High level conclusions

Fuzzer miniflow_target is blocked:

The runtime code coverage of miniflow_target covers 27.42% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer flow_extract_target is blocked:

The runtime code coverage of flow_extract_target covers 28.92% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer json_parser_target is blocked:

The runtime code coverage of json_parser_target covers 29.50% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 31.35% of cyclomatic complexity.

Fuzzers reach 24.85% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

2481 / 9983

Cyclomatic complexity statically reachable by fuzzers

13593 / 43356

Runtime code coverage of functions

2394 / 9983

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: json_parser_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	939	70.9%
gold	[1:9]	20	1.51%
yellow	[10:29]	16	1.20%
greenyellow	[30:49]	7	0.52%
lawngreen	50+	341	25.7%
All colors	1323	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
486	637	json_parser_abort	call site: 00637	jsonrpc_run
110	525	jsonrpc_msg_to_json	call site: 00525	json_to_ds
99	166	xmemdup0	call site: 00166	vlog
39	124	ds_put_uninit	call site: 00124	vlog
28	9	xcalloc__	call site: 00009	out_of_memory
24	289	shash_find	call site: 00289	shash_add
22	318	xvasprintf	call site: 00318	ovs_mutex_lock_at
20	266	ds_put_char__	call site: 00266	time_wall_msec
17	403	shash_destroy	call site: 00403	json_object_put
16	494	jsonrpc_msg_destroy	call site: 00494	jsonrpc_log_msg
14	356	json_destroy__	call site: 00356	cooperative_multitasking_yield_at
9	105	resize	call site: 00105	vlog_should_drop

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

356

Reachable functions

505

Percentage of reachable functions covered

29.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/json_parser_target.c	1
lib/json.c	51
lib/util.c	46
lib/shash.c	20
lib/hmap.c	13
lib/hash.h	9
lib/hash.c	1
lib/unaligned.h	2
./include/openvswitch/hmap.h	11
./include/openvswitch/util.h	1
lib/vlog.c	47
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	17
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	2
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/svec.c	8
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	14
lib/ofpbuf.c	5
./include/openvswitch/list.h	7
lib/async-append-aio.c	7
lib/byteq.c	10
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/token-bucket.c	1
lib/sat-math.h	2
lib/unicode.h	2
lib/unicode.c	1

Fuzzer: flow_extract_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1328	63.2%
gold	[1:9]	10	0.47%
yellow	[10:29]	32	1.52%
greenyellow	[30:49]	19	0.90%
lawngreen	50+	710	33.8%
All colors	2099	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
547	659	ds_steal_cstr	call site: 00659	json_to_string
174	317	hash_finish	call site: 00317	shash_add
165	492	x2nrealloc	call site: 00492	ovs_mutex_lock_at
143	137	ds_put_uninit	call site: 00137	vlog
28	103	xrealloc__	call site: 00103	out_of_memory
28	282	ds_put_char__	call site: 00282	time_wall_msec
23	1527	flow_get_metadata	call site: 01527	is_ct_valid
16	1490	flow_get_metadata	call site: 01490	match_set_tun_gbp_id
16	1899	format_flow_tunnel	call site: 01899	ds_put_hex
13	1831	format_packet_type_masked	call site: 01831	put_u16_masked
13	1885	format_flow_tunnel	call site: 01885	format_flags_masked
10	84	miniflow_extract	call site: 00084	dump_invalid_packet

Runtime coverage analysis

Covered functions

435

Functions that are reachable but not covered

511

Reachable functions

719

Percentage of reachable functions covered

28.93%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/flow_extract_target.c	3
lib/dp-packet.c	3
lib/dp-packet.h	28
lib/packets.h	21
lib/flow.c	53
lib/flow.h	14
lib/util.h	5
lib/unaligned.h	3
lib/byte-order.h	5
lib/vlog.c	47
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	20
lib/util.c	44
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	10
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	17
lib/hash.h	10
lib/hash.c	1
./include/openvswitch/hmap.h	13
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	24
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	5
./include/openvswitch/list.h	7
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
./include/openvswitch/nsh.h	8
./lib/dp-packet.h	4
lib/match.c	71
lib/tun-metadata.c	6
lib/jhash.c	4
lib/ofp-match.c	3
lib/ofp-print.c	3
lib/ofp-port.c	3
lib/namemap.c	3

Fuzzer: miniflow_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1140	71.9%
gold	[1:9]	32	2.02%
yellow	[10:29]	21	1.32%
greenyellow	[30:49]	11	0.69%
lawngreen	50+	380	23.9%
All colors	1584	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
445	492	x2nrealloc	call site: 00492	ovs_mutex_lock_at
243	963	random_next	call site: 00963	fatal_signal_add_file_to_unlink
174	317	hash_finish	call site: 00317	shash_add
139	168	xmalloc	call site: 00168	syslog_direct_create
63	103	xrealloc__	call site: 00103	vlog
14	84	miniflow_extract	call site: 00084	dump_invalid_packet
5	33	ipv6_addr_is_set	call site: 00033	flowmap_set
5	40	miniflow_extract	call site: 00040	flowmap_set
4	946	get_entropy	call site: 00946	vlog
4	955	get_entropy	call site: 00955	vlog
4	1422	miniflow_equal	call site: 01422	flowmap_next_index
3	62	miniflow_extract	call site: 00062	pt_ns_type_be

Runtime coverage analysis

Covered functions

394

Functions that are reachable but not covered

442

Reachable functions

609

Percentage of reachable functions covered

27.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/miniflow_target.c	8
lib/dp-packet.c	3
lib/dp-packet.h	23
lib/packets.h	9
lib/flow.c	51
lib/flow.h	25
lib/util.h	5
lib/unaligned.h	3
lib/byte-order.h	2
lib/vlog.c	47
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	19
lib/util.c	42
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	2
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	17
lib/hash.h	10
lib/hash.c	1
./include/openvswitch/hmap.h	11
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	23
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	5
./include/openvswitch/list.h	7
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	3
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
./include/openvswitch/nsh.h	6
./lib/flow.h	15
./lib/util.h	4
./lib/packets.h	1
./lib/hash.h	7
./lib/classifier-private.h	3
./lib/random.h	1

Fuzzer: odp_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1923	52.3%
gold	[1:9]	88	2.39%
yellow	[10:29]	36	0.97%
greenyellow	[30:49]	29	0.78%
lawngreen	50+	1599	43.5%
All colors	3675	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
313	636	ofpbuf_init__	call site: 00636	vlog_rate_limit
228	2546	ipv6_format_addr	call site: 02546	ofputil_format_port
211	423	x2nrealloc	call site: 00423	ovs_mutex_lock_at
134	288	vlog_should_drop	call site: 00288	ovs_mutex_lock_at
130	84	ds_cstr	call site: 00084	vlog
127	979	vlog_set_levels_from_string	call site: 00979	unixctl_command_reply_error
88	2455	ipv6_addr_is_set	call site: 02455	match_format
81	3196	ovs_parse_tnl_push	call site: 03196	scan_geneve
78	3311	format_odp_action	call site: 03311	format_odp_tnl_push_action
71	216	ds_put_char__	call site: 00216	time_wall_msec
32	3621	format_odp_action	call site: 03621	format_odp_check_pkt_len_action
29	2835	tun_metadata_to_geneve_nlattr	call site: 02835	tun_metadata_to_geneve_nlattr_mask

Runtime coverage analysis

Covered functions

554

Functions that are reachable but not covered

518

Reachable functions

845

Percentage of reachable functions covered

38.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/odp_target.c	3
lib/vlog.c	48
lib/util.c	58
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	18
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	11
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	17
lib/hash.h	9
lib/hash.c	1
lib/unaligned.h	9
./include/openvswitch/hmap.h	13
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	24
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	16
./include/openvswitch/list.h	7
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	10
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/odp-util.c	149
lib/bitmap.h	6
lib/uuid.c	2
lib/netlink.c	40
lib/util.h	9
lib/flow.c	10
lib/byte-order.h	5
lib/simap.c	3
./include/openvswitch/nsh.h	13
lib/netlink.h	3
lib/odp-util.h	2
lib/tun-metadata.c	14
lib/packets.h	25
lib/flow.h	9
lib/match.c	16
lib/ofp-port.c	3
lib/namemap.c	3
lib/csum.c	3
lib/csum.h	1

Fuzzer: ofp_print_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1771	27.7%
gold	[1:9]	42	0.65%
yellow	[10:29]	97	1.52%
greenyellow	[30:49]	40	0.62%
lawngreen	50+	4426	69.4%
All colors	6376	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	685	ofpbuf_pull	call site: 00685	vlog_rate_limit
127	977	vlog_set_levels_from_string	call site: 00977	unixctl_command_reply_error
120	466	ovsthread_once_done	call site: 00466	vlog
114	98	ovsthread_once_start__	call site: 00098	ovs_mutex_unlock
81	5037	ofputil_flow_mod_format	call site: 05037	nx_match_to_string
63	286	vlog_should_drop	call site: 00286	ovs_mutex_lock_at
62	350	ds_put_char_multiple	call site: 00350	format_log_message
44	421	x2nrealloc	call site: 00421	ovs_mutex_lock_at
44	588	ds_steal_cstr	call site: 00588	json_to_string
31	653	ovs_list_pop_front	call site: 00653	jsonrpc_run
28	10	xmalloc	call site: 00010	out_of_memory
22	74	ds_put_uninit	call site: 00074	vlog

Runtime coverage analysis

Covered functions

1639

Functions that are reachable but not covered

436

Reachable functions

1842

Percentage of reachable functions covered

76.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/ofp_print_target.c	1
lib/vlog.c	48
lib/util.c	54
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	24
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	17
lib/packets.c	18
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	17
lib/hash.h	16
lib/hash.c	2
lib/unaligned.h	9
./include/openvswitch/hmap.h	13
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	24
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	22
./include/openvswitch/list.h	10
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	14
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/ofp-print.c	60
lib/ofp-msgs.c	29
lib/ofp-group.c	35
lib/byte-order.h	6
lib/ofp-actions.c	269
lib/ofp-protocol.c	9
lib/ofp-actions.inc2	1
./include/openvswitch/ofp-actions.h	133
lib/flow.h	33
lib/ofp-port.c	43
lib/packets.h	22
lib/util.h	16
lib/meta-flow.c	39
lib/nx-match.c	51
./include/openvswitch/meta-flow.h	1
lib/cmap.c	9
lib/cmap.h	1
lib/namemap.c	3
lib/flow.c	64
lib/nx-match.h	2
lib/multipath.c	2
lib/bundle.c	2
lib/ofp-prop.c	15
./include/openvswitch/ofp-prop.h	1
lib/ofp-ed-props.c	3
lib/ofp-errors.c	7
lib/bitmap.h	13
lib/ofp-packet.c	12
lib/ofp-table.c	54
lib/learn.c	2
lib/match.c	150
./include/openvswitch/ofp-group.h	1
lib/ofp-util.c	4
lib/ofp-switch.c	9
lib/netdev.c	4
lib/tun-metadata.c	9
./include/openvswitch/nsh.h	10
lib/uuid.c	1
lib/dp-packet.c	3
lib/dp-packet.h	27
lib/ofp-monitor.c	15
lib/ofp-match.c	20
lib/ox-stat.c	12
lib/ofp-flow.c	14
lib/ofp-meter.c	16
lib/ofp-queue.c	20
lib/ofp-connection.c	18
lib/ofp-bundle.c	6
lib/ofp-ipfix.c	7
lib/ofp-ct.c	5

Fuzzer: ofctl_parse_target

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1917	43.3%
gold	[1:9]	235	5.31%
yellow	[10:29]	71	1.60%
greenyellow	[30:49]	65	1.47%
lawngreen	50+	2132	48.2%
All colors	4420	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	687	ofpbuf_pull	call site: 00687	vlog_rate_limit
127	979	vlog_set_levels_from_string	call site: 00979	unixctl_command_reply_error
126	288	vlog_should_drop	call site: 00288	ovs_mutex_lock_at
120	468	ovsthread_once_done	call site: 00468	vlog
114	3289	vlan_tci_to_vid	call site: 03289	format_ipv6_netmask
98	3190	ipv6_mask_is_any	call site: 03190	ofputil_format_port
80	135	str_to_llong_with_tail	call site: 00135	vlog
44	590	ds_steal_cstr	call site: 00590	json_to_string
43	3146	ofputil_normalize_match__	call site: 03146	match_format
29	657	ofpbuf_delete	call site: 00657	jsonrpc_run
28	12	xmalloc	call site: 00012	out_of_memory
27	100	ovsthread_once_start__	call site: 00100	ovs_mutex_unlock

Runtime coverage analysis

Covered functions

1264

Functions that are reachable but not covered

437

Reachable functions

1476

Percentage of reachable functions covered

70.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/oss-fuzz/ofctl_parse_target.c	3
lib/vlog.c	48
lib/util.c	67
lib/ovs-thread.c	15
lib/backtrace.c	3
lib/dynamic-string.c	19
./include/openvswitch/thread.h	1
lib/syslog-null.c	1
lib/syslog-libc.c	1
lib/syslog-direct.c	1
lib/socket-util.c	18
lib/packets.c	21
lib/dns-resolve-stub.c	1
lib/socket-util.h	1
lib/socket-util-unix.c	8
lib/fatal-signal.c	13
./include/openvswitch/dynamic-string.h	1
lib/timeval.c	17
lib/coverage.c	8
lib/unixctl.c	7
lib/shash.c	19
lib/hash.h	16
lib/hash.c	2
lib/unaligned.h	2
./include/openvswitch/hmap.h	13
lib/hmap.c	13
./include/openvswitch/util.h	1
lib/token-bucket.c	1
lib/sat-math.h	2
lib/async-append-aio.c	7
lib/byteq.c	10
lib/svec.c	8
lib/json.c	27
./include/openvswitch/json.h	2
lib/cooperative-multitasking.c	2
lib/json.h	1
lib/jsonrpc.c	11
lib/ofpbuf.c	21
./include/openvswitch/list.h	8
lib/stream.c	5
lib/stream-replay.c	2
lib/ovs-replay.c	5
./include/openvswitch/ofpbuf.h	11
lib/seq.c	8
lib/latch-unix.c	2
lib/signals.c	2
lib/sset.c	9
lib/random.c	5
lib/entropy.c	2
lib/syslog-provider.h	1
./lib/dirs.c.in	2
lib/ofp-flow.c	7
lib/ofp-parse.c	13
lib/match.c	149
lib/meta-flow.c	43
lib/flow.c	32
lib/bitmap.h	6
lib/util.h	10
lib/ofp-port.c	8
lib/flow.h	31
lib/namemap.c	4
lib/unicode.h	2
lib/unicode.c	1
lib/tun-metadata.c	10
lib/byte-order.h	5
./include/openvswitch/nsh.h	4
lib/packets.h	19
lib/nx-match.c	48
./include/openvswitch/meta-flow.h	1
lib/ofp-table.c	2
lib/ofp-group.c	1
lib/ofp-actions.c	258
./include/openvswitch/ofp-actions.h	133
lib/ofp-packet.c	2
lib/bundle.c	4
lib/ofp-ed-props.c	4
lib/learn.c	5
lib/multipath.c	3
lib/ofp-errors.c	3
lib/ofp-match.c	8
lib/ofp-protocol.c	3
lib/ofp-msgs.c	10
lib/ovs-atomic.h	1
lib/ofp-actions.inc2	74
lib/ofp-prop.c	11
./include/openvswitch/ofp-prop.h	1
lib/nx-match.h	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
dpif_dummy_register	/src/openvswitch/lib/dpif-netdev.c	1	['int']	124	0	94	19	7	2279	0	9531	5582

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

3803 / 9983

Cyclomatic complexity statically reachable by fuzzers

19105 / 43356

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/oss-fuzz/json_parser_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['json_parser_abort', 'jsonrpc_msg_to_json', 'xmemdup0', 'ds_put_uninit', 'xcalloc__', 'shash_find', 'xvasprintf', 'ds_put_char__', 'shash_destroy', 'jsonrpc_msg_destroy']

tests/oss-fuzz/flow_extract_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ds_steal_cstr', 'hash_finish', 'x2nrealloc', 'ds_put_uninit', 'xrealloc__', 'ds_put_char__', 'flow_get_metadata', 'format_flow_tunnel', 'format_packet_type_masked']

tests/oss-fuzz/miniflow_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['x2nrealloc', 'random_next', 'hash_finish', 'xmalloc', 'xrealloc__', 'miniflow_extract', 'ipv6_addr_is_set', 'get_entropy']

tests/oss-fuzz/odp_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ofpbuf_init__', 'ipv6_format_addr', 'x2nrealloc', 'vlog_should_drop', 'ds_cstr', 'vlog_set_levels_from_string', 'ipv6_addr_is_set', 'ovs_parse_tnl_push', 'format_odp_action', 'ds_put_char__']

tests/oss-fuzz/ofp_print_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ofpbuf_pull', 'vlog_set_levels_from_string', 'ovsthread_once_done', 'ovsthread_once_start__', 'ofputil_flow_mod_format', 'vlog_should_drop', 'ds_put_char_multiple', 'x2nrealloc', 'ds_steal_cstr', 'ovs_list_pop_front']

tests/oss-fuzz/ofctl_parse_target.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ofpbuf_pull', 'vlog_set_levels_from_string', 'vlog_should_drop', 'ovsthread_once_done', 'vlan_tci_to_vid', 'ipv6_mask_is_any', 'str_to_llong_with_tail', 'ds_steal_cstr', 'ofputil_normalize_match__', 'ofpbuf_delete']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
flow_get_metadata	92	31	33.69%	['flow_extract_target']
odp_action_len	39	21	53.84%	['odp_target']
ovs_parse_tnl_push	276	31	11.23%	['odp_target']
check_attr_len	34	13	38.23%	['odp_target']
vlog_set_levels_from_string	71	30	42.25%	['odp_target', 'json_parser_target', 'ofp_print_target', 'miniflow_target', 'flow_extract_target', 'ofctl_parse_target']
vlog_should_drop	33	5	15.15%	['odp_target', 'json_parser_target', 'ofp_print_target', 'miniflow_target', 'flow_extract_target', 'ofctl_parse_target']
ofpraw_from_ofphdrs	31	17	54.83%	['ofp_print_target']
parse_intel_port_stats_rfc2819_property	34	6	17.64%	['ofp_print_target']
ofpraw_put__	48	25	52.08%	['ofctl_parse_target']
vlog_valist	67	7	10.44%	['odp_target', 'json_parser_target', 'ofp_print_target', 'miniflow_target', 'flow_extract_target', 'ofctl_parse_target']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/openvswitch/lib/random.h	[]	[]
/src/openvswitch/lib/jhash.c	['flow_extract_target']	['flow_extract_target']
/src/openvswitch/lib/timer.c	[]	[]
/src/openvswitch/lib/hindex.h	[]	[]
/src/openvswitch/lib/userspace-tso.c	[]	[]
/src/openvswitch/lib/ovsdb-data.h	[]	[]
/src/openvswitch/lib/ccmap.c	[]	[]
/src/openvswitch/lib/csum.c	['odp_target']	[]
/src/openvswitch/lib/tnl-ports.c	[]	[]
/src/openvswitch/lib/netdev-vport.c	[]	[]
/src/openvswitch/lib/bundle.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ox-stat.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/netdev.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/flow.c	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/odp-execute-private.c	[]	[]
/src/openvswitch/lib/util.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/hash.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'miniflow_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif-netdev-extract-study.c	[]	[]
/src/openvswitch/lib/ovsdb-error.c	[]	[]
/src/openvswitch/lib/netlink-socket.c	[]	[]
/src/openvswitch/lib/ovsdb-set-op.c	[]	[]
/src/openvswitch/lib/ofp-ipfix.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/netnsid.h	[]	[]
/src/openvswitch/lib/dhparams.c	[]	[]
/src/openvswitch/lib/odp-util.c	['odp_target']	['odp_target']
/src/openvswitch/lib/conntrack.c	[]	[]
/src/openvswitch/lib/syslog-provider.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/ofp-group.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-msgs.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif-netdev-perf.c	[]	[]
/src/openvswitch/lib/stream-tcp.c	[]	[]
/src/openvswitch/./lib/dirs.c.in	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/process.c	[]	[]
/src/openvswitch/lib/dp-packet-gso.c	[]	[]
/src/openvswitch/lib/dpif-netdev-lookup-generic.c	[]	[]
/src/openvswitch/lib/ovs-replay.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/latch-unix.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/pvector.h	[]	[]
/src/openvswitch/lib/netlink-notifier.c	[]	[]
/src/openvswitch/lib/backtrace.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/stream-fd.c	[]	[]
/src/openvswitch/lib/cmap.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/unaligned.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-meter.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/meta-flow.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/json.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/packets.h	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/socket-util-unix.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpctl.c	[]	[]
/src/openvswitch/lib/ofpbuf.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-table.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif-netdev-lookup-autovalidator.c	[]	[]
/src/openvswitch/lib/versions.h	[]	[]
/src/openvswitch/lib/hmapx.c	[]	[]
/src/openvswitch/lib/dns-resolve-stub.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/unicode.c	['json_parser_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/aes128.c	[]	[]
/src/openvswitch/lib/match.c	['flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovs-thread.h	[]	[]
/src/openvswitch/lib/ovsdb-cs.c	[]	[]
/src/openvswitch/lib/stream-provider.h	[]	[]
/src/openvswitch/lib/classifier.h	[]	[]
/src/openvswitch/lib/syslog-null.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/./include/openvswitch/ofp-actions.h	['ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/stream.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovs-numa.c	[]	[]
/src/openvswitch/lib/bitmap.h	['odp_target', 'ofp_print_target', 'ofctl_parse_target']	['odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-errors.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-port.c	['flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/sha1.c	[]	[]
/src/openvswitch/lib/mov-avg.h	[]	[]
/src/openvswitch/lib/learn.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ipf.c	[]	[]
/src/openvswitch/lib/conntrack-icmp.c	[]	[]
/src/openvswitch/lib/ofp-util.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/socket-util.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/conntrack-tp.c	[]	[]
/src/openvswitch/lib/ovs-atomic-flag-gcc4.7+.h	[]	[]
/src/openvswitch/lib/netdev-offload.c	[]	[]
/src/openvswitch/lib/ovs-thread.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/socket-util.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/signals.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/nx-match.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/thread.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/usr/include/openssl/x509.h	[]	[]
/src/openvswitch/lib/smap.c	[]	[]
/src/openvswitch/lib/ofp-actions.inc2	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ct-dpif.c	[]	[]
/src/openvswitch/lib/dpif-netdev-private-dpcls.h	[]	[]
/src/openvswitch/lib/ovsdb-session.c	[]	[]
/src/openvswitch/./lib/flow.h	['miniflow_target']	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/netdev-vport-private.h	[]	[]
/src/openvswitch/lib/netdev-afxdp.h	[]	[]
/src/openvswitch/lib/dynamic-string.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/ofp-group.h	['ofp_print_target']	[]
/src/openvswitch/lib/crc32c.c	[]	[]
/src/openvswitch/lib/multipath.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/cooperative-multitasking.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-errors.inc	[]	[]
/src/openvswitch/lib/skiplist.c	[]	[]
/src/openvswitch/lib/route-table.c	[]	[]
/src/openvswitch/lib/sat-math.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/vlog.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/byteq.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/csum.h	['odp_target']	[]
/src/openvswitch/lib/dp-packet.h	['flow_extract_target', 'miniflow_target', 'ofp_print_target']	['flow_extract_target', 'miniflow_target', 'ofp_print_target']
/src/openvswitch/lib/daemon-unix.c	[]	[]
/src/openvswitch/lib/conntrack-tcp.c	[]	[]
/src/openvswitch/lib/tc.c	[]	[]
/src/openvswitch/lib/unixctl.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/command-line.c	[]	[]
/src/openvswitch/lib/token-bucket.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/ofp-parse.c	['ofctl_parse_target']	['ofctl_parse_target']
/src/openvswitch/lib/ofp-bundle.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/ovsdb-map-op.c	[]	[]
/src/openvswitch/lib/ovs-atomic.h	['ofctl_parse_target']	['ofctl_parse_target']
/src/openvswitch/lib/ofp-monitor.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/stream-unix.c	[]	[]
/src/openvswitch/lib/id-pool.c	[]	[]
/src/openvswitch/lib/netlink-conntrack.c	[]	[]
/src/openvswitch/lib/ofp-match.c	['flow_extract_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/fat-rwlock.c	[]	[]
/src/openvswitch/lib/dpif-netdev-private-extract.c	[]	[]
/src/openvswitch/./include/openvswitch/meta-flow.h	['ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/netdev-native-tnl.h	[]	[]
/src/openvswitch/lib/id-fpool.c	[]	[]
/src/openvswitch/lib/tc.h	[]	[]
/src/openvswitch/lib/dpif-netdev-perf.h	[]	[]
/src/openvswitch/lib/unicode.h	['json_parser_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/classifier-private.h	[]	[]
/src/openvswitch/tests/oss-fuzz/odp_target.c	['odp_target']	['odp_target']
/src/openvswitch/tests/oss-fuzz/ofctl_parse_target.c	['ofctl_parse_target']	['ofctl_parse_target']
/src/openvswitch/lib/reconnect.c	[]	[]
/src/openvswitch/lib/ovs-replay.h	[]	[]
/src/openvswitch/lib/uuid.h	[]	[]
/src/openvswitch/lib/shash.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif.c	[]	[]
/src/openvswitch/lib/ofp-actions.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/lockfile.c	[]	[]
/src/openvswitch/lib/dpif-provider.h	[]	[]
/src/openvswitch/lib/fatal-signal.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/netdev-offload.h	[]	[]
/src/openvswitch/lib/netlink.c	['odp_target']	['odp_target']
/src/openvswitch/lib/syslog-libc.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/hash.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-print.c	['flow_extract_target', 'ofp_print_target']	['flow_extract_target', 'ofp_print_target']
/src/openvswitch/lib/util.h	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/rculist.h	[]	[]
/src/openvswitch/./include/openvswitch/dynamic-string.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/daemon.c	[]	[]
/src/openvswitch/lib/guarded-list.c	[]	[]
/src/openvswitch/./include/openvswitch/ofpbuf.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/seq.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/coverage.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/netdev-linux.c	[]	[]
/src/openvswitch/lib/stream-ssl.c	[]	[]
/src/openvswitch/tests/oss-fuzz/flow_extract_target.c	['flow_extract_target']	['flow_extract_target']
/src/openvswitch/lib/flow.h	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif-netdev-lookup.c	[]	[]
/src/openvswitch/lib/json.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'ofctl_parse_target']
/src/openvswitch/lib/hmap.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovsdb-parser.c	[]	[]
/src/openvswitch/lib/netdev-provider.h	[]	[]
/src/openvswitch/lib/syslog-direct.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/namemap.c	['flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/packets.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/async-append-aio.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/netdev-linux-private.h	[]	[]
/src/openvswitch/lib/dpif-netdev-private-flow.h	[]	[]
/src/openvswitch/lib/odp-util.h	['odp_target']	['odp_target']
/src/openvswitch/./include/openvswitch/nsh.h	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/tests/oss-fuzz/miniflow_target.c	['miniflow_target']	['miniflow_target']
/src/openvswitch/lib/random.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['miniflow_target']
/src/openvswitch/lib/sort.c	[]	[]
/src/openvswitch/lib/odp-execute.c	[]	[]
/src/openvswitch/./include/openvswitch/util.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/ovsdb-types.h	[]	[]
/src/openvswitch/lib/rtnetlink.c	[]	[]
/src/openvswitch/lib/entropy.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/netdev-dpdk.h	[]	[]
/src/openvswitch/lib/poll-loop.c	[]	[]
/src/openvswitch/lib/ofp-connection.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/dpdk-stub.c	[]	[]
/src/openvswitch/lib/ofp-ct.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/jsonrpc.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-prop.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/list.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/ovs-router.c	[]	[]
/src/openvswitch/lib/classifier.c	[]	[]
/src/openvswitch/lib/timeval.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/mpsc-queue.c	[]	[]
/src/openvswitch/lib/hindex.c	[]	[]
/src/openvswitch/lib/dpif-netlink-rtnl.c	[]	[]
/src/openvswitch/tests/oss-fuzz/ofp_print_target.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/tun-metadata.c	['flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/./include/openvswitch/ofp-prop.h	['ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/conntrack-other.c	[]	[]
/src/openvswitch/lib/netlink.h	['odp_target']	['odp_target']
/src/openvswitch/lib/byte-order.h	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/nx-match.h	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/dpif-netdev-private-dfc.h	[]	[]
/src/openvswitch/lib/pvector.c	[]	[]
/src/openvswitch/lib/dpif-netdev.c	[]	[]
/src/openvswitch/lib/json.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/simap.c	['odp_target']	[]
/src/openvswitch/lib/netdev-native-tnl.c	[]	[]
/src/openvswitch/lib/vswitch-idl.c	[]	[]
/src/openvswitch/lib/dp-packet.c	['flow_extract_target', 'miniflow_target', 'ofp_print_target']	['flow_extract_target', 'miniflow_target', 'ofp_print_target']
/src/openvswitch/tests/oss-fuzz/json_parser_target.c	['json_parser_target']	['json_parser_target']
/src/openvswitch/lib/cmap.h	['ofp_print_target']	[]
/src/openvswitch/lib/dpif-netdev-private-dpif.c	[]	[]
/src/openvswitch/lib/tnl-neigh-cache.c	[]	[]
/src/openvswitch/lib/ofp-ed-props.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ovsdb-condition.c	[]	[]
/src/openvswitch/lib/ovsdb-types.c	[]	[]
/src/openvswitch/lib/svec.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/ofp-queue.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/./include/openvswitch/hmap.h	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	[]
/src/openvswitch/lib/dpif-netdev-private-dfc.c	[]	[]
/src/openvswitch/lib/ovsdb-idl.c	[]	[]
/src/openvswitch/lib/ovsdb-data.c	[]	[]
/src/openvswitch/lib/dpif-netlink.c	[]	[]
/src/openvswitch/lib/ofp-switch.c	['ofp_print_target']	['ofp_print_target']
/src/openvswitch/lib/colors.c	[]	[]
/src/openvswitch/lib/ovs-rcu.c	[]	[]
/src/openvswitch/lib/ofp-packet.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/stream-replay.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/sset.c	['json_parser_target', 'flow_extract_target', 'miniflow_target', 'odp_target', 'ofp_print_target', 'ofctl_parse_target']	['json_parser_target']
/src/openvswitch/lib/netdev-offload-tc.c	[]	[]
/src/openvswitch/lib/ofp-flow.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']
/src/openvswitch/lib/uuid.c	['odp_target', 'ofp_print_target']	['odp_target', 'ofp_print_target']
/src/openvswitch/lib/connectivity.c	[]	[]
/src/openvswitch/lib/timer.h	[]	[]
/src/openvswitch/lib/ofp-protocol.c	['ofp_print_target', 'ofctl_parse_target']	['ofp_print_target', 'ofctl_parse_target']

Directories in report

Directory
/src/openvswitch/tests/oss-fuzz/
/usr/include/openssl/
/src/openvswitch/./lib/
/src/openvswitch/lib/
/src/openvswitch/./include/openvswitch/