecureChannel_clear', 'cleanupSession', 'UA_Array_delete', 'notifyClientState', '__Client_Service', 'processServiceResponse', 'UA_UNLOCK', 'setLocalCertificate_none', 'UA_ClientConfig_clear', 'UA_SecureChannel_deleteBuffered']

/src/open62541/tests/fuzz/fuzz_parse_string.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'stringOrder', 'UA_Array_delete', 'lookupRefType', 'UA_String_unescape', 'parse_nodeid', 'nodeId_printEscape', 'printRelativePath', 'UA_String_escapedSize']

/src/open62541/tests/fuzz/fuzz_attributeoperand.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_STRING', 'nodeIdOrder', 'UA_Array_delete', 'guidOrder', 'lookupRefType', 'UA_String_unescape', 'nodeId_printEscape', 'UA_AttributeOperand_print', 'parse_nodeid', 'printRelativePath']

/src/open62541/tests/fuzz/fuzz_json_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_base64_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_server_services.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'ctxClear', 'browseRecursive', 'copyAttributeIntoNode', 'Service_ActivateSession_inner', 'findSessionByToken', 'UA_SecureChannel_clear', 'endModelChange', 'Service_CreateMonitoredItems']

/src/open62541/tests/fuzz/fuzz_tcp_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'UA_KeyValueMap_setScalar', 'processHEL', 'copyAttributeIntoNode', 'UA_KeyValueMap_clear', 'extractCompleteChunk', 'UA_SecureChannel_clear', 'endModelChange', 'UA_findDataTypeWithCustom']

/src/open62541/tests/fuzz/fuzz_mdns_xht.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_process_request.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['findSingleChildNode', 'ctxClear', 'initPubSubNS0', 'copyAttributeIntoNode', 'getNodeContext', 'endModelChange', 'UA_SecureChannel_clear', 'UA_findDataTypeWithCustom', 'browseRecursive', 'Service_ActivateSession_inner']

/src/open62541/tests/fuzz/fuzz_msg_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['findSingleChildNode', 'initPubSubNS0', 'copyAttributeIntoNode', 'processSecureChannelMessage', 'getNodeContext', 'UA_findDataTypeWithCustom', 'browseRecursive', 'Service_ActivateSession_inner', 'Service_CreateSession_inner']

/src/open62541/tests/fuzz/fuzz_certificate_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_CertificateUtils_verifyApplicationUri', 'LLVMFuzzerTestOneInput', 'UA_OpenSSL_LoadPemCertificate', 'UA_CertificateUtils_getKeySize', 'UA_OpenSSL_LoadCertificate', 'UA_OpenSSL_LoadCrl', 'UA_CertificateUtils_getSubjectName']

/src/open62541/tests/fuzz/fuzz_config_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'notifySubscription', 'UA_Session_detachFromSecureChannel', 'browseRecursive', 'copyAttributeIntoNode', 'endModelChange', 'UA_findDataTypeWithCustom', 'deleteNodeOperation_inner', 'UA_Subscription_delete']

/src/open62541/tests/fuzz/fuzz_pubsub_binary.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['stringOrder', 'UA_DataSetMessage_keyFrame_decodeBinary', 'guidOrder', 'UA_DataSetMessage_clear', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_json_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput']

/src/open62541/tests/fuzz/fuzz_datatype_description.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parse_qn', 'fromDescription', 'reverse', 'UA_DataType_toStructureDescription', 'UA_DataType_clear', 'UA_DataType_fromStructureDescription', 'guidOrder', 'stringOrder']

/src/open62541/tests/fuzz/fuzz_eventfilter_parse.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_ExtensionObject_setValue', 'stringOrder', 'UA_QualifiedName_parseEx', 'lookupRefType', 'Variant_clear', 'UA_Array_copy', 'UA_findDataTypeWithCustom', 'UA_String_unescape', 'parse_nodeid', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_pubsub_connection_config.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_PubSubConnectionConfig_copy', 'UA_PubSubConnectionConfig_clear', 'UA_Array_copy', 'UA_Array_delete']

/src/open62541/tests/fuzz/fuzz_xml_decode_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'UA_encodeXml', 'UA_decodeXml', 'UA_ByteString_allocBuffer']

/src/open62541/tests/fuzz/fuzz_src_ua_util.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_pubsub_json.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_DataSetMessage_clear', 'NetworkMessage_decodeJsonInternal', 'UA_NetworkMessage_decodeJson', 'UA_NetworkMessage_clear']

/src/open62541/tests/fuzz/fuzz_opn_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'policyUriContains', 'copyAttributeIntoNode', 'browseRecursive', 'processOPN', 'UA_SecurityPolicy_isEnhancedSecurity', 'UA_SecureChannel_clear', 'endModelChange', 'UA_findDataTypeWithCustom']

/src/open62541/tests/fuzz/fuzz_base64_encode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

/src/open62541/tests/fuzz/fuzz_binary_decode.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['UA_encodeBinaryInternal', 'LLVMFuzzerTestOneInput', 'UA_encodeBinary', 'UA_ByteString_allocBuffer', 'copySubString', 'UA_Variant_copyRange', 'UA_DataValue_copyRange']

/src/open62541/tests/fuzz/fuzz_binary_message.cc

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['initPubSubNS0', 'processHEL', 'copyAttributeIntoNode', 'browseRecursive', 'extractCompleteChunk', 'UA_SecureChannel_clear', 'endModelChange', 'UA_findDataTypeWithCustom', 'notifySubscription']