High level conclusions

Fuzzer flow_extract_target is blocked:

The runtime code coverage of flow_extract_target covers 29.13% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer miniflow_target is blocked:

The runtime code coverage of miniflow_target covers 27.58% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 32.64% of cyclomatic complexity.

Fuzzers reach 26.05% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

2436/9348

Cyclomatic complexity statically reachable by fuzzers

13364/40941

Runtime code coverage of functions

2341 / 9348

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: json_parser_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	761	69.0%
gold	[1:9]	19	1.72%
yellow	[10:29]	13	1.17%
greenyellow	[30:49]	5	0.45%
lawngreen	50+	304	27.5%
All colors	1102	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
50	50	1 : View List ['out_of_memory']	50	50	xcalloc__	call site: 00008	/src/openvswitch/lib/util.c:125
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00040	/src/openvswitch/lib/util.c:141
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00057	/src/openvswitch/lib/util.c:151
2	2	1 : View List ['abort']	2	2	json_parser_put_value	call site: 00097	/src/openvswitch/lib/json.c:1275
2	2	1 : View List ['abort']	2	2	json_parser_pop	call site: 00071	/src/openvswitch/lib/json.c:1395
0	88	1 : View List ['ds_put_utf8']	0	88	ds_put_utf8	call site: 01033	/src/openvswitch/lib/dynamic-string.c:98
0	73	1 : View List ['ds_put_char__']	0	73	ds_put_char	call site: 00232	/src/openvswitch/./include/openvswitch/dynamic-string.h:91
0	11	2 : View List ['hmap_first', 'hmap_next']	0	259	json_serialize_object	call site: 00235	/src/openvswitch/lib/json.c:1652
0	0	None	0	149	json_string_unescape	call site: 01008	/src/openvswitch/lib/json.c:875
0	0	None	0	149	json_string_unescape	call site: 01011	/src/openvswitch/lib/json.c:886
0	0	None	0	0	mhash_add__	call site: 00107	/src/openvswitch/./lib/hash.h:66
0	0	None	0	0	json_parser_pop	call site: 00068	/src/openvswitch/lib/json.c:1387

Runtime coverage analysis

Covered functions

185

Functions that are reachable but not covered

338

Reachable functions

484

Percentage of reachable functions covered

30.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/json_parser_target.c	1
lib/json.c	46
lib/util.c	43
lib/shash.c	19
lib/hmap.c	11
lib/dynamic-string.c	16
./lib/hash.h	9
lib/hash.c	1
./lib/unaligned.h	2
./include/openvswitch/hmap.h	9
./include/openvswitch/util.h	1
lib/vlog.c	40
lib/ovs-thread.c	14
lib/token-bucket.c	1
lib/timeval.c	16
lib/coverage.c	8
lib/unixctl.c	6
lib/svec.c	8
lib/jsonrpc.c	14
./include/openvswitch/json.h	2
./include/openvswitch/dynamic-string.h	1
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	14
lib/packets.c	2
lib/dns-resolve-stub.c	1
./lib/socket-util.h	1
lib/socket-util-unix.c	7
lib/fatal-signal.c	9
lib/async-append-aio.c	7
lib/byteq.c	10
lib/signals.c	2
lib/sset.c	8
lib/random.c	5
lib/entropy.c	2
lib/ofpbuf.c	5
./include/openvswitch/list.h	5
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
./lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/seq.c	7
lib/latch-unix.c	2
./lib/sat-math.h	2
./lib/unicode.h	2
lib/unicode.c	1

Fuzzer: miniflow_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	915	72.3%
gold	[1:9]	26	2.05%
yellow	[10:29]	21	1.66%
greenyellow	[30:49]	7	0.55%
lawngreen	50+	296	23.3%
All colors	1265	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1432	1432	2 : View List ['ovs_retval_to_string', 'vlog']	1432	1432	get_entropy	call site: 00616	/src/openvswitch/lib/entropy.c:53
1432	1432	2 : View List ['ovs_retval_to_string', 'vlog_fatal']	1432	1432	get_entropy_or_die	call site: 00606	/src/openvswitch/lib/entropy.c:78
1430	1430	3 : View List ['__errno_location', 'vlog_fatal', 'ovs_strerror']	1430	1430	xgettimeofday	call site: 00602	/src/openvswitch/lib/timeval.c:488
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00131	/src/openvswitch/lib/util.c:141
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00168	/src/openvswitch/lib/util.c:151
17	17	2 : View List ['__errno_location', 'ovs_strerror']	1434	1434	get_entropy	call site: 00607	/src/openvswitch/lib/entropy.c:45
4	4	1 : View List ['pt_ns_type_be']	2966	3140	miniflow_extract	call site: 00044	/src/openvswitch/lib/flow.c:833
4	4	1 : View List ['pt_ns_type_be']	16	48	flow_wildcards_init_for_packet	call site: 01173	/src/openvswitch/lib/flow.c:1901
2	2	1 : View List ['ovs_u128_is_zero']	2984	3173	miniflow_extract	call site: 00036	/src/openvswitch/lib/flow.c:808
0	0	None	2984	3175	miniflow_extract	call site: 00027	/src/openvswitch/lib/flow.c:780
0	0	None	2984	3175	miniflow_extract	call site: 00033	/src/openvswitch/lib/flow.c:802
0	0	None	2982	3171	miniflow_extract	call site: 00040	/src/openvswitch/lib/flow.c:821

Runtime coverage analysis

Covered functions

351

Functions that are reachable but not covered

420

Reachable functions

580

Percentage of reachable functions covered

27.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/miniflow_target.c	8
lib/dp-packet.c	3
./lib/dp-packet.h	16
./lib/packets.h	10
lib/flow.c	43
./lib/flow.h	27
./lib/util.h	4
./lib/unaligned.h	3
./lib/byte-order.h	2
lib/vlog.c	40
lib/ovs-thread.c	14
lib/util.c	39
lib/token-bucket.c	1
lib/timeval.c	16
lib/coverage.c	8
lib/unixctl.c	6
lib/shash.c	14
./lib/hash.h	10
lib/hash.c	1
lib/svec.c	8
lib/dynamic-string.c	18
lib/json.c	18
lib/jsonrpc.c	11
./include/openvswitch/json.h	2
./include/openvswitch/dynamic-string.h	1
./include/openvswitch/hmap.h	9
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	14
lib/packets.c	2
lib/dns-resolve-stub.c	1
./lib/socket-util.h	1
lib/socket-util-unix.c	7
lib/fatal-signal.c	9
lib/async-append-aio.c	7
lib/byteq.c	10
lib/signals.c	2
lib/sset.c	8
lib/hmap.c	11
./include/openvswitch/util.h	1
lib/random.c	5
lib/entropy.c	2
lib/ofpbuf.c	5
./include/openvswitch/list.h	5
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
./lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/seq.c	7
lib/latch-unix.c	2
./lib/sat-math.h	2
./include/openvswitch/nsh.h	6
./lib/classifier-private.h	2
./lib/random.h	1

Fuzzer: ofctl_parse_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1190	44.9%
gold	[1:9]	154	5.81%
yellow	[10:29]	47	1.77%
greenyellow	[30:49]	37	1.39%
lawngreen	50+	1221	46.0%
All colors	2649	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1458	1458	1 : View List ['put_OFPAT15_COPY_FIELD']	1464	4561	encode_REG_MOVE	call site: 00000	/src/openvswitch/lib/ofp-actions.c:2685
588	4839	3 : View List ['free', 'match_to_string', 'vlog']	588	4839	ofputil_normalize_match__	call site: 02288	/src/openvswitch/lib/ofp-match.c:970
182	289	4 : View List ['ds_cstr', 'namemap_put_name', 'ds_destroy', 'ofputil_port_map_get_name']	182	294	ofputil_port_to_string	call site: 01064	/src/openvswitch/lib/ofp-port.c:272
182	182	1 : View List ['namemap_put_name']	182	182	ofputil_format_port	call site: 01599	/src/openvswitch/lib/ofp-port.c:254
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00011	/src/openvswitch/lib/util.c:141
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00397	/src/openvswitch/lib/util.c:151
50	50	1 : View List ['ovs_fatal']	50	50	vlog_set_verbosity	call site: 00004	/src/openvswitch/lib/vlog.c:608
20	20	1 : View List ['hash_words__']	20	20	hash_words	call site: 00000	/src/openvswitch/./lib/hash.h:359
14	75	3 : View List ['xmalloc', 'ofpbuf_copy__', 'free']	14	75	ofpbuf_resize__	call site: 01814	/src/openvswitch/lib/ofpbuf.c:260
2	2	1 : View List ['htons']	2	4078	ofputil_encode_flow_mod	call site: 02324	/src/openvswitch/lib/ofp-flow.c:420
0	2260	1 : View List ['ofpacts_put_openflow_actions']	0	2260	ofpacts_put_openflow_instructions	call site: 02559	/src/openvswitch/lib/ofp-actions.c:8930
0	1504	1 : View List ['nxm_put_32']	6	7559	nxm_put_ip	call site: 02457	/src/openvswitch/lib/nx-match.c:1008

Runtime coverage analysis

Covered functions

1227

Functions that are reachable but not covered

413

Reachable functions

1451

Percentage of reachable functions covered

71.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/ofctl_parse_target.c	3
lib/vlog.c	43
lib/util.c	60
lib/ovs-thread.c	15
lib/ofp-flow.c	7
lib/ofp-parse.c	10
lib/match.c	148
lib/meta-flow.c	34
lib/shash.c	17
lib/hmap.c	11
./lib/hash.h	12
lib/hash.c	1
./lib/unaligned.h	2
lib/flow.c	26
./lib/bitmap.h	6
lib/packets.c	20
./lib/util.h	10
lib/ofp-port.c	8
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	14
lib/dns-resolve-stub.c	1
./lib/socket-util.h	1
lib/socket-util-unix.c	7
lib/fatal-signal.c	9
lib/signals.c	2
lib/dynamic-string.c	18
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	16
lib/coverage.c	8
lib/unixctl.c	6
lib/svec.c	8
lib/json.c	22
lib/jsonrpc.c	11
./include/openvswitch/json.h	2
./include/openvswitch/hmap.h	10
lib/ofpbuf.c	16
./include/openvswitch/list.h	6
lib/token-bucket.c	1
./lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	10
lib/seq.c	7
lib/latch-unix.c	2
lib/sset.c	8
./include/openvswitch/util.h	1
lib/random.c	5
lib/entropy.c	2
./lib/syslog-provider.h	1
./lib/dirs.c.in	2
./lib/flow.h	23
lib/namemap.c	4
./lib/unicode.h	2
lib/unicode.c	1
lib/tun-metadata.c	10
./lib/byte-order.h	5
./include/openvswitch/nsh.h	4
./lib/packets.h	18
lib/nx-match.c	36
./include/openvswitch/meta-flow.h	1
lib/ofp-table.c	2
lib/ofp-group.c	1
lib/ofp-actions.c	44
./include/openvswitch/ofp-actions.h	15
lib/bundle.c	2
lib/ofp-errors.c	3
lib/ofp-match.c	8
lib/ofp-protocol.c	3
lib/ofp-msgs.c	3
./lib/ovs-atomic.h	1
./lib/ofp-actions.inc2	2

Fuzzer: odp_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1594	48.5%
gold	[1:9]	68	2.06%
yellow	[10:29]	39	1.18%
greenyellow	[30:49]	15	0.45%
lawngreen	50+	1570	47.7%
All colors	3286	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1450	1452	2 : View List ['odp_nsh_key_from_attr__', 'nl_attr_get_size']	1494	7844	parse_l2_5_onward	call site: 02099	/src/openvswitch/lib/odp-util.c:7016
1418	1418	1 : View List ['vlog_rate_limit']	1418	1418	nl_attr_validate	call site: 01446	/src/openvswitch/lib/netlink.c:874
1418	1418	1 : View List ['vlog_rate_limit']	1418	1418	odp_to_ovs_frag	call site: 02083	/src/openvswitch/lib/odp-util.c:6704
188	426	4 : View List ['ds_put_char.13456', 'ds_put_format', 'format_generic_odp_key', 'nl_attr_get_size']	188	426	check_attr_len	call site: 01520	/src/openvswitch/lib/odp-util.c:3613
131	131	1 : View List ['format_odp_set_nsh']	131	131	format_odp_action	call site: 03096	/src/openvswitch/lib/odp-util.c:1169
104	104	1 : View List ['odp_put_tnl_push_action']	104	104	parse_odp_action__	call site: 02881	/src/openvswitch/lib/odp-util.c:2634
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00011	/src/openvswitch/lib/util.c:141
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00173	/src/openvswitch/lib/util.c:151
50	50	1 : View List ['ovs_fatal']	50	50	vlog_set_verbosity	call site: 00004	/src/openvswitch/lib/vlog.c:608
42	42	2 : View List ['simap_find_len', 'strcspn']	172	12264	parse_odp_action__	call site: 02672	/src/openvswitch/lib/odp-util.c:2352
21	21	3 : View List ['hmap_next_in_bucket.13538', 'hash_odp_port', 'hmap_first_in_bucket.13537']	21	21	odp_portno_names_get	call site: 01833	/src/openvswitch/lib/odp-util.c:3374
4	3244	5 : View List ['strncasecmp', 'parse_action_list', 'nl_msg_put_u16', 'nl_msg_end_nested', 'nl_msg_start_nested']	4	3422	parse_odp_action__	call site: 02796	/src/openvswitch/lib/odp-util.c:2556

Runtime coverage analysis

Covered functions

513

Functions that are reachable but not covered

493

Reachable functions

815

Percentage of reachable functions covered

39.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/odp_target.c	3
lib/vlog.c	43
lib/util.c	55
lib/ovs-thread.c	15
lib/ofpbuf.c	16
./include/openvswitch/list.h	5
lib/odp-util.c	144
./lib/bitmap.h	6
lib/uuid.c	2
lib/netlink.c	39
./include/openvswitch/ofpbuf.h	10
./lib/util.h	8
lib/flow.c	9
./lib/byte-order.h	5
lib/simap.c	2
lib/hash.c	1
./lib/unaligned.h	9
./lib/hash.h	9
lib/packets.c	11
./include/openvswitch/nsh.h	13
./lib/netlink.h	1
lib/token-bucket.c	1
lib/timeval.c	16
lib/coverage.c	8
lib/unixctl.c	6
lib/shash.c	14
lib/svec.c	8
lib/dynamic-string.c	17
lib/json.c	19
lib/jsonrpc.c	11
./include/openvswitch/json.h	2
./include/openvswitch/dynamic-string.h	1
./include/openvswitch/hmap.h	10
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	14
lib/dns-resolve-stub.c	1
./lib/socket-util.h	1
lib/socket-util-unix.c	7
lib/fatal-signal.c	9
lib/signals.c	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/sset.c	8
lib/hmap.c	11
./include/openvswitch/util.h	1
lib/random.c	5
lib/entropy.c	2
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/seq.c	7
lib/latch-unix.c	2
./lib/sat-math.h	2
lib/tun-metadata.c	14
./lib/packets.h	25
./lib/flow.h	9
lib/match.c	16
lib/ofp-port.c	3
lib/namemap.c	3
lib/csum.c	2
./lib/csum.h	1

Fuzzer: ofp_print_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1174	22.8%
gold	[1:9]	41	0.79%
yellow	[10:29]	161	3.13%
greenyellow	[30:49]	71	1.38%
lawngreen	50+	3685	71.8%
All colors	5132	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
4839	4839	3 : View List ['free', 'match_to_string', 'vlog']	4839	4839	ofputil_normalize_match__	call site: 03841	/src/openvswitch/lib/ofp-match.c:970
1607	3061	4 : View List ['ntohs', 'ofpmsg_body', 'free', 'nx_match_to_string']	1607	6233	ofputil_flow_mod_format	call site: 03946	/src/openvswitch/lib/ofp-flow.c:542
281	281	1 : View List ['ofp10_match_print']	281	4832	ofputil_flow_mod_format	call site: 03944	/src/openvswitch/lib/ofp-flow.c:536
182	182	1 : View List ['namemap_put_name']	182	182	ofputil_format_port	call site: 01399	/src/openvswitch/lib/ofp-port.c:254
182	182	1 : View List ['namemap_put_name']	182	182	ofputil_format_table	call site: 02430	/src/openvswitch/lib/ofp-table.c:203
73	75	2 : View List ['ds_destroy', 'ds_put_buffer']	73	603	ofputil_format_port_stats	call site: 04698	/src/openvswitch/lib/ofp-port.c:1799
50	50	1 : View List ['out_of_memory']	50	50	xcalloc__	call site: 04584	/src/openvswitch/lib/util.c:125
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00009	/src/openvswitch/lib/util.c:141
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00110	/src/openvswitch/lib/util.c:151
50	50	1 : View List ['ovs_fatal']	50	50	vlog_set_verbosity	call site: 00002	/src/openvswitch/lib/vlog.c:608
20	20	1 : View List ['hash_words__']	20	20	hash_words	call site: 00934	/src/openvswitch/./lib/hash.h:359
6	1424	4 : View List ['vlog_rate_limit', 'ntohs', 'htons', 'ntohl']	6	2865	parse_async_tlv	call site: 04849	/src/openvswitch/lib/ofp-connection.c:366

Runtime coverage analysis

Covered functions

1586

Functions that are reachable but not covered

414

Reachable functions

1803

Percentage of reachable functions covered

77.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/ofp_print_target.c	1
lib/vlog.c	43
lib/util.c	46
lib/ovs-thread.c	15
lib/ofpbuf.c	21
./include/openvswitch/list.h	8
./include/openvswitch/ofpbuf.h	14
lib/ofp-print.c	59
lib/dynamic-string.c	22
lib/ofp-msgs.c	29
lib/token-bucket.c	1
lib/timeval.c	16
lib/coverage.c	8
lib/unixctl.c	6
lib/shash.c	14
./lib/hash.h	16
lib/hash.c	2
./lib/unaligned.h	8
lib/svec.c	8
lib/json.c	19
lib/jsonrpc.c	11
./include/openvswitch/json.h	2
./include/openvswitch/dynamic-string.h	1
./include/openvswitch/hmap.h	10
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	14
lib/packets.c	17
lib/dns-resolve-stub.c	1
./lib/socket-util.h	1
lib/socket-util-unix.c	7
lib/fatal-signal.c	9
lib/signals.c	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/sset.c	8
lib/hmap.c	11
./include/openvswitch/util.h	1
lib/random.c	5
lib/entropy.c	2
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/seq.c	7
lib/latch-unix.c	2
./lib/sat-math.h	2
lib/ofp-group.c	33
./lib/byte-order.h	6
lib/ofp-actions.c	138
lib/ofp-protocol.c	8
./lib/ofp-actions.inc2	1
./include/openvswitch/ofp-actions.h	70
./lib/flow.h	33
lib/ofp-port.c	43
./lib/packets.h	22
lib/meta-flow.c	34
lib/nx-match.c	47
./include/openvswitch/meta-flow.h	1
lib/cmap.c	9
./lib/cmap.h	1
lib/namemap.c	3
lib/flow.c	50
./lib/util.h	14
./lib/nx-match.h	2
lib/multipath.c	1
lib/bundle.c	1
lib/ofp-prop.c	12
./include/openvswitch/ofp-prop.h	1
lib/ofp-ed-props.c	1
lib/ofp-errors.c	7
./lib/bitmap.h	13
./include/openvswitch/ofp-group.h	1
lib/ofp-table.c	54
lib/ofp-util.c	4
lib/ofp-switch.c	9
lib/netdev.c	4
lib/ofp-packet.c	13
lib/match.c	150
lib/tun-metadata.c	8
./include/openvswitch/nsh.h	10
lib/uuid.c	1
lib/dp-packet.c	3
./lib/dp-packet.h	20
lib/ofp-monitor.c	15
lib/ofp-match.c	20
lib/ox-stat.c	12
lib/ofp-flow.c	14
lib/ofp-meter.c	15
lib/ofp-queue.c	20
lib/ofp-connection.c	18
lib/ofp-bundle.c	6
lib/ofp-ipfix.c	7
lib/ofp-ct.c	5

Fuzzer: flow_extract_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1081	62.9%
gold	[1:9]	7	0.40%
yellow	[10:29]	20	1.16%
greenyellow	[30:49]	8	0.46%
lawngreen	50+	600	34.9%
All colors	1716	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
196	204	4 : View List ['pt_ns', 'pt_ns_type', 'put_u16_masked', 'ds_put_char.382']	196	279	format_packet_type_masked	call site: 01471	/src/openvswitch/lib/flow.c:1578
182	182	1 : View List ['namemap_put_name']	182	182	ofputil_format_port	call site: 01379	/src/openvswitch/lib/ofp-port.c:254
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00158	/src/openvswitch/lib/util.c:151
38	45	11 : View List ['match_set_ct_tp_dst', 'htons', 'match_set_ct_state', 'match_set_ct_nw_src', 'match_set_ct_nw_dst', 'match_set_ct_ipv6_dst', 'match_set_ct_ipv6_src', 'match_set_ct_nw_proto', 'match_set_ct_tp_src', 'is_ct_valid', 'match_set_dl_type']	50	59	flow_get_metadata	call site: 01174	/src/openvswitch/lib/flow.c:1326
10	163	5 : View List ['ipv6_count_cidr_bits', 'ds_put_char.3897', 'ipv6_format_addr', 'ds_put_format', 'ipv6_is_cidr']	10	163	ipv6_format_masked	call site: 01448	/src/openvswitch/lib/packets.c:943
4	4	1 : View List ['pt_ns_type_be']	2966	3140	miniflow_extract	call site: 00034	/src/openvswitch/lib/flow.c:833
4	4	1 : View List ['match_set_tun_id']	122	241	flow_get_metadata	call site: 01124	/src/openvswitch/lib/flow.c:1263
4	4	1 : View List ['match_set_tun_flags']	118	237	flow_get_metadata	call site: 01126	/src/openvswitch/lib/flow.c:1266
4	4	1 : View List ['match_set_tun_src']	114	233	flow_get_metadata	call site: 01128	/src/openvswitch/lib/flow.c:1270
4	4	1 : View List ['match_set_tun_dst']	110	229	flow_get_metadata	call site: 01130	/src/openvswitch/lib/flow.c:1273
4	4	1 : View List ['match_set_tun_gbp_id']	100	207	flow_get_metadata	call site: 01138	/src/openvswitch/lib/flow.c:1282
4	4	1 : View List ['match_set_tun_gbp_flags']	96	203	flow_get_metadata	call site: 01139	/src/openvswitch/lib/flow.c:1285

Runtime coverage analysis

Covered functions

392

Functions that are reachable but not covered

489

Reachable functions

690

Percentage of reachable functions covered

29.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/flow_extract_target.c	3
lib/dp-packet.c	2
./lib/dp-packet.h	14
lib/flow.c	42
./lib/flow.h	13
./lib/packets.h	20
./lib/util.h	4
./lib/unaligned.h	3
./lib/byte-order.h	5
lib/vlog.c	40
lib/ovs-thread.c	14
lib/util.c	41
lib/token-bucket.c	1
lib/timeval.c	16
lib/coverage.c	8
lib/unixctl.c	6
lib/shash.c	14
./lib/hash.h	10
lib/hash.c	1
lib/svec.c	8
lib/dynamic-string.c	19
lib/json.c	19
lib/jsonrpc.c	11
./include/openvswitch/json.h	2
./include/openvswitch/dynamic-string.h	1
./include/openvswitch/hmap.h	10
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	14
lib/packets.c	10
lib/dns-resolve-stub.c	1
./lib/socket-util.h	1
lib/socket-util-unix.c	7
lib/fatal-signal.c	9
lib/async-append-aio.c	7
lib/byteq.c	10
lib/signals.c	2
lib/sset.c	8
lib/hmap.c	11
./include/openvswitch/util.h	1
lib/random.c	5
lib/entropy.c	2
lib/ofpbuf.c	5
./include/openvswitch/list.h	5
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
./lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/seq.c	7
lib/latch-unix.c	2
./lib/sat-math.h	2
./include/openvswitch/nsh.h	8
lib/match.c	71
lib/tun-metadata.c	6
lib/jhash.c	4
lib/ofp-match.c	3
lib/ofp-print.c	2
lib/ofp-port.c	3
lib/namemap.c	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
dpif_dummy_register	/src/openvswitch/lib/dpif-netdev.c	1	['int ']	81	0	103	19	7	2150	0	9003	5211
ovsdb_idl_txn_commit_block	/src/openvswitch/lib/ovsdb-idl.c	1	['struct.ovsdb_idl_txn *']	83	0	42	6	3	1038	0	4043	1844
netdev_tc_flow_put	/src/openvswitch/lib/netdev-offload-tc.c	7	['struct.netdev.903 *', 'struct.match *', 'struct.anon.11 *', 'size_t ', 'union.ovs_u128 *', 'struct.offload_info *', 'struct.dpif_flow_stats *']	68	0	2109	217	72	727	0	2923	940
dpctl_dump_flows	/src/openvswitch/lib/dpctl.c	3	['int ', 'char **', 'struct.dpctl_params *']	82	0	464	72	27	1347	0	6217	532
htb_tc_install	/src/openvswitch/lib/netdev-linux.c	2	['struct.netdev.751 *', 'struct.smap *']	73	0	59	9	4	720	0	2582	385
ssl_connect	/src/openvswitch/lib/stream-ssl.c	1	['struct.stream.221 *']	74	0	290	46	13	504	0	1669	222
dpif_netlink_operate	/src/openvswitch/lib/dpif-netlink.c	4	['struct.dpif.2523 *', 'struct.dpif_op **', 'size_t ', 'int ']	81	0	234	42	15	970	0	4226	212

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

4361/9348

Cyclomatic complexity statically reachable by fuzzers

22524 / 40941

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ofpraw_put__	49	25	51.02%	['ofctl_parse_target']
vlog_set_levels_from_string	71	30	42.25%	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
vlog_valist	68	7	10.29%	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
vlog_should_drop	34	5	14.70%	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
ovs_parse_tnl_push	235	30	12.76%	['odp_target']
check_attr_len	34	13	38.23%	['odp_target']
ofpraw_from_ofphdrs	31	17	54.83%	['ofp_print_target']
parse_intel_port_stats_rfc2819_property	34	6	17.64%	['ofp_print_target']
flow_get_metadata	92	31	33.69%	['flow_extract_target']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/openvswitch/lib/dpif-netdev-private-extract.c	[]	[]
/src/openvswitch/lib/vlog.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/ovs-thread.h	[]	[]
/src/openvswitch/lib/tnl-neigh-cache.c	[]	[]
/src/openvswitch/lib/userspace-tso.c	[]	[]
/src/openvswitch/lib/ovsdb-idl.c	[]	[]
/src/openvswitch/lib/netlink-conntrack.c	[]	[]
/src/openvswitch/lib/ofp-msgs.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/shash.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/nx-match.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/ofp-meter.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/odp-execute.c	[]	[]
/src/openvswitch/./lib/dpif-netdev-private-dfc.h	[]	[]
/src/openvswitch/./lib/ovs-atomic-flag-gcc4.7+.h	[]	[]
/src/openvswitch/./include/openvswitch/util.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/ofp-connection.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/./lib/ovs-atomic.h	['ofctl_parse_target']	[]
/src/openvswitch/lib/crc32c.c	[]	[]
/src/openvswitch/./include/openvswitch/dynamic-string.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/dpif-netdev-lookup.c	[]	[]
/src/openvswitch/lib/ofpbuf.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['ofctl_parse_target', 'odp_target', 'ofp_print_target']
/src/openvswitch/./lib/flow.h	['miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/tests/oss-fuzz/flow_extract_target.c	['flow_extract_target']	['flow_extract_target']
/src/openvswitch/lib/flow.c	['miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/netdev-native-tnl.c	[]	[]
/src/openvswitch/lib/id-fpool.c	[]	[]
/src/openvswitch/./lib/csum.h	['odp_target']	[]
/src/openvswitch/./lib/ovs-replay.h	[]	[]
/src/openvswitch/lib/dpif-netdev-perf.c	[]	[]
/src/openvswitch/lib/conntrack-other.c	[]	[]
/src/openvswitch/lib/fatal-signal.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/pvector.c	[]	[]
/src/openvswitch/./lib/pvector.h	[]	[]
/src/openvswitch/./include/openvswitch/json.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/csum.c	['odp_target']	[]
/src/openvswitch/lib/dpctl.c	[]	[]
/src/openvswitch/lib/stream.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/classifier-private.h	['miniflow_target']	[]
/src/openvswitch/./lib/netdev-offload.h	[]	[]
/src/openvswitch/lib/ipf.c	[]	[]
/src/openvswitch/./include/openvswitch/list.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/netlink-notifier.c	[]	[]
/src/openvswitch/lib/bundle.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/ct-dpif.c	[]	[]
/src/openvswitch/lib/backtrace.c	[]	[]
/src/openvswitch/./lib/random.h	['miniflow_target']	[]
/src/openvswitch/lib/meta-flow.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/route-table.c	[]	[]
/src/openvswitch/./lib/socket-util.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/./include/openvswitch/ofp-group.h	['ofp_print_target']	[]
/src/openvswitch/lib/dp-packet.c	['miniflow_target', 'ofp_print_target', 'flow_extract_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/dpif-netlink.c	[]	[]
/src/openvswitch/lib/token-bucket.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/./lib/hindex.h	[]	[]
/src/openvswitch/lib/tc.c	[]	[]
/src/openvswitch/lib/hmap.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/ofp-errors.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/conntrack-tcp.c	[]	[]
/src/openvswitch/lib/reconnect.c	[]	[]
/src/openvswitch/./include/openvswitch/ofp-prop.h	['ofp_print_target']	[]
/src/openvswitch/lib/tnl-ports.c	[]	[]
/src/openvswitch/./lib/timer.h	[]	[]
/src/openvswitch/lib/netdev-linux.c	[]	[]
/src/openvswitch/lib/stream-ssl.c	[]	[]
/src/openvswitch/lib/coverage.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/ofp-errors.inc	[]	[]
/src/openvswitch/lib/cmap.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/tests/oss-fuzz/ofctl_parse_target.c	['ofctl_parse_target']	['ofctl_parse_target']
/src/openvswitch/lib/ofp-parse.c	['ofctl_parse_target']	['ofctl_parse_target']
/src/openvswitch/./include/openvswitch/meta-flow.h	['ofctl_parse_target', 'ofp_print_target']	[]
/src/openvswitch/lib/classifier.c	[]	[]
/src/openvswitch/lib/ovsdb-types.c	[]	[]
/src/openvswitch/lib/ofp-ipfix.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/ovs-numa.c	[]	[]
/src/openvswitch/lib/stream-tcp.c	[]	[]
/src/openvswitch/lib/ovsdb-session.c	[]	[]
/src/openvswitch/./lib/ovsdb-types.h	[]	[]
/src/openvswitch/./include/openvswitch/ofp-actions.h	['ofctl_parse_target', 'ofp_print_target']	[]
/src/openvswitch/lib/dpif-netdev-lookup-generic.c	[]	[]
/src/openvswitch/lib/byteq.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/dpif-netdev-private-dfc.c	[]	[]
/src/openvswitch/lib/dpif.c	[]	[]
/src/openvswitch/./lib/netdev-afxdp.h	[]	[]
/src/openvswitch/lib/svec.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/ofp-protocol.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/ofp-queue.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/tests/oss-fuzz/ofp_print_target.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/timeval.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/netlink-socket.c	[]	[]
/src/openvswitch/lib/ofp-monitor.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/dpif-netdev-extract-study.c	[]	[]
/src/openvswitch/lib/guarded-list.c	[]	[]
/src/openvswitch/./lib/nx-match.h	['ofp_print_target']	[]
/src/openvswitch/lib/ofp-actions.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/syslog-direct.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/./lib/netdev-linux-private.h	[]	[]
/src/openvswitch/lib/smap.c	[]	[]
/src/openvswitch/./lib/ofp-actions.inc2	['ofctl_parse_target', 'ofp_print_target']	[]
/src/openvswitch/lib/ofp-bundle.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/./lib/uuid.h	[]	[]
/src/openvswitch/lib/ofp-packet.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/sset.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target']
/src/openvswitch/lib/aes128.c	[]	[]
/src/openvswitch/lib/ovsdb-error.c	[]	[]
/src/openvswitch/lib/dynamic-string.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/syslog-null.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/seq.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/unicode.h	['json_parser_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/multipath.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/dpdk-stub.c	[]	[]
/src/openvswitch/lib/signals.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/match.c	['ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/tc.h	[]	[]
/src/openvswitch/./lib/netdev-native-tnl.h	[]	[]
/src/openvswitch/./lib/dpif-provider.h	[]	[]
/src/openvswitch/lib/colors.c	[]	[]
/src/openvswitch/./include/openvswitch/thread.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/./lib/dirs.c.in	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/tests/oss-fuzz/miniflow_target.c	['miniflow_target']	['miniflow_target']
/src/openvswitch/lib/ovs-rcu.c	[]	[]
/src/openvswitch/lib/ovsdb-map-op.c	[]	[]
/src/openvswitch/./lib/classifier.h	[]	[]
/src/openvswitch/lib/uuid.c	['odp_target', 'ofp_print_target']	['odp_target', 'ofp_print_target']
/src/openvswitch/lib/json.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-prop.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/dpif-netdev-private-dpif.c	[]	[]
/src/openvswitch/./lib/netdev-vport-private.h	[]	[]
/src/openvswitch/lib/hmapx.c	[]	[]
/src/openvswitch/tests/oss-fuzz/json_parser_target.c	['json_parser_target']	['json_parser_target']
/src/openvswitch/lib/poll-loop.c	[]	[]
/src/openvswitch/./lib/versions.h	[]	[]
/src/openvswitch/lib/sha1.c	[]	[]
/src/openvswitch/./include/openvswitch/ofpbuf.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/unixctl.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/ovsdb-data.h	[]	[]
/src/openvswitch/lib/netlink.c	['odp_target']	['odp_target']
/src/openvswitch/lib/odp-util.c	['odp_target']	['odp_target']
/src/openvswitch/lib/id-pool.c	[]	[]
/src/openvswitch/lib/socket-util.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/sat-math.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/./lib/netdev-provider.h	[]	[]
/src/openvswitch/lib/conntrack.c	[]	[]
/src/openvswitch/lib/dns-resolve-stub.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/ofp-util.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/netdev-offload-tc.c	[]	[]
/src/openvswitch/lib/hindex.c	[]	[]
/src/openvswitch/./lib/unaligned.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/./lib/byte-order.h	['miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/unicode.c	['json_parser_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/latch-unix.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/ccmap.c	[]	[]
/src/openvswitch/lib/ofp-group.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/./lib/hash.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/socket-util-unix.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/ovs-thread.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/stream-provider.h	[]	[]
/src/openvswitch/lib/odp-execute-private.c	[]	[]
/src/openvswitch/lib/mpsc-queue.c	[]	[]
/src/openvswitch/lib/ovsdb-cs.c	[]	[]
/src/openvswitch/lib/rtnetlink.c	[]	[]
/src/openvswitch/./lib/dpif-netdev-private-dpcls.h	[]	[]
/src/openvswitch/./include/openvswitch/hmap.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/./include/openvswitch/nsh.h	['miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/jhash.c	['flow_extract_target']	['flow_extract_target']
/src/openvswitch/./lib/rculist.h	[]	[]
/src/openvswitch/./lib/dp-packet.h	['miniflow_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/connectivity.c	[]	[]
/src/openvswitch/lib/packets.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/ovsdb-data.c	[]	[]
/src/openvswitch/lib/entropy.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/stream-replay.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/cmap.h	['ofp_print_target']	[]
/src/openvswitch/lib/conntrack-icmp.c	[]	[]
/src/openvswitch/lib/skiplist.c	[]	[]
/src/openvswitch/./lib/dpif-netdev-perf.h	[]	[]
/src/openvswitch/lib/fat-rwlock.c	[]	[]
/src/openvswitch/lib/dpif-netlink-rtnl.c	[]	[]
/src/openvswitch/lib/ofp-ed-props.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/dpif-netdev-lookup-autovalidator.c	[]	[]
/src/openvswitch/lib/ofp-flow.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/ox-stat.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/timer.c	[]	[]
/src/openvswitch/lib/jsonrpc.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/ovs-replay.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/simap.c	['odp_target']	[]
/usr/include/openssl/x509.h	[]	[]
/src/openvswitch/lib/learn.c	[]	[]
/src/openvswitch/lib/conntrack-tp.c	[]	[]
/src/openvswitch/./lib/util.h	['miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/hash.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/ovsdb-parser.c	[]	[]
/src/openvswitch/./lib/syslog-provider.h	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/ofp-print.c	['ofp_print_target', 'flow_extract_target']	['ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/netdev-vport.c	[]	[]
/src/openvswitch/lib/ofp-table.c	['ofctl_parse_target', 'ofp_print_target']	['ofctl_parse_target', 'ofp_print_target']
/src/openvswitch/lib/ovsdb-condition.c	[]	[]
/src/openvswitch/./lib/mov-avg.h	[]	[]
/src/openvswitch/lib/ofp-match.c	['ofctl_parse_target', 'ofp_print_target', 'flow_extract_target']	['ofctl_parse_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/./lib/dpif-netdev-private-flow.h	[]	[]
/src/openvswitch/lib/ofp-switch.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/./lib/netdev-dpdk.h	[]	[]
/src/openvswitch/./lib/packets.h	['miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/syslog-libc.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/tests/oss-fuzz/odp_target.c	['odp_target']	['odp_target']
/src/openvswitch/lib/dpif-netdev.c	[]	[]
/src/openvswitch/lib/vswitch-idl.c	[]	[]
/src/openvswitch/lib/stream-fd.c	[]	[]
/src/openvswitch/./lib/netlink.h	['odp_target']	[]
/src/openvswitch/./lib/netnsid.h	[]	[]
/src/openvswitch/lib/netdev.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/stream-unix.c	[]	[]
/src/openvswitch/lib/sort.c	[]	[]
/src/openvswitch/./lib/bitmap.h	['ofctl_parse_target', 'odp_target', 'ofp_print_target']	[]
/src/openvswitch/lib/ovs-router.c	[]	[]
/src/openvswitch/lib/util.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/namemap.c	['ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/ofp-ct.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/async-append-aio.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	[]
/src/openvswitch/lib/netdev-offload.c	[]	[]
/src/openvswitch/lib/dhparams.c	[]	[]
/src/openvswitch/lib/random.c	['json_parser_target', 'miniflow_target', 'ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['miniflow_target']
/src/openvswitch/lib/ovsdb-set-op.c	[]	[]
/src/openvswitch/lib/tun-metadata.c	['ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/ofp-port.c	['ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']	['ofctl_parse_target', 'odp_target', 'ofp_print_target', 'flow_extract_target']

Directories in report

Directory
/src/openvswitch/tests/oss-fuzz/
/usr/include/openssl/
/src/openvswitch/./include/openvswitch/
/src/openvswitch/./lib/
/src/openvswitch/lib/

This section shows a chosen list of functions / methods calls and their relative coverage information. By static analysis of the target project code, all of these function call and their caller information, including the source file or class and line number that initiate the call are captured. Column 1 is the function name of that selected functions or methods. Column 2 of each row indicate if the target function covered by any fuzzer calltree information. Column 3 lists all fuzzers (or no fuzzers at all) that have coered that particular function call dynamically. Column 4 shows list of parent function for the specific function call, while column 5 shows possible blocker functions that make the fuzzers fail to reach the specific functions. Both column 4 and 5 will only show information if none of the fuzzers cover the target function calls.

Function in each files in report

Target sink	Callsite location	Reached by fuzzer	Function call path	Covered by fuzzer	Possible branch blockers