Project overview

High level conclusions

Fuzzers reach 3.448% of all functions. Improvements need to be made

Fuzzers reach 0.998% of cyclomatic complexity. Improvements could be made

Reachability and coverage overview

Functions statically reachable by fuzzers

26/754

Cyclomatic complexity statically reachable by fuzzers

79/7909

Functions covered at runtime

401

Fuzzers overview

Fuzzer	Fuzzer filename	Functions Reached	Functions unreached	Fuzzer depth	Files reached	Basic blocks reached	Cyclomatic complexity	Details
decoder_fuzzer	decoder_fuzzer.cpp	26	728	7	10	101	79	decoder_fuzzer.cpp

Project functions overview

The following table shows data about each function in the project. The functions included in this table corresponds to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer details

Fuzzer: decoder_fuzzer

Call tree overview

The following is the call tree with color coding for which functions are hit/not hit. This info is based on the coverage achieved of all fuzzers together and not just this specific fuzzer. This should change in the future to be per-fuzzer-basis.

For further technical details on what the call tree overview is, please see the Glossary .

Full calltree

The following link provides a visualisation of the full calltree overlayed with coverage information: full calltree

For futher technical details on how the call tree is made, please see the Glossary .

Fuzz blockers

The followings nodes represent call sites where fuzz blockers occur

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	8	welsCodecTrace::StaticCodecTrace(void, int, char const, __va_list_tag*)	call site	WelsVsnprintf
1	2	WelsCreateDecoder	call site
1	5	welsCodecTrace::welsCodecTrace()	call site	fprintf
1	13	WelsDec::CWelsDecoder::CWelsDecoder()	call site	WelsSnprintf

Functions hit (dynamic analysis based)

Covered functions

Functions that are reachable but not covered

Reachable functions

Percentage of reachable functions covered

61.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation our of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files hit

filename	functions hit
decoder_fuzzer.cpp	1
openh264/codec/decoder/pluswelsDecoderExt.cpp	3
openh264/./codec/api/svc/codec_api.h	3
openh264/codec/commonwelsCodecTrace.cpp	6
/	6
openh264/codec/commoncrt_util_safe_x.cpp	4
openh264/codec/commonutils.cpp	1
openh264/codec/decoder/coredecoder.cpp	1
openh264/codec/decoder/corewels_decoder_thread.cpp	1
openh264/codec/commonWelsThreadLib.cpp	1

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination reaches a high amount of code coverage.

Func name	Functions filename	Arg count	Args	Function depth	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
`WelsDec::CWelsDecoder::DecodeFrame2WithCtx(WelsDec::TagWelsDecoderContext, unsigned char const, int, unsigned char*, TagBufferInfo)`	/src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp	6	['class.WelsDec::CWelsDecoder ', 'struct.WelsDec::TagWelsDecoderContext ', 'char ', 'int ', 'char ', 'struct.TagBufferInfo ']	17	605	94	38	464	13	3607	3585
`WelsDec::WelsDeblockingMb(WelsDec::TagDqLayer, WelsDec::tagDeblockingFilter, int)`	/src/openh264/codec/decoder/core/src/deblocking.cpp	3	['struct.WelsDec::TagDqLayer ', 'struct.WelsDec::tagDeblockingFilter ', 'int ']	3	255	48	16	19	0	1463	1463
`WelsDec::WelsDecodeMbCabacBSlice(WelsDec::TagWelsDecoderContext, WelsDec::TagNalUnit, unsigned int&)`	/src/openh264/codec/decoder/core/src/decode_slice.cpp	3	['struct.WelsDec::TagWelsDecoderContext ', 'struct.WelsDec::TagNalUnit ', 'int *']	7	354	59	24	93	0	1155	1085
`WelsDec::WelsDecodeMbCavlcBSlice(WelsDec::TagWelsDecoderContext, WelsDec::TagNalUnit, unsigned int&)`	/src/openh264/codec/decoder/core/src/decode_slice.cpp	3	['struct.WelsDec::TagWelsDecoderContext ', 'struct.WelsDec::TagNalUnit ', 'int *']	6	456	83	34	74	0	951	435
`WelsDec::WelsDecodeMbCabacPSlice(WelsDec::TagWelsDecoderContext, WelsDec::TagNalUnit, unsigned int&)`	/src/openh264/codec/decoder/core/src/decode_slice.cpp	3	['struct.WelsDec::TagWelsDecoderContext ', 'struct.WelsDec::TagNalUnit ', 'int *']	7	271	39	16	71	0	848	283
`WelsDec::WelsDecodeMbCavlcPSlice(WelsDec::TagWelsDecoderContext, WelsDec::TagNalUnit, unsigned int&)`	/src/openh264/codec/decoder/core/src/decode_slice.cpp	3	['struct.WelsDec::TagWelsDecoderContext ', 'struct.WelsDec::TagNalUnit ', 'int *']	6	356	61	25	53	0	673	235
`WelsDec::WelsDecodeMbCabacISlice(WelsDec::TagWelsDecoderContext, WelsDec::TagNalUnit, unsigned int&)`	/src/openh264/codec/decoder/core/src/decode_slice.cpp	3	['struct.WelsDec::TagWelsDecoderContext ', 'struct.WelsDec::TagNalUnit ', 'int *']	7	24	6	3	48	0	532	110
`WelsDec::WelsDecodeMbCavlcISlice(WelsDec::TagWelsDecoderContext, WelsDec::TagNalUnit, unsigned int&)`	/src/openh264/codec/decoder/core/src/decode_slice.cpp	3	['struct.WelsDec::TagWelsDecoderContext ', 'struct.WelsDec::TagNalUnit ', 'int *']	5	117	20	9	40	0	416	91
`WelsDec::CWelsDecoder::SetOption(DECODER_OPTION, void*)`	/src/openh264/codec/decoder/plus/src/welsDecoderExt.cpp	3	['class.WelsDec::CWelsDecoder ', 'int ', 'char ']	4	388	88	39	15	0	79	43

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

605/754