High level conclusions

Fuzzer flow_extract_target is blocked:

The runtime code coverage of flow_extract_target covers 28.92% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer miniflow_target is blocked:

The runtime code coverage of miniflow_target covers 27.42% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer json_parser_target is blocked:

The runtime code coverage of json_parser_target covers 29.30% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 31.35% of cyclomatic complexity.

Fuzzers reach 24.85% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

2481 / 9982

Cyclomatic complexity statically reachable by fuzzers

13585 / 43328

Runtime code coverage of functions

2401 / 9982

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: json_parser_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	924	71.1%
gold	[1:9]	19	1.46%
yellow	[10:29]	18	1.38%
greenyellow	[30:49]	6	0.46%
lawngreen	50+	331	25.5%
All colors	1298	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1500	1500	1 : View List ['cooperative_multitasking_yield_at']	3000	3039	json_destroy_object	call site: 00351	/src/openvswitch/lib/json.c:566
1500	1500	1 : View List ['cooperative_multitasking_yield_at']	3000	3008	json_destroy_array	call site: 00380	/src/openvswitch/lib/json.c:589
1500	1500	1 : View List ['cooperative_multitasking_yield_at']	1500	4679	json_serialize_object	call site: 00421	/src/openvswitch/lib/json.c:1856
1500	1500	1 : View List ['cooperative_multitasking_yield_at']	1500	3318	json_serialize_array	call site: 00453	/src/openvswitch/lib/json.c:1893
50	50	1 : View List ['out_of_memory']	50	50	xcalloc__	call site: 00009	/src/openvswitch/lib/util.c:126
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00046	/src/openvswitch/lib/util.c:142
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00056	/src/openvswitch/lib/util.c:152
2	2	1 : View List ['abort']	2	2	json_parser_put_value	call site: 00060	/src/openvswitch/lib/json.c:1479
2	2	1 : View List ['abort']	2	2	json_parser_pop	call site: 01124	/src/openvswitch/lib/json.c:1599
0	82	1 : View List ['ds_put_utf8']	0	82	ds_put_utf8	call site: 01226	/src/openvswitch/lib/dynamic-string.c:99
0	73	1 : View List ['ds_put_char__']	0	73	ds_put_char	call site: 00261	/src/openvswitch/./include/openvswitch/dynamic-string.h:95
0	11	2 : View List ['hmap_next', 'hmap_first']	0	1587	json_serialize_object	call site: 00425	/src/openvswitch/lib/json.c:1860

Runtime coverage analysis

Covered functions

200

Functions that are reachable but not covered

357

Reachable functions

505

Percentage of reachable functions covered

29.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/json_parser_target.c	1
lib/json.c	51
lib/util.c	46
lib/shash.c	20
lib/hmap.c	13
lib/hash.h	9
lib/hash.c	1
lib/unaligned.h	2
./include/openvswitch/hmap.h	11
./include/openvswitch/util.h	1
lib/vlog.c	47
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	17
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	2
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/svec.c	8
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	14
lib/ofpbuf.c	5
./include/openvswitch/list.h	7
lib/async-append-aio.c	7
lib/byteq.c	10
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/token-bucket.c	1
lib/sat-math.h	2
lib/unicode.h	2
lib/unicode.c	1

Fuzzer: miniflow_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1115	72.4%
gold	[1:9]	31	2.01%
yellow	[10:29]	23	1.49%
greenyellow	[30:49]	10	0.65%
lawngreen	50+	359	23.3%
All colors	1538	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1515	1515	2 : View List ['vlog', 'ovs_retval_to_string']	1515	1515	get_entropy	call site: 00934	/src/openvswitch/lib/entropy.c:53
1515	1515	2 : View List ['ovs_retval_to_string', 'vlog_fatal']	1515	1515	get_entropy_or_die	call site: 00924	/src/openvswitch/lib/entropy.c:78
1513	1513	3 : View List ['ovs_strerror', 'vlog_fatal', '__errno_location']	1513	1513	xgettimeofday	call site: 00921	/src/openvswitch/lib/timeval.c:490
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00166	/src/openvswitch/lib/util.c:142
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00103	/src/openvswitch/lib/util.c:152
17	17	2 : View List ['ovs_strerror', '__errno_location']	1517	1517	get_entropy	call site: 00925	/src/openvswitch/lib/entropy.c:45
4	4	1 : View List ['pt_ns_type_be']	3136	3327	miniflow_extract	call site: 00050	/src/openvswitch/lib/flow.c:873
4	4	1 : View List ['pt_ns_type_be']	16	48	flow_wildcards_init_for_packet	call site: 01434	/src/openvswitch/lib/flow.c:1957
2	2	1 : View List ['ovs_u128_is_zero']	3154	3360	miniflow_extract	call site: 00040	/src/openvswitch/lib/flow.c:843
0	0	None	3154	3362	miniflow_extract	call site: 00031	/src/openvswitch/lib/flow.c:815
0	0	None	3154	3362	miniflow_extract	call site: 00037	/src/openvswitch/lib/flow.c:837
0	0	None	3152	3358	miniflow_extract	call site: 00044	/src/openvswitch/lib/flow.c:856

Runtime coverage analysis

Covered functions

394

Functions that are reachable but not covered

442

Reachable functions

609

Percentage of reachable functions covered

27.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/miniflow_target.c	8
lib/dp-packet.c	3
lib/dp-packet.h	23
lib/packets.h	9
lib/flow.c	51
lib/flow.h	25
lib/util.h	5
lib/unaligned.h	3
lib/byte-order.h	2
lib/vlog.c	47
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	19
lib/util.c	42
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	2
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	17
lib/hash.h	10
lib/hash.c	1
./include/openvswitch/hmap.h	11
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	23
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	5
./include/openvswitch/list.h	7
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
./include/openvswitch/nsh.h	6
./lib/flow.h	15
./lib/util.h	4
./lib/packets.h	1
./lib/hash.h	7
./lib/classifier-private.h	3
./lib/random.h	1

Fuzzer: ofp_print_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1602	25.3%
gold	[1:9]	43	0.68%
yellow	[10:29]	107	1.69%
greenyellow	[30:49]	93	1.47%
lawngreen	50+	4472	70.7%
All colors	6317	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6388	6388	3 : View List ['vlog', 'match_to_string', 'free']	6388	6388	ofputil_normalize_match__	call site: 04623	/src/openvswitch/lib/ofp-match.c:970
1692	3231	4 : View List ['ofpmsg_body', 'nx_match_to_string', 'ntohs', 'free']	1692	7797	ofputil_flow_mod_format	call site: 04990	/src/openvswitch/lib/ofp-flow.c:542
1587	1587	1 : View List ['ofp10_match_print']	1587	7617	ofputil_flow_mod_format	call site: 04988	/src/openvswitch/lib/ofp-flow.c:536
1510	1510	1 : View List ['namemap_put_name']	1510	1510	ofputil_format_port	call site: 01630	/src/openvswitch/lib/ofp-port.c:254
1510	1510	1 : View List ['namemap_put_name']	1510	1510	ofputil_format_table	call site: 02605	/src/openvswitch/lib/ofp-table.c:203
73	75	2 : View List ['ds_destroy', 'ds_put_buffer']	73	603	ofputil_format_port_stats	call site: 05810	/src/openvswitch/lib/ofp-port.c:1799
50	50	1 : View List ['out_of_memory']	50	50	xcalloc__	call site: 02264	/src/openvswitch/lib/util.c:126
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00010	/src/openvswitch/lib/util.c:142
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00066	/src/openvswitch/lib/util.c:152
50	50	1 : View List ['ovs_fatal']	50	50	vlog_set_verbosity	call site: 00002	/src/openvswitch/lib/vlog.c:611
20	20	1 : View List ['hash_words__']	20	20	hash_words	call site: 01115	/src/openvswitch/lib/hash.h:358
6	1506	4 : View List ['ntohl', 'htons', 'vlog_rate_limit', 'ntohs']	6	3032	parse_async_tlv	call site: 05966	/src/openvswitch/lib/ofp-connection.c:366

Runtime coverage analysis

Covered functions

1639

Functions that are reachable but not covered

436

Reachable functions

1842

Percentage of reachable functions covered

76.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/ofp_print_target.c	1
lib/vlog.c	48
lib/util.c	54
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	24
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	18
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	17
lib/hash.h	16
lib/hash.c	2
lib/unaligned.h	9
./include/openvswitch/hmap.h	13
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	24
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	22
./include/openvswitch/list.h	10
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	14
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/ofp-print.c	60
lib/ofp-msgs.c	29
lib/ofp-group.c	35
lib/byte-order.h	6
lib/ofp-actions.c	269
lib/ofp-protocol.c	9
lib/ofp-actions.inc2	1
./include/openvswitch/ofp-actions.h	133
lib/flow.h	33
lib/ofp-port.c	43
lib/packets.h	22
lib/util.h	16
lib/meta-flow.c	39
lib/nx-match.c	51
./include/openvswitch/meta-flow.h	1
lib/cmap.c	9
lib/cmap.h	1
lib/namemap.c	3
lib/flow.c	64
lib/nx-match.h	2
lib/multipath.c	2
lib/bundle.c	2
lib/ofp-prop.c	15
./include/openvswitch/ofp-prop.h	1
lib/ofp-ed-props.c	3
lib/ofp-errors.c	7
lib/bitmap.h	13
lib/ofp-packet.c	12
lib/ofp-table.c	54
lib/learn.c	2
lib/match.c	150
./include/openvswitch/ofp-group.h	1
lib/ofp-util.c	4
lib/ofp-switch.c	9
lib/netdev.c	4
lib/tun-metadata.c	9
./include/openvswitch/nsh.h	10
lib/uuid.c	1
lib/dp-packet.c	3
lib/dp-packet.h	27
lib/ofp-monitor.c	15
lib/ofp-match.c	20
lib/ox-stat.c	12
lib/ofp-flow.c	14
lib/ofp-meter.c	16
lib/ofp-queue.c	20
lib/ofp-connection.c	18
lib/ofp-bundle.c	6
lib/ofp-ipfix.c	7
lib/ofp-ct.c	5

Fuzzer: flow_extract_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1294	62.3%
gold	[1:9]	12	0.57%
yellow	[10:29]	20	0.96%
greenyellow	[30:49]	21	1.01%
lawngreen	50+	728	35.0%
All colors	2075	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1510	1510	1 : View List ['namemap_put_name']	1510	1510	ofputil_format_port	call site: 01707	/src/openvswitch/lib/ofp-port.c:254
196	204	4 : View List ['pt_ns', 'pt_ns_type', 'put_u16_masked', 'ds_put_char.463']	196	279	format_packet_type_masked	call site: 01806	/src/openvswitch/lib/flow.c:1634
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00103	/src/openvswitch/lib/util.c:152
38	45	11 : View List ['match_set_ct_nw_proto', 'match_set_dl_type', 'match_set_ct_nw_dst', 'is_ct_valid', 'match_set_ct_nw_src', 'match_set_ct_ipv6_src', 'htons', 'match_set_ct_tp_dst', 'match_set_ct_state', 'match_set_ct_ipv6_dst', 'match_set_ct_tp_src']	50	59	flow_get_metadata	call site: 01504	/src/openvswitch/lib/flow.c:1382
10	163	5 : View List ['ipv6_format_addr', 'ipv6_is_cidr', 'ipv6_count_cidr_bits', 'ds_put_format', 'ds_put_char.4234']	10	163	ipv6_format_masked	call site: 01783	/src/openvswitch/lib/packets.c:942
4	4	1 : View List ['pt_ns_type_be']	3136	3327	miniflow_extract	call site: 00050	/src/openvswitch/lib/flow.c:873
4	4	1 : View List ['match_set_tun_id']	122	241	flow_get_metadata	call site: 01453	/src/openvswitch/lib/flow.c:1319
4	4	1 : View List ['match_set_tun_flags']	118	237	flow_get_metadata	call site: 01455	/src/openvswitch/lib/flow.c:1322
4	4	1 : View List ['match_set_tun_src']	114	233	flow_get_metadata	call site: 01457	/src/openvswitch/lib/flow.c:1326
4	4	1 : View List ['match_set_tun_dst']	110	229	flow_get_metadata	call site: 01459	/src/openvswitch/lib/flow.c:1329
4	4	1 : View List ['match_set_tun_gbp_id']	100	207	flow_get_metadata	call site: 01467	/src/openvswitch/lib/flow.c:1338
4	4	1 : View List ['match_set_tun_gbp_flags']	96	203	flow_get_metadata	call site: 01468	/src/openvswitch/lib/flow.c:1341

Runtime coverage analysis

Covered functions

435

Functions that are reachable but not covered

511

Reachable functions

719

Percentage of reachable functions covered

28.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/flow_extract_target.c	3
lib/dp-packet.c	3
lib/dp-packet.h	28
lib/packets.h	21
lib/flow.c	53
lib/flow.h	14
lib/util.h	5
lib/unaligned.h	3
lib/byte-order.h	5
lib/vlog.c	47
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	20
lib/util.c	44
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	10
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	17
lib/hash.h	10
lib/hash.c	1
./include/openvswitch/hmap.h	13
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	24
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	5
./include/openvswitch/list.h	7
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
./include/openvswitch/nsh.h	8
./lib/dp-packet.h	4
lib/match.c	71
lib/tun-metadata.c	6
lib/jhash.c	4
lib/ofp-match.c	3
lib/ofp-print.c	3
lib/ofp-port.c	3
lib/namemap.c	3

Fuzzer: odp_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1876	51.4%
gold	[1:9]	71	1.94%
yellow	[10:29]	41	1.12%
greenyellow	[30:49]	7	0.19%
lawngreen	50+	1648	45.2%
All colors	3643	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1535	1537	2 : View List ['nl_attr_get_size', 'odp_nsh_key_from_attr__']	1575	8269	parse_l2_5_onward	call site: 02345	/src/openvswitch/lib/odp-util.c:7174
1500	1500	1 : View List ['vlog_rate_limit']	1500	1500	nl_attr_validate	call site: 01650	/src/openvswitch/lib/netlink.c:895
1500	1500	1 : View List ['vlog_rate_limit']	1500	1500	odp_to_ovs_frag	call site: 02329	/src/openvswitch/lib/odp-util.c:6862
188	426	4 : View List ['ds_put_char.14351', 'nl_attr_get_size', 'format_generic_odp_key', 'ds_put_format']	188	426	check_attr_len	call site: 01733	/src/openvswitch/lib/odp-util.c:3770
131	131	1 : View List ['format_odp_set_nsh']	131	131	format_odp_action	call site: 03403	/src/openvswitch/lib/odp-util.c:1230
104	104	1 : View List ['odp_put_tnl_push_action']	104	104	parse_odp_action__	call site: 03162	/src/openvswitch/lib/odp-util.c:2801
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00012	/src/openvswitch/lib/util.c:142
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00068	/src/openvswitch/lib/util.c:152
50	50	1 : View List ['ovs_fatal']	50	50	vlog_set_verbosity	call site: 00004	/src/openvswitch/lib/vlog.c:611
42	42	2 : View List ['simap_find_len', 'strcspn']	174	12630	parse_odp_action__	call site: 02937	/src/openvswitch/lib/odp-util.c:2515
21	21	3 : View List ['hash_odp_port', 'hmap_first_in_bucket.14430', 'hmap_next_in_bucket.14431']	21	21	odp_portno_names_get	call site: 02070	/src/openvswitch/lib/odp-util.c:3531
4	3288	5 : View List ['nl_msg_start_nested', 'strncasecmp', 'parse_action_list', 'nl_msg_put_u16', 'nl_msg_end_nested']	4	3466	parse_odp_action__	call site: 03062	/src/openvswitch/lib/odp-util.c:2719

Runtime coverage analysis

Covered functions

553

Functions that are reachable but not covered

519

Reachable functions

845

Percentage of reachable functions covered

38.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/odp_target.c	3
lib/vlog.c	48
lib/util.c	58
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	18
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	11
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	17
lib/hash.h	9
lib/hash.c	1
lib/unaligned.h	9
./include/openvswitch/hmap.h	13
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	24
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	16
./include/openvswitch/list.h	7
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	10
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/odp-util.c	149
lib/bitmap.h	6
lib/uuid.c	2
lib/netlink.c	40
lib/util.h	9
lib/flow.c	10
lib/byte-order.h	5
lib/simap.c	3
./include/openvswitch/nsh.h	13
lib/netlink.h	3
lib/odp-util.h	2
lib/tun-metadata.c	14
lib/packets.h	25
lib/flow.h	9
lib/match.c	16
lib/ofp-port.c	3
lib/namemap.c	3
lib/csum.c	3
lib/csum.h	1

Fuzzer: ofctl_parse_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1751	40.1%
gold	[1:9]	227	5.19%
yellow	[10:29]	81	1.85%
greenyellow	[30:49]	74	1.69%
lawngreen	50+	2233	51.1%
All colors	4366	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
1888	6388	3 : View List ['vlog', 'match_to_string', 'free']	1888	6388	ofputil_normalize_match__	call site: 03359	/src/openvswitch/lib/ofp-match.c:970
1543	1543	1 : View List ['put_OFPAT15_COPY_FIELD']	1549	4816	encode_REG_MOVE	call site: 03968	/src/openvswitch/lib/ofp-actions.c:2677
1510	1617	4 : View List ['namemap_put_name', 'ofputil_port_map_get_name', 'ds_cstr', 'ds_destroy']	1510	1622	ofputil_port_to_string	call site: 01248	/src/openvswitch/lib/ofp-port.c:272
1510	1510	1 : View List ['namemap_put_name']	1510	1510	ofputil_format_port	call site: 01802	/src/openvswitch/lib/ofp-port.c:254
50	50	1 : View List ['out_of_memory']	50	50	xmalloc__	call site: 00012	/src/openvswitch/lib/util.c:142
50	50	1 : View List ['out_of_memory']	50	50	xrealloc__	call site: 00068	/src/openvswitch/lib/util.c:152
50	50	1 : View List ['ovs_fatal']	50	50	vlog_set_verbosity	call site: 00004	/src/openvswitch/lib/vlog.c:611
20	20	1 : View List ['hash_words__']	20	20	hash_words	call site: 03405	/src/openvswitch/lib/hash.h:358
14	75	3 : View List ['xmalloc', 'ofpbuf_copy__', 'free']	14	75	ofpbuf_resize__	call site: 02032	/src/openvswitch/lib/ofpbuf.c:260
2	1538	3 : View List ['htonl', 'nxm_header_from_mff', 'nxm_encode_ofs_nbits']	4	1635	encode_BUNDLE	call site: 03807	/src/openvswitch/lib/ofp-actions.c:1518
2	2	1 : View List ['htons']	2	4257	ofputil_encode_flow_mod	call site: 03436	/src/openvswitch/lib/ofp-flow.c:420
0	3191	2 : View List ['mf_nxm_header', 'mf_parse_subfield']	0	3191	bundle_parse__	call site: 02154	/src/openvswitch/lib/bundle.c:225

Runtime coverage analysis

Covered functions

1269

Functions that are reachable but not covered

432

Reachable functions

1476

Percentage of reachable functions covered

70.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/ofctl_parse_target.c	3
lib/vlog.c	48
lib/util.c	67
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	19
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	18
lib/packets.c	21
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	19
lib/hash.h	16
lib/hash.c	2
lib/unaligned.h	2
./include/openvswitch/hmap.h	13
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	27
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	21
./include/openvswitch/list.h	8
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	11
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/ofp-flow.c	7
lib/ofp-parse.c	13
lib/match.c	149
lib/meta-flow.c	43
lib/flow.c	32
lib/bitmap.h	6
lib/util.h	10
lib/ofp-port.c	8
lib/flow.h	31
lib/namemap.c	4
lib/unicode.h	2
lib/unicode.c	1
lib/tun-metadata.c	10
lib/byte-order.h	5
./include/openvswitch/nsh.h	4
lib/packets.h	19
lib/nx-match.c	48
./include/openvswitch/meta-flow.h	1
lib/ofp-table.c	2
lib/ofp-group.c	1
lib/ofp-actions.c	258
./include/openvswitch/ofp-actions.h	133
lib/ofp-packet.c	2
lib/bundle.c	4
lib/ofp-ed-props.c	4
lib/learn.c	5
lib/multipath.c	3
lib/ofp-errors.c	3
lib/ofp-match.c	8
lib/ofp-protocol.c	3
lib/ofp-msgs.c	10
lib/ovs-atomic.h	1
lib/ofp-actions.inc2	74
lib/ofp-prop.c	11
./include/openvswitch/ofp-prop.h	1
lib/nx-match.h	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
dpif_dummy_register	/src/openvswitch/lib/dpif-netdev.c	1	['int']	124	0	97	19	7	2279	0	9502	5560

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3803 / 9982

Cyclomatic complexity statically reachable by fuzzers

19075 / 43328

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/oss-fuzz/json_parser_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['json_parser_abort', 'jsonrpc_msg_to_json', 'xmemdup0', 'ds_put_uninit', 'xcalloc__', 'shash_find', 'xvasprintf', 'ds_put_char__', 'shash_destroy', 'jsonrpc_msg_destroy']

tests/oss-fuzz/miniflow_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['x2nrealloc', 'random_next', 'hash_finish', 'xmalloc', 'xrealloc__', 'miniflow_extract', 'ipv6_addr_is_set', 'get_entropy']

tests/oss-fuzz/ofp_print_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ovs_list_pop_front', 'vlog_set_levels_from_string', 'ovsthread_once_start__', 'ovsthread_once_done', 'ofputil_flow_mod_format', 'vlog_should_drop', 'ds_put_char_multiple', 'x2nrealloc', 'ds_steal_cstr', 'xmalloc']

tests/oss-fuzz/flow_extract_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ds_steal_cstr', 'hash_finish', 'x2nrealloc', 'ds_put_uninit', 'xrealloc__', 'ds_put_char__', 'flow_get_metadata', 'format_flow_tunnel', 'format_packet_type_masked']

tests/oss-fuzz/odp_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ofpbuf_init__', 'ipv6_format_addr', 'x2nrealloc', 'vlog_should_drop', 'ds_cstr', 'vlog_set_levels_from_string', 'ipv6_addr_is_set', 'ovs_parse_tnl_push', 'format_odp_action', 'ds_put_char__']

tests/oss-fuzz/ofctl_parse_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ofpbuf_delete', 'vlog_set_levels_from_string', 'vlog_should_drop', 'vlan_tci_to_vid', 'ovsthread_once_done', 'ipv6_mask_is_any', 'ip_parse', 'ds_steal_cstr', 'ofputil_normalize_match__', 'xmalloc']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ofpraw_from_ofphdrs	31	17	54.83%	['ofp_print_target']
parse_intel_port_stats_rfc2819_property	34	6	17.64%	['ofp_print_target']
vlog_set_levels_from_string	71	30	42.25%	['ofctl_parse_target', 'ofp_print_target', 'odp_target', 'flow_extract_target', 'json_parser_target', 'miniflow_target']
vlog_should_drop	34	5	14.70%	['ofctl_parse_target', 'ofp_print_target', 'odp_target', 'flow_extract_target', 'json_parser_target', 'miniflow_target']
flow_get_metadata	92	31	33.69%	['flow_extract_target']
odp_action_len	39	21	53.84%	['odp_target']
ovs_parse_tnl_push	276	31	11.23%	['odp_target']
check_attr_len	34	13	38.23%	['odp_target']
ofpraw_put__	49	25	51.02%	['ofctl_parse_target']
vlog_valist	68	7	10.29%	['ofctl_parse_target', 'ofp_print_target', 'odp_target', 'flow_extract_target', 'json_parser_target', 'miniflow_target']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/openvswitch/lib/flow.c	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-queue.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/id-pool.c	[]	[]
/src/openvswitch/lib/util.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofpbuf.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['ofp_print_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovsdb-set-op.c	[]	[]
/src/openvswitch/lib/json.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/ofp-table.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovs-replay.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/simap.c	['odp_target']	[]
/src/openvswitch/lib/json.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-bundle.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/conntrack-tp.c	[]	[]
/src/openvswitch/lib/stream-ssl.c	[]	[]
/src/openvswitch/lib/conntrack-tcp.c	[]	[]
/src/openvswitch/lib/rculist.h	[]	[]
/src/openvswitch/lib/entropy.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/colors.c	[]	[]
/src/openvswitch/lib/socket-util-unix.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/syslog-direct.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/hindex.h	[]	[]
/src/openvswitch/tests/oss-fuzz/json_parser_target.c	['json_parser_target']	['json_parser_target']
/src/openvswitch/lib/ofp-msgs.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/netdev-offload-tc.c	[]	[]
/src/openvswitch/lib/dns-resolve-stub.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/netdev-native-tnl.c	[]	[]
/src/openvswitch/lib/dpif-netdev-lookup-generic.c	[]	[]
/src/openvswitch/lib/stream-unix.c	[]	[]
/src/openvswitch/lib/ofp-errors.inc	[]	[]
/src/openvswitch/lib/ovsdb-data.c	[]	[]
/src/openvswitch/lib/ovs-router.c	[]	[]
/src/openvswitch/lib/dpif-netdev-private-dpcls.h	[]	[]
/src/openvswitch/lib/sha1.c	[]	[]
/src/openvswitch/tests/oss-fuzz/miniflow_target.c	['miniflow_target']	['miniflow_target']
/src/openvswitch/lib/netlink.h	['odp_target']	['odp_target']
/src/openvswitch/lib/ofp-actions.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/lockfile.c	[]	[]
/src/openvswitch/lib/nx-match.h	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovsdb-types.c	[]	[]
/src/openvswitch/lib/ovs-atomic-flag-gcc4.7+.h	[]	[]
/src/openvswitch/lib/stream-replay.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/hindex.c	[]	[]
/src/openvswitch/lib/multipath.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/bitmap.h	['ofp_print_target', 'odp_target', 'ofctl_parse_target']	['ofp_print_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif-netdev-private-extract.c	[]	[]
/src/openvswitch/lib/netdev-vport.c	[]	[]
/src/openvswitch/lib/syslog-null.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/ofp-ipfix.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/nx-match.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ipf.c	[]	[]
/src/openvswitch/lib/odp-util.h	['odp_target']	['odp_target']
/src/openvswitch/lib/dpif-netdev-private-dpif.c	[]	[]
/src/openvswitch/lib/rtnetlink.c	[]	[]
/src/openvswitch/lib/jhash.c	['flow_extract_target']	['flow_extract_target']
/src/openvswitch/lib/netlink-conntrack.c	[]	[]
/src/openvswitch/lib/dpif-netlink.c	[]	[]
/src/openvswitch/lib/coverage.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/pvector.c	[]	[]
/src/openvswitch/tests/oss-fuzz/odp_target.c	['odp_target']	['odp_target']
/src/openvswitch/lib/match.c	['ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-ed-props.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/packets.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/conntrack.c	[]	[]
/src/openvswitch/lib/dpif-netdev-lookup.c	[]	[]
/src/openvswitch/lib/dp-packet.c	['miniflow_target', 'ofp_print_target', 'flow_extract_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/netlink.c	['odp_target']	['odp_target']
/src/openvswitch/lib/token-bucket.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/tests/oss-fuzz/ofctl_parse_target.c	['ofctl_parse_target']	['ofctl_parse_target']
/src/openvswitch/lib/stream-fd.c	[]	[]
/src/openvswitch/lib/ovsdb-parser.c	[]	[]
/src/openvswitch/lib/ovs-numa.c	[]	[]
/src/openvswitch/./include/openvswitch/json.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/netdev-native-tnl.h	[]	[]
/src/openvswitch/lib/ofp-packet.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/tc.c	[]	[]
/src/openvswitch/lib/flow.h	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ccmap.c	[]	[]
/src/openvswitch/lib/id-fpool.c	[]	[]
/src/openvswitch/tests/oss-fuzz/flow_extract_target.c	['flow_extract_target']	['flow_extract_target']
/src/openvswitch/lib/dpctl.c	[]	[]
/src/openvswitch/lib/syslog-libc.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/classifier.h	[]	[]
/src/openvswitch/lib/bundle.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/process.c	[]	[]
/src/openvswitch/lib/classifier-private.h	[]	[]
/src/openvswitch/lib/ovsdb-map-op.c	[]	[]
/src/openvswitch/lib/daemon.c	[]	[]
/src/openvswitch/lib/ovsdb-error.c	[]	[]
/src/openvswitch/lib/unicode.c	['json_parser_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/byteq.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/daemon-unix.c	[]	[]
/src/openvswitch/lib/ovsdb-data.h	[]	[]
/src/openvswitch/lib/ofp-errors.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-connection.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/./include/openvswitch/ofpbuf.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/netdev-provider.h	[]	[]
/src/openvswitch/lib/reconnect.c	[]	[]
/src/openvswitch/lib/route-table.c	[]	[]
/src/openvswitch/lib/ovsdb-cs.c	[]	[]
/src/openvswitch/lib/util.h	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/hash.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-match.c	['ofp_print_target', 'flow_extract_target', 'ofctl_parse_target']	['ofp_print_target', 'flow_extract_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/list.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/userspace-tso.c	[]	[]
/src/openvswitch/lib/ofp-switch.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/dp-packet-gso.c	[]	[]
/src/openvswitch/lib/command-line.c	[]	[]
/src/openvswitch/./include/openvswitch/ofp-group.h	['ofp_print_target']	[]
/src/openvswitch/lib/sset.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target']
/src/openvswitch/lib/byte-order.h	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-protocol.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/socket-util.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/netlink-socket.c	[]	[]
/src/openvswitch/lib/classifier.c	[]	[]
/src/openvswitch/lib/ovs-rcu.c	[]	[]
/src/openvswitch/lib/ct-dpif.c	[]	[]
/src/openvswitch/lib/dpif-netlink-rtnl.c	[]	[]
/src/openvswitch/lib/syslog-provider.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/tests/oss-fuzz/ofp_print_target.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/poll-loop.c	[]	[]
/src/openvswitch/lib/async-append-aio.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/random.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['miniflow_target']
/src/openvswitch/lib/tun-metadata.c	['ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/ofp-actions.h	['ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/fat-rwlock.c	[]	[]
/src/openvswitch/lib/dpif-netdev-perf.h	[]	[]
/src/openvswitch/lib/dpif-netdev-lookup-autovalidator.c	[]	[]
/src/openvswitch/lib/ofp-meter.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/netdev-afxdp.h	[]	[]
/src/openvswitch/lib/unaligned.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/hmapx.c	[]	[]
/src/openvswitch/lib/ofp-ct.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/ofp-port.c	['ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif-netdev.c	[]	[]
/src/openvswitch/lib/stream-provider.h	[]	[]
/src/openvswitch/./lib/dirs.c.in	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/netlink-notifier.c	[]	[]
/src/openvswitch/lib/ovs-thread.h	[]	[]
/src/openvswitch/lib/dynamic-string.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/unicode.h	['json_parser_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/seq.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/netdev-offload.c	[]	[]
/src/openvswitch/lib/ovs-thread.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/hash.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'ofctl_parse_target']
/src/openvswitch/lib/netdev-offload.h	[]	[]
/src/openvswitch/lib/dpif-netdev-perf.c	[]	[]
/src/openvswitch/lib/skiplist.c	[]	[]
/src/openvswitch/lib/dpif-netdev-extract-study.c	[]	[]
/src/openvswitch/lib/vswitch-idl.c	[]	[]
/src/openvswitch/lib/random.h	[]	[]
/src/openvswitch/lib/cmap.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/uuid.h	[]	[]
/src/openvswitch/lib/cmap.h	['ofp_print_target']	[]
/src/openvswitch/./include/openvswitch/nsh.h	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/./include/openvswitch/thread.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/./lib/flow.h	['miniflow_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-actions.inc2	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/stream.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-flow.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/versions.h	[]	[]
/src/openvswitch/lib/netdev-dpdk.h	[]	[]
/src/openvswitch/lib/tc.h	[]	[]
/src/openvswitch/lib/ofp-util.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/aes128.c	[]	[]
/usr/include/openssl/x509.h	[]	[]
/src/openvswitch/lib/latch-unix.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/namemap.c	['ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/dhparams.c	[]	[]
/src/openvswitch/lib/timeval.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/packets.h	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/vlog.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/shash.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/csum.h	['odp_target']	[]
/src/openvswitch/lib/socket-util.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/dpif-provider.h	[]	[]
/src/openvswitch/lib/conntrack-icmp.c	[]	[]
/src/openvswitch/lib/timer.c	[]	[]
/src/openvswitch/lib/netdev-vport-private.h	[]	[]
/src/openvswitch/lib/stream-tcp.c	[]	[]
/src/openvswitch/lib/ovsdb-condition.c	[]	[]
/src/openvswitch/lib/tnl-neigh-cache.c	[]	[]
/src/openvswitch/lib/pvector.h	[]	[]
/src/openvswitch/lib/ovs-replay.h	[]	[]
/src/openvswitch/lib/connectivity.c	[]	[]
/src/openvswitch/lib/unixctl.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/meta-flow.h	['ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/meta-flow.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ox-stat.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/dpif-netdev-private-flow.h	[]	[]
/src/openvswitch/lib/ovsdb-session.c	[]	[]
/src/openvswitch/lib/netdev.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/netnsid.h	[]	[]
/src/openvswitch/./include/openvswitch/ofp-prop.h	['ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/svec.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/jsonrpc.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/sat-math.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/signals.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/odp-execute.c	[]	[]
/src/openvswitch/lib/backtrace.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/hmap.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/guarded-list.c	[]	[]
/src/openvswitch/lib/dpif-netdev-private-dfc.h	[]	[]
/src/openvswitch/lib/fatal-signal.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-group.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/sort.c	[]	[]
/src/openvswitch/lib/timer.h	[]	[]
/src/openvswitch/lib/dpif-netdev-private-dfc.c	[]	[]
/src/openvswitch/lib/odp-execute-private.c	[]	[]
/src/openvswitch/lib/ovsdb-types.h	[]	[]
/src/openvswitch/lib/smap.c	[]	[]
/src/openvswitch/lib/hmap.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/uuid.c	['ofp_print_target', 'odp_target']	['ofp_print_target', 'odp_target']
/src/openvswitch/lib/dpdk-stub.c	[]	[]
/src/openvswitch/lib/dp-packet.h	['miniflow_target', 'ofp_print_target', 'flow_extract_target']	['miniflow_target', 'ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/crc32c.c	[]	[]
/src/openvswitch/lib/conntrack-other.c	[]	[]
/src/openvswitch/lib/netdev-linux.c	[]	[]
/src/openvswitch/lib/csum.c	['odp_target']	[]
/src/openvswitch/lib/ofp-print.c	['ofp_print_target', 'flow_extract_target']	['ofp_print_target', 'flow_extract_target']
/src/openvswitch/lib/tnl-ports.c	[]	[]
/src/openvswitch/lib/odp-util.c	['odp_target']	['odp_target']
/src/openvswitch/lib/cooperative-multitasking.c	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovsdb-idl.c	[]	[]
/src/openvswitch/./include/openvswitch/dynamic-string.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/netdev-linux-private.h	[]	[]
/src/openvswitch/./include/openvswitch/util.h	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'flow_extract_target', 'odp_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/ofp-monitor.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/mov-avg.h	[]	[]
/src/openvswitch/lib/mpsc-queue.c	[]	[]
/src/openvswitch/lib/learn.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovs-atomic.h	['ofctl_parse_target']	['ofctl_parse_target']
/src/openvswitch/lib/ofp-parse.c	['ofctl_parse_target']	['ofctl_parse_target']
/src/openvswitch/lib/ofp-prop.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif.c	[]	[]

Directories in report

Directory
/src/openvswitch/./lib/
/src/openvswitch/./include/openvswitch/
/usr/include/openssl/
/src/openvswitch/tests/oss-fuzz/
/src/openvswitch/lib/