Fuzz introspector
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzzers overview

Fuzzer Fuzzer filename Functions Reached Functions unreached Fuzzer depth Files reached Basic blocks reached Cyclomatic complexity Details
opus_repacketizer_fuzzer_fixed /src/opus/tests/opus_repacketizer_fuzzer.cc 18 270 3 4 292 133 opus_repacketizer_fuzzer.cc
opus_repacketizer_fuzzer_floating /src/opus/tests/opus_repacketizer_fuzzer.cc 18 255 3 4 292 133 opus_repacketizer_fuzzer.cc
opus_projection_decoder_fuzzer_floating /src/opus/tests/opus_projection_decoder_fuzzer.cc 234 64 19 73 5684 1954 opus_projection_decoder_fuzzer.cc
opus_projection_decoder_fuzzer_fixed /src/opus/tests/opus_projection_decoder_fuzzer.cc 240 75 19 73 5995 2060 opus_projection_decoder_fuzzer.cc
opus_multistream_decode_fuzzer_floating /src/opus/tests/opus_multistream_decode_fuzzer.cc 223 55 19 70 5615 1923 opus_multistream_decode_fuzzer.cc
opus_multistream_decode_fuzzer_fixed /src/opus/tests/opus_multistream_decode_fuzzer.cc 229 64 19 70 5924 2028 opus_multistream_decode_fuzzer.cc
opus_multistream_encode_fuzzer_floating /src/opus/tests/opus_multistream_encode_fuzzer.cc 350 115 15 114 10750 3624 opus_multistream_encode_fuzzer.cc
opus_projection_encoder_fuzzer_fixed /src/opus/tests/opus_projection_encoder_fuzzer.cc 352 137 15 111 11274 3783 opus_projection_encoder_fuzzer.cc
opus_encode_fuzzer_fixed /src/opus/tests/opus_encode_fuzzer.cc 315 120 16 106 10459 3502 opus_encode_fuzzer.cc
opus_projection_encoder_fuzzer_floating /src/opus/tests/opus_projection_encoder_fuzzer.cc 358 128 15 116 10788 3642 opus_projection_encoder_fuzzer.cc
opus_multistream_encode_fuzzer_fixed /src/opus/tests/opus_multistream_encode_fuzzer.cc 344 124 15 109 11236 3765 opus_multistream_encode_fuzzer.cc
opus_encode_fuzzer_floating /src/opus/tests/opus_encode_fuzzer.cc 321 111 16 111 9974 3361 opus_encode_fuzzer.cc

Fuzzer details

Fuzzer: opus_repacketizer_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1 7.14%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 13 92.8%
All colors 14 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 4 1 :

['parse_size']

0 4 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:304
0 2 1 :

['encode_size']

0 2 opus_repacketizer_out_range_impl call site: 00010 /src/opus/src/repacketizer.c:207
0 0 None 0 6 opus_repacketizer_out_range_impl call site: 00008 /src/opus/src/repacketizer.c:120
0 0 None 0 4 opus_repacketizer_out_range_impl call site: 00009 /src/opus/src/repacketizer.c:159
0 0 None 0 4 opus_repacketizer_out_range_impl call site: 00009 /src/opus/src/repacketizer.c:191
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:208
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:210
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:250
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:255
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:330
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:340
0 0 None 0 0 opus_packet_get_nb_frames call site: 00000 /src/opus/src/opus_decoder.c:1007

Runtime coverage analysis

Covered functions
17
Functions that are reachable but not covered
0
Reachable functions
18
Percentage of reachable functions covered
100.0%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc 2
/src/opus/src/repacketizer.c 6
/src/opus/./celt/os_support.h 2
/src/opus/src/opus.c 1

Fuzzer: opus_repacketizer_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 1 7.14%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 13 92.8%
All colors 14 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
0 4 1 :

['parse_size']

0 4 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:304
0 2 1 :

['encode_size']

0 2 opus_repacketizer_out_range_impl call site: 00010 /src/opus/src/repacketizer.c:207
0 0 None 0 6 opus_repacketizer_out_range_impl call site: 00008 /src/opus/src/repacketizer.c:120
0 0 None 0 4 opus_repacketizer_out_range_impl call site: 00009 /src/opus/src/repacketizer.c:159
0 0 None 0 4 opus_repacketizer_out_range_impl call site: 00009 /src/opus/src/repacketizer.c:191
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:208
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:210
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:250
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:255
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:330
0 0 None 0 0 opus_packet_parse_impl call site: 00000 /src/opus/src/opus.c:340
0 0 None 0 0 opus_packet_get_nb_frames call site: 00000 /src/opus/src/opus_decoder.c:1007

Runtime coverage analysis

Covered functions
17
Functions that are reachable but not covered
0
Reachable functions
18
Percentage of reachable functions covered
100.0%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc 2
/src/opus/src/repacketizer.c 6
/src/opus/./celt/os_support.h 2
/src/opus/src/opus.c 1

Fuzzer: opus_projection_decoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 98 14.0%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 3 0.42%
lawngreen 50+ 598 85.5%
All colors 699 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
103 103 1 :

['alg_quant']

103 103 quant_partition call site: 00559 /src/opus/celt/bands.c:1056
31 31 1 :

['ec_enc_uint']

70 79 interp_bits2pulses call site: 00482 /src/opus/celt/rate.c:397
31 31 1 :

['ec_enc_uint']

62 82 compute_theta call site: 00539 /src/opus/celt/bands.c:799
29 29 1 :

['stereo_itheta']

173 292 compute_theta call site: 00522 /src/opus/celt/bands.c:734
25 25 2 :

['stereo_split', 'intensity_stereo']

25 45 compute_theta call site: 00548 /src/opus/celt/bands.c:840
23 23 1 :

['intensity_stereo']

38 67 compute_theta call site: 00551 /src/opus/celt/bands.c:850
22 22 1 :

['ec_encode']

53 73 compute_theta call site: 00536 /src/opus/celt/bands.c:784
22 22 1 :

['ec_encode']

53 73 compute_theta call site: 00541 /src/opus/celt/bands.c:806
15 15 1 :

['ec_enc_bit_logp']

39 39 interp_bits2pulses call site: 00492 /src/opus/celt/rate.c:414
15 15 1 :

['ec_enc_bit_logp']

15 35 compute_theta call site: 00552 /src/opus/celt/bands.c:863
12 12 1 :

['ec_enc_bits']

12 372 quant_band_stereo call site: 00612 /src/opus/celt/bands.c:1299
7 7 1 :

['celt_exp2']

7 9 opus_decode_frame call site: 00129 /src/opus/src/opus_decoder.c:604

Runtime coverage analysis

Covered functions
205
Functions that are reachable but not covered
27
Reachable functions
234
Percentage of reachable functions covered
88.46%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc 1
/usr/local/bin/../include/c++/v1/math.h 1
/src/opus/tests/../celt/os_support.h 2
/src/opus/src/opus_projection_decoder.c 8
/src/opus/src/mapping_matrix.c 3
/src/opus/src/opus_private.h 1
/src/opus/src/opus_multistream_decoder.c 7
/src/opus/src/opus_decoder.c 12
/src/opus/silk/dec_API.c 3
/src/opus/celt/celt_decoder.c 13
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/./celt/arch.h 1
/src/opus/src/opus_multistream.c 4
/src/opus/silk/init_decoder.c 1
/src/opus/celt/x86/x86cpu.c 4
/src/opus/silk/CNG.c 3
/src/opus/silk/PLC.c 5
/src/opus/celt/celt.c 3
/src/opus/src/opus.c 4
/src/opus/celt/entdec.c 11
/src/opus/silk/decoder_set_fs.c 1
/src/opus/silk/resampler.c 2
/src/opus/silk/stereo_decode_pred.c 2
/src/opus/silk/decode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/decode_pulses.c 1
/src/opus/silk/shell_coder.c 2
/src/opus/silk/code_signs.c 1
/src/opus/silk/decode_frame.c 1
/src/opus/silk/decode_parameters.c 1
/src/opus/silk/gain_quant.c 1
/src/opus/./silk/SigProc_FIX.h 6
/src/opus/silk/log2lin.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/sort.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/./silk/macros.h 1
/src/opus/./silk/Inlines.h 4
/src/opus/silk/bwexpander.c 1
/src/opus/silk/decode_pitch.c 1
/src/opus/silk/decode_core.c 1
/src/opus/silk/LPC_analysis_filter.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/stereo_MS_to_LR.c 1
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/./celt/entcode.h 4
/src/opus/celt/bands.c 20
/src/opus/celt/vq.c 8
/src/opus/celt/x86/pitch_sse.c 4
/src/opus/celt/mdct.c 1
/src/opus/celt/kiss_fft.c 5
/src/opus/celt/pitch.c 5
/src/opus/celt/celt_lpc.c 4
/src/opus/celt/quant_bands.c 3
/src/opus/celt/laplace.c 2
/src/opus/celt/entcode.c 1
/src/opus/celt/rate.c 2
/src/opus/celt/entenc.c 8
/src/opus/./celt/mathops.h 1
/src/opus/celt/mathops.c 1
/src/opus/./celt/rate.h 3
/src/opus/celt/x86/vq_sse2.c 1
/src/opus/celt/cwrs.c 4
/src/opus/./celt/stack_alloc.h 1

Fuzzer: opus_projection_decoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 105 14.4%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 624 85.5%
All colors 729 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
103 103 1 :

['alg_quant']

103 103 quant_partition call site: 00578 /src/opus/celt/bands.c:1056
31 31 1 :

['ec_enc_uint']

70 79 interp_bits2pulses call site: 00496 /src/opus/celt/rate.c:397
31 31 1 :

['ec_enc_uint']

62 82 compute_theta call site: 00556 /src/opus/celt/bands.c:799
29 29 1 :

['stereo_itheta']

173 292 compute_theta call site: 00536 /src/opus/celt/bands.c:734
25 25 2 :

['stereo_split', 'intensity_stereo']

25 45 compute_theta call site: 00565 /src/opus/celt/bands.c:840
23 23 1 :

['intensity_stereo']

38 67 compute_theta call site: 00570 /src/opus/celt/bands.c:850
22 22 1 :

['ec_encode']

53 73 compute_theta call site: 00553 /src/opus/celt/bands.c:784
22 22 1 :

['ec_encode']

53 73 compute_theta call site: 00558 /src/opus/celt/bands.c:806
15 15 1 :

['ec_enc_bit_logp']

39 39 interp_bits2pulses call site: 00506 /src/opus/celt/rate.c:414
15 15 1 :

['ec_enc_bit_logp']

15 35 compute_theta call site: 00571 /src/opus/celt/bands.c:863
12 12 1 :

['ec_enc_bits']

12 372 quant_band_stereo call site: 00639 /src/opus/celt/bands.c:1299
0 53 1 :

['silk_resampler']

0 53 silk_Decode call site: 00314 /src/opus/silk/dec_API.c:352

Runtime coverage analysis

Covered functions
217
Functions that are reachable but not covered
25
Reachable functions
240
Percentage of reachable functions covered
89.58%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc 1
/usr/local/bin/../include/c++/v1/math.h 1
/src/opus/tests/../celt/os_support.h 2
/src/opus/src/opus_projection_decoder.c 8
/src/opus/src/mapping_matrix.c 3
/src/opus/src/opus_private.h 1
/src/opus/src/opus_multistream_decoder.c 7
/src/opus/src/opus_decoder.c 12
/src/opus/silk/dec_API.c 3
/src/opus/celt/celt_decoder.c 13
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/./celt/arch.h 2
/src/opus/src/opus_multistream.c 4
/src/opus/silk/init_decoder.c 1
/src/opus/celt/x86/x86cpu.c 4
/src/opus/silk/CNG.c 3
/src/opus/silk/PLC.c 5
/src/opus/celt/celt.c 4
/src/opus/src/opus.c 3
/src/opus/celt/entdec.c 11
/src/opus/silk/decoder_set_fs.c 1
/src/opus/silk/resampler.c 2
/src/opus/silk/stereo_decode_pred.c 2
/src/opus/silk/decode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/decode_pulses.c 1
/src/opus/silk/shell_coder.c 2
/src/opus/silk/code_signs.c 1
/src/opus/silk/decode_frame.c 1
/src/opus/silk/decode_parameters.c 1
/src/opus/silk/gain_quant.c 1
/src/opus/./silk/SigProc_FIX.h 6
/src/opus/silk/log2lin.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/sort.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/./silk/macros.h 1
/src/opus/./silk/Inlines.h 4
/src/opus/silk/bwexpander.c 1
/src/opus/silk/decode_pitch.c 1
/src/opus/silk/decode_core.c 1
/src/opus/silk/LPC_analysis_filter.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/stereo_MS_to_LR.c 1
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/./celt/entcode.h 4
/src/opus/celt/bands.c 20
/src/opus/celt/vq.c 9
/src/opus/./celt/mathops.h 8
/src/opus/celt/mathops.c 7
/src/opus/celt/mdct.c 1
/src/opus/celt/kiss_fft.c 5
/src/opus/celt/pitch.c 5
/src/opus/celt/celt_lpc.c 3
/src/opus/./celt/fixed_generic.h 1
/src/opus/celt/quant_bands.c 3
/src/opus/celt/laplace.c 2
/src/opus/celt/entcode.c 1
/src/opus/celt/rate.c 2
/src/opus/celt/entenc.c 8
/src/opus/./celt/rate.h 3
/src/opus/celt/cwrs.c 4
/src/opus/./celt/pitch.h 1
/src/opus/./celt/stack_alloc.h 1

Fuzzer: opus_multistream_decode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 97 14.3%
gold [1:9] 0 0.0%
yellow [10:29] 3 0.44%
greenyellow [30:49] 1 0.14%
lawngreen 50+ 575 85.0%
All colors 676 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
103 103 1 :

['alg_quant']

103 103 quant_partition call site: 00538 /src/opus/celt/bands.c:1056
31 31 1 :

['ec_enc_uint']

70 79 interp_bits2pulses call site: 00461 /src/opus/celt/rate.c:397
31 31 1 :

['ec_enc_uint']

62 82 compute_theta call site: 00518 /src/opus/celt/bands.c:799
29 29 1 :

['stereo_itheta']

173 292 compute_theta call site: 00501 /src/opus/celt/bands.c:734
25 25 2 :

['stereo_split', 'intensity_stereo']

25 45 compute_theta call site: 00527 /src/opus/celt/bands.c:840
23 23 1 :

['intensity_stereo']

38 67 compute_theta call site: 00530 /src/opus/celt/bands.c:850
22 22 1 :

['ec_encode']

53 73 compute_theta call site: 00515 /src/opus/celt/bands.c:784
22 22 1 :

['ec_encode']

53 73 compute_theta call site: 00520 /src/opus/celt/bands.c:806
15 15 1 :

['ec_enc_bit_logp']

39 39 interp_bits2pulses call site: 00471 /src/opus/celt/rate.c:414
15 15 1 :

['ec_enc_bit_logp']

15 35 compute_theta call site: 00531 /src/opus/celt/bands.c:863
12 12 1 :

['ec_enc_bits']

12 372 quant_band_stereo call site: 00591 /src/opus/celt/bands.c:1299
7 7 1 :

['celt_exp2']

7 9 opus_decode_frame call site: 00108 /src/opus/src/opus_decoder.c:604

Runtime coverage analysis

Covered functions
196
Functions that are reachable but not covered
25
Reachable functions
223
Percentage of reachable functions covered
88.79%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc 1
/src/opus/src/opus_multistream_decoder.c 11
/src/opus/src/opus_decoder.c 12
/src/opus/silk/dec_API.c 3
/src/opus/src/opus_private.h 1
/src/opus/celt/celt_decoder.c 13
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/src/opus_multistream.c 4
/src/opus/silk/init_decoder.c 1
/src/opus/celt/x86/x86cpu.c 4
/src/opus/silk/CNG.c 3
/src/opus/silk/PLC.c 5
/src/opus/celt/celt.c 3
/src/opus/./celt/arch.h 1
/src/opus/tests/../celt/os_support.h 2
/src/opus/src/opus.c 4
/src/opus/celt/entdec.c 11
/src/opus/silk/decoder_set_fs.c 1
/src/opus/silk/resampler.c 2
/src/opus/silk/stereo_decode_pred.c 2
/src/opus/silk/decode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/decode_pulses.c 1
/src/opus/silk/shell_coder.c 2
/src/opus/silk/code_signs.c 1
/src/opus/silk/decode_frame.c 1
/src/opus/silk/decode_parameters.c 1
/src/opus/silk/gain_quant.c 1
/src/opus/./silk/SigProc_FIX.h 6
/src/opus/silk/log2lin.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/sort.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/./silk/macros.h 1
/src/opus/./silk/Inlines.h 4
/src/opus/silk/bwexpander.c 1
/src/opus/silk/decode_pitch.c 1
/src/opus/silk/decode_core.c 1
/src/opus/silk/LPC_analysis_filter.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/stereo_MS_to_LR.c 1
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/./celt/entcode.h 4
/src/opus/celt/bands.c 20
/src/opus/celt/vq.c 8
/src/opus/celt/x86/pitch_sse.c 4
/src/opus/celt/mdct.c 1
/src/opus/celt/kiss_fft.c 5
/src/opus/celt/pitch.c 5
/src/opus/celt/celt_lpc.c 4
/src/opus/celt/quant_bands.c 3
/src/opus/celt/laplace.c 2
/src/opus/celt/entcode.c 1
/src/opus/celt/rate.c 2
/src/opus/celt/entenc.c 8
/src/opus/./celt/mathops.h 1
/src/opus/celt/mathops.c 1
/src/opus/./celt/rate.h 3
/src/opus/celt/x86/vq_sse2.c 1
/src/opus/celt/cwrs.c 4
/src/opus/./celt/stack_alloc.h 1

Fuzzer: opus_multistream_decode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 104 14.7%
gold [1:9] 1 0.14%
yellow [10:29] 0 0.0%
greenyellow [30:49] 4 0.56%
lawngreen 50+ 597 84.5%
All colors 706 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
103 103 1 :

['alg_quant']

103 103 quant_partition call site: 00557 /src/opus/celt/bands.c:1056
31 31 1 :

['ec_enc_uint']

70 79 interp_bits2pulses call site: 00475 /src/opus/celt/rate.c:397
31 31 1 :

['ec_enc_uint']

62 82 compute_theta call site: 00535 /src/opus/celt/bands.c:799
29 29 1 :

['stereo_itheta']

173 292 compute_theta call site: 00515 /src/opus/celt/bands.c:734
25 25 2 :

['stereo_split', 'intensity_stereo']

25 45 compute_theta call site: 00544 /src/opus/celt/bands.c:840
23 23 1 :

['intensity_stereo']

38 67 compute_theta call site: 00549 /src/opus/celt/bands.c:850
22 22 1 :

['ec_encode']

53 73 compute_theta call site: 00532 /src/opus/celt/bands.c:784
22 22 1 :

['ec_encode']

53 73 compute_theta call site: 00537 /src/opus/celt/bands.c:806
15 15 1 :

['ec_enc_bit_logp']

39 39 interp_bits2pulses call site: 00485 /src/opus/celt/rate.c:414
15 15 1 :

['ec_enc_bit_logp']

15 35 compute_theta call site: 00550 /src/opus/celt/bands.c:863
12 12 1 :

['ec_enc_bits']

12 372 quant_band_stereo call site: 00618 /src/opus/celt/bands.c:1299
0 53 1 :

['silk_resampler']

0 53 silk_Decode call site: 00293 /src/opus/silk/dec_API.c:352

Runtime coverage analysis

Covered functions
208
Functions that are reachable but not covered
23
Reachable functions
229
Percentage of reachable functions covered
89.96%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc 1
/src/opus/src/opus_multistream_decoder.c 11
/src/opus/src/opus_decoder.c 12
/src/opus/silk/dec_API.c 3
/src/opus/src/opus_private.h 1
/src/opus/celt/celt_decoder.c 13
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/src/opus_multistream.c 4
/src/opus/silk/init_decoder.c 1
/src/opus/celt/x86/x86cpu.c 4
/src/opus/silk/CNG.c 3
/src/opus/silk/PLC.c 5
/src/opus/celt/celt.c 4
/src/opus/./celt/arch.h 2
/src/opus/tests/../celt/os_support.h 2
/src/opus/src/opus.c 3
/src/opus/celt/entdec.c 11
/src/opus/silk/decoder_set_fs.c 1
/src/opus/silk/resampler.c 2
/src/opus/silk/stereo_decode_pred.c 2
/src/opus/silk/decode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/decode_pulses.c 1
/src/opus/silk/shell_coder.c 2
/src/opus/silk/code_signs.c 1
/src/opus/silk/decode_frame.c 1
/src/opus/silk/decode_parameters.c 1
/src/opus/silk/gain_quant.c 1
/src/opus/./silk/SigProc_FIX.h 6
/src/opus/silk/log2lin.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/sort.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/./silk/macros.h 1
/src/opus/./silk/Inlines.h 4
/src/opus/silk/bwexpander.c 1
/src/opus/silk/decode_pitch.c 1
/src/opus/silk/decode_core.c 1
/src/opus/silk/LPC_analysis_filter.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/stereo_MS_to_LR.c 1
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/./celt/entcode.h 4
/src/opus/celt/bands.c 20
/src/opus/celt/vq.c 9
/src/opus/./celt/mathops.h 8
/src/opus/celt/mathops.c 7
/src/opus/celt/mdct.c 1
/src/opus/celt/kiss_fft.c 5
/src/opus/celt/pitch.c 5
/src/opus/celt/celt_lpc.c 3
/src/opus/./celt/fixed_generic.h 1
/src/opus/celt/quant_bands.c 3
/src/opus/celt/laplace.c 2
/src/opus/celt/entcode.c 1
/src/opus/celt/rate.c 2
/src/opus/celt/entenc.c 8
/src/opus/./celt/rate.h 3
/src/opus/celt/cwrs.c 4
/src/opus/./celt/pitch.h 1
/src/opus/./celt/stack_alloc.h 1

Fuzzer: opus_multistream_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 153 13.0%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1017 86.9%
All colors 1170 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
86 86 1 :

['alg_unquant']

86 86 quant_partition call site: 01063 /src/opus/celt/bands.c:1056
28 28 1 :

['ec_dec_uint']

61 76 interp_bits2pulses call site: 00985 /src/opus/celt/rate.c:397
28 28 1 :

['ec_dec_uint']

34 79 compute_theta call site: 01044 /src/opus/celt/bands.c:799
18 24 3 :

['ec_decode', 'isqrt32', 'ec_dec_update']

24 75 compute_theta call site: 01046 /src/opus/celt/bands.c:806
18 18 2 :

['ec_decode', 'ec_dec_update']

24 69 compute_theta call site: 01041 /src/opus/celt/bands.c:784
9 9 1 :

['ec_dec_bit_logp']

33 33 interp_bits2pulses call site: 00989 /src/opus/celt/rate.c:414
9 9 1 :

['ec_dec_bit_logp']

9 29 compute_theta call site: 01056 /src/opus/celt/bands.c:863
6 6 1 :

['ec_dec_bits']

6 366 quant_band_stereo call site: 01118 /src/opus/celt/bands.c:1299
6 6 1 :

['celt_fatal']

6 21 silk_P_Ana_calc_corr_st3 call site: 00577 /src/opus/silk/float/pitch_analysis_core_FLP.c:512
6 6 1 :

['celt_fatal']

6 16 silk_P_Ana_calc_energy_st3 call site: 00586 /src/opus/silk/float/pitch_analysis_core_FLP.c:578
6 6 1 :

['celt_fatal']

6 6 check_control_input call site: 00310 /src/opus/silk/check_control_input.c:100
6 6 1 :

['celt_fatal']

6 6 silk_InitEncoder call site: 00052 /src/opus/silk/enc_API.c:93

Runtime coverage analysis

Covered functions
333
Functions that are reachable but not covered
29
Reachable functions
350
Percentage of reachable functions covered
91.71%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc 1
/src/opus/src/opus_multistream_encoder.c 22
/src/opus/celt/mathops.c 1
/src/opus/src/opus_encoder.c 22
/src/opus/silk/enc_API.c 4
/src/opus/src/opus_private.h 1
/src/opus/celt/celt_encoder.c 19
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/celt/x86/x86cpu.c 4
/src/opus/src/opus_multistream.c 4
/src/opus/silk/init_encoder.c 1
/src/opus/silk/lin2log.c 1
/src/opus/./silk/Inlines.h 4
/src/opus/./silk/macros.h 1
/src/opus/./silk/SigProc_FIX.h 5
/src/opus/silk/VAD.c 1
/src/opus/./celt/arch.h 1
/src/opus/celt/celt.c 3
/src/opus/src/analysis.c 7
/src/opus/tests/../celt/os_support.h 2
/src/opus/celt/x86/pitch_sse.c 4
/src/opus/celt/mdct.c 1
/src/opus/celt/kiss_fft.c 6
/src/opus/celt/bands.c 22
/src/opus/celt/quant_bands.c 6
/src/opus/src/repacketizer.c 6
/src/opus/./celt/mathops.h 2
/src/opus/./celt/float_cast.h 2
/src/opus/src/mlp.c 5
/src/opus/src/opus.c 4
/src/opus/src/opus_decoder.c 1
/src/opus/celt/entenc.c 13
/src/opus/silk/log2lin.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/check_control_input.c 1
/src/opus/silk/control_codec.c 5
/src/opus/silk/resampler.c 2
/src/opus/./silk/float/SigProc_FLP.h 5
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/silk/control_audio_bandwidth.c 1
/src/opus/./celt/entcode.h 6
/src/opus/silk/stereo_encode_pred.c 2
/src/opus/silk/encode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/encode_pulses.c 2
/src/opus/silk/shell_coder.c 3
/src/opus/silk/code_signs.c 1
/src/opus/silk/HP_variable_cutoff.c 1
/src/opus/silk/stereo_LR_to_MS.c 1
/src/opus/silk/stereo_find_predictor.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/inner_prod_aligned.c 1
/src/opus/silk/stereo_quant_pred.c 1
/src/opus/silk/float/encode_frame_FLP.c 3
/src/opus/silk/control_SNR.c 1
/src/opus/silk/LP_variable_cutoff.c 1
/src/opus/silk/biquad_alt.c 1
/src/opus/silk/float/find_pitch_lags_FLP.c 1
/src/opus/silk/float/apply_sine_window_FLP.c 1
/src/opus/silk/float/autocorrelation_FLP.c 1
/src/opus/silk/float/inner_product_FLP.c 1
/src/opus/silk/float/schur_FLP.c 1
/src/opus/silk/float/k2a_FLP.c 1
/src/opus/silk/float/bwexpander_FLP.c 1
/src/opus/silk/float/LPC_analysis_filter_FLP.c 6
/src/opus/silk/float/pitch_analysis_core_FLP.c 3
/src/opus/silk/resampler_down2.c 1
/src/opus/silk/resampler_down2_3.c 1
/src/opus/celt/pitch.c 7
/src/opus/silk/float/energy_FLP.c 1
/src/opus/silk/float/sort_FLP.c 1
/src/opus/silk/float/noise_shape_analysis_FLP.c 4
/src/opus/silk/float/warped_autocorrelation_FLP.c 1
/src/opus/silk/float/find_pred_coefs_FLP.c 1
/src/opus/silk/float/find_LTP_FLP.c 1
/src/opus/silk/float/corrMatrix_FLP.c 2
/src/opus/silk/float/scale_vector_FLP.c 1
/src/opus/silk/float/wrappers_FLP.c 5
/src/opus/silk/quant_LTP_gains.c 1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c 1
/src/opus/silk/float/LTP_analysis_filter_FLP.c 1
/src/opus/silk/float/scale_copy_vector_FLP.c 1
/src/opus/silk/float/find_LPC_FLP.c 1
/src/opus/silk/float/burg_modified_FLP.c 1
/src/opus/silk/A2NLSF.c 4
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/interpolate.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/silk/process_NLSFs.c 1
/src/opus/silk/NLSF_VQ_weights_laroia.c 1
/src/opus/silk/NLSF_encode.c 1
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/silk/sort.c 2
/src/opus/silk/NLSF_VQ.c 1
/src/opus/silk/NLSF_del_dec_quant.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/float/residual_energy_FLP.c 1
/src/opus/silk/float/process_gains_FLP.c 1
/src/opus/silk/gain_quant.c 3
/src/opus/celt/entcode.c 1
/src/opus/celt/celt_lpc.c 2
/src/opus/celt/laplace.c 2
/src/opus/celt/rate.c 2
/src/opus/celt/entdec.c 8
/src/opus/celt/vq.c 8
/src/opus/./celt/rate.h 3
/src/opus/celt/x86/vq_sse2.c 1
/src/opus/celt/cwrs.c 4

Fuzzer: opus_projection_encoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 190 15.6%
gold [1:9] 0 0.0%
yellow [10:29] 2 0.16%
greenyellow [30:49] 1 0.08%
lawngreen 50+ 1021 84.1%
All colors 1214 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
121 121 1 :

['surround_analysis']

121 6072 opus_multistream_encode_native call site: 00174 /src/opus/src/opus_multistream_encoder.c:870
86 86 1 :

['alg_unquant']

86 86 quant_partition call site: 01101 /src/opus/celt/bands.c:1056
48 48 2 :

['ms_get_window_mem', 'ms_get_preemph_mem']

169 6820 opus_multistream_encode_native call site: 00165 /src/opus/src/opus_multistream_encoder.c:837
48 48 2 :

['ms_get_window_mem', 'ms_get_preemph_mem']

48 48 opus_multistream_encoder_init_impl call site: 00109 /src/opus/src/opus_multistream_encoder.c:488
28 28 1 :

['ec_dec_uint']

61 76 interp_bits2pulses call site: 01026 /src/opus/celt/rate.c:397
28 28 1 :

['ec_dec_uint']

34 79 compute_theta call site: 01081 /src/opus/celt/bands.c:799
18 24 3 :

['ec_decode', 'isqrt32', 'ec_dec_update']

24 75 compute_theta call site: 01083 /src/opus/celt/bands.c:806
18 18 2 :

['ec_decode', 'ec_dec_update']

24 69 compute_theta call site: 01078 /src/opus/celt/bands.c:784
9 115 3 :

['silk_resampler', 'silk_short2float_array', 'silk_float2short_array']

9 179 silk_setup_resamplers call site: 00354 /src/opus/silk/control_codec.c:144
9 9 1 :

['ec_dec_bit_logp']

33 33 interp_bits2pulses call site: 01030 /src/opus/celt/rate.c:414
9 9 1 :

['ec_dec_bit_logp']

9 29 compute_theta call site: 01094 /src/opus/celt/bands.c:863
6 6 1 :

['ec_dec_bits']

6 366 quant_band_stereo call site: 01162 /src/opus/celt/bands.c:1299

Runtime coverage analysis

Covered functions
345
Functions that are reachable but not covered
32
Reachable functions
352
Percentage of reachable functions covered
90.91%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc 1
/src/opus/src/opus_projection_encoder.c 11
/src/opus/celt/mathops.c 7
/src/opus/src/mapping_matrix.c 3
/src/opus/src/opus_private.h 1
/src/opus/src/opus_multistream_encoder.c 15
/src/opus/src/opus_encoder.c 21
/src/opus/silk/enc_API.c 4
/src/opus/celt/celt_encoder.c 19
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/./celt/arch.h 1
/src/opus/celt/x86/x86cpu.c 4
/src/opus/src/opus_multistream.c 4
/src/opus/silk/init_encoder.c 1
/src/opus/silk/lin2log.c 1
/src/opus/./silk/Inlines.h 5
/src/opus/./silk/macros.h 1
/src/opus/./silk/SigProc_FIX.h 5
/src/opus/silk/VAD.c 1
/src/opus/celt/celt.c 4
/src/opus/src/analysis.c 8
/src/opus/tests/../celt/os_support.h 2
/src/opus/celt/mdct.c 1
/src/opus/celt/kiss_fft.c 6
/src/opus/celt/bands.c 22
/src/opus/./celt/mathops.h 8
/src/opus/celt/quant_bands.c 6
/src/opus/src/repacketizer.c 6
/src/opus/./celt/float_cast.h 1
/src/opus/src/mlp.c 5
/src/opus/src/opus.c 4
/src/opus/src/opus_decoder.c 1
/src/opus/celt/entenc.c 13
/src/opus/silk/log2lin.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/biquad_alt.c 2
/src/opus/silk/check_control_input.c 1
/src/opus/silk/control_codec.c 5
/src/opus/silk/resampler.c 2
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/silk/control_audio_bandwidth.c 1
/src/opus/./celt/entcode.h 6
/src/opus/silk/stereo_encode_pred.c 2
/src/opus/silk/encode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/encode_pulses.c 2
/src/opus/silk/shell_coder.c 3
/src/opus/silk/code_signs.c 1
/src/opus/silk/HP_variable_cutoff.c 1
/src/opus/silk/stereo_LR_to_MS.c 1
/src/opus/silk/stereo_find_predictor.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/inner_prod_aligned.c 1
/src/opus/silk/stereo_quant_pred.c 1
/src/opus/silk/fixed/encode_frame_FIX.c 3
/src/opus/silk/control_SNR.c 1
/src/opus/silk/LP_variable_cutoff.c 2
/src/opus/silk/fixed/find_pitch_lags_FIX.c 1
/src/opus/silk/fixed/apply_sine_window_FIX.c 1
/src/opus/silk/fixed/autocorr_FIX.c 1
/src/opus/celt/celt_lpc.c 2
/src/opus/celt/pitch.c 7
/src/opus/silk/fixed/schur_FIX.c 1
/src/opus/silk/fixed/k2a_FIX.c 1
/src/opus/silk/bwexpander.c 1
/src/opus/silk/LPC_analysis_filter.c 1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c 3
/src/opus/silk/resampler_down2.c 1
/src/opus/silk/resampler_down2_3.c 1
/src/opus/silk/fixed/vector_ops_FIX.c 2
/src/opus/silk/sort.c 3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c 3
/src/opus/silk/sigm_Q15.c 1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c 1
/src/opus/silk/fixed/schur64_FIX.c 1
/src/opus/silk/fixed/k2a_Q16_FIX.c 1
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/fixed/find_pred_coefs_FIX.c 1
/src/opus/silk/fixed/find_LTP_FIX.c 1
/src/opus/silk/fixed/corrMatrix_FIX.c 2
/src/opus/silk/quant_LTP_gains.c 1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c 1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c 1
/src/opus/silk/fixed/find_LPC_FIX.c 1
/src/opus/silk/A2NLSF.c 4
/src/opus/silk/interpolate.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/silk/process_NLSFs.c 1
/src/opus/silk/NLSF_VQ_weights_laroia.c 1
/src/opus/silk/NLSF_encode.c 1
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/silk/NLSF_VQ.c 1
/src/opus/silk/NLSF_del_dec_quant.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/fixed/residual_energy_FIX.c 1
/src/opus/silk/fixed/process_gains_FIX.c 1
/src/opus/silk/gain_quant.c 3
/src/opus/celt/entcode.c 1
/src/opus/./celt/pitch.h 1
/src/opus/celt/laplace.c 2
/src/opus/celt/rate.c 2
/src/opus/celt/entdec.c 8
/src/opus/celt/vq.c 9
/src/opus/./celt/rate.h 3
/src/opus/celt/cwrs.c 4

Fuzzer: opus_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 86 7.99%
gold [1:9] 1 0.09%
yellow [10:29] 2 0.18%
greenyellow [30:49] 1 0.09%
lawngreen 50+ 986 91.6%
All colors 1076 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
86 86 1 :

['alg_unquant']

86 86 quant_partition call site: 00963 /src/opus/celt/bands.c:1056
28 28 1 :

['ec_dec_uint']

61 76 interp_bits2pulses call site: 00888 /src/opus/celt/rate.c:397
28 28 1 :

['ec_dec_uint']

34 79 compute_theta call site: 00943 /src/opus/celt/bands.c:799
24 24 3 :

['ec_decode', 'isqrt32', 'ec_dec_update']

30 75 compute_theta call site: 00945 /src/opus/celt/bands.c:806
18 18 2 :

['ec_decode', 'ec_dec_update']

24 69 compute_theta call site: 00940 /src/opus/celt/bands.c:784
9 9 1 :

['ec_dec_bit_logp']

33 33 interp_bits2pulses call site: 00892 /src/opus/celt/rate.c:414
9 9 1 :

['ec_dec_bit_logp']

9 29 compute_theta call site: 00956 /src/opus/celt/bands.c:863
6 6 1 :

['ec_dec_bits']

6 366 quant_band_stereo call site: 01025 /src/opus/celt/bands.c:1299
6 6 1 :

['celt_fatal']

6 6 check_control_input call site: 00200 /src/opus/silk/check_control_input.c:100
6 6 1 :

['celt_fatal']

6 6 silk_InitEncoder call site: 00031 /src/opus/silk/enc_API.c:93
6 6 1 :

['celt_fatal']

6 6 silk_resampler_init call site: 00211 /src/opus/silk/resampler.c:148
4 4 1 :

['parse_size']

4 4 opus_packet_parse_impl call site: 00156 /src/opus/src/opus.c:304

Runtime coverage analysis

Covered functions
321
Functions that are reachable but not covered
21
Reachable functions
315
Percentage of reachable functions covered
93.33%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_encode_fuzzer.cc 1
/src/opus/src/opus_encoder.c 23
/src/opus/silk/enc_API.c 4
/src/opus/src/opus_private.h 1
/src/opus/celt/celt_encoder.c 19
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/celt/x86/x86cpu.c 4
/src/opus/silk/init_encoder.c 1
/src/opus/silk/lin2log.c 1
/src/opus/./silk/Inlines.h 5
/src/opus/./silk/macros.h 1
/src/opus/./silk/SigProc_FIX.h 5
/src/opus/silk/VAD.c 1
/src/opus/./celt/arch.h 1
/src/opus/celt/celt.c 4
/src/opus/src/analysis.c 8
/src/opus/./celt/mathops.h 8
/src/opus/celt/kiss_fft.c 6
/src/opus/./celt/float_cast.h 1
/src/opus/src/mlp.c 5
/src/opus/celt/mathops.c 7
/src/opus/src/repacketizer.c 5
/src/opus/src/opus.c 4
/src/opus/src/opus_decoder.c 1
/src/opus/celt/entenc.c 13
/src/opus/silk/log2lin.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/biquad_alt.c 2
/src/opus/silk/check_control_input.c 1
/src/opus/silk/control_codec.c 5
/src/opus/silk/resampler.c 2
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/silk/control_audio_bandwidth.c 1
/src/opus/./celt/entcode.h 6
/src/opus/silk/stereo_encode_pred.c 2
/src/opus/silk/encode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/encode_pulses.c 2
/src/opus/silk/shell_coder.c 3
/src/opus/silk/code_signs.c 1
/src/opus/silk/HP_variable_cutoff.c 1
/src/opus/silk/stereo_LR_to_MS.c 1
/src/opus/silk/stereo_find_predictor.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/inner_prod_aligned.c 1
/src/opus/silk/stereo_quant_pred.c 1
/src/opus/silk/fixed/encode_frame_FIX.c 3
/src/opus/silk/control_SNR.c 1
/src/opus/silk/LP_variable_cutoff.c 2
/src/opus/silk/fixed/find_pitch_lags_FIX.c 1
/src/opus/silk/fixed/apply_sine_window_FIX.c 1
/src/opus/silk/fixed/autocorr_FIX.c 1
/src/opus/celt/celt_lpc.c 2
/src/opus/celt/pitch.c 7
/src/opus/silk/fixed/schur_FIX.c 1
/src/opus/silk/fixed/k2a_FIX.c 1
/src/opus/silk/bwexpander.c 1
/src/opus/silk/LPC_analysis_filter.c 1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c 3
/src/opus/silk/resampler_down2.c 1
/src/opus/silk/resampler_down2_3.c 1
/src/opus/silk/fixed/vector_ops_FIX.c 2
/src/opus/silk/sort.c 3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c 3
/src/opus/silk/sigm_Q15.c 1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c 1
/src/opus/silk/fixed/schur64_FIX.c 1
/src/opus/silk/fixed/k2a_Q16_FIX.c 1
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/fixed/find_pred_coefs_FIX.c 1
/src/opus/silk/fixed/find_LTP_FIX.c 1
/src/opus/silk/fixed/corrMatrix_FIX.c 2
/src/opus/silk/quant_LTP_gains.c 1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c 1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c 1
/src/opus/silk/fixed/find_LPC_FIX.c 1
/src/opus/silk/A2NLSF.c 4
/src/opus/silk/interpolate.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/silk/process_NLSFs.c 1
/src/opus/silk/NLSF_VQ_weights_laroia.c 1
/src/opus/silk/NLSF_encode.c 1
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/silk/NLSF_VQ.c 1
/src/opus/silk/NLSF_del_dec_quant.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/fixed/residual_energy_FIX.c 1
/src/opus/silk/fixed/process_gains_FIX.c 1
/src/opus/silk/gain_quant.c 3
/src/opus/celt/entcode.c 1
/src/opus/./celt/pitch.h 1
/src/opus/celt/mdct.c 1
/src/opus/celt/bands.c 22
/src/opus/celt/quant_bands.c 6
/src/opus/celt/laplace.c 2
/src/opus/celt/rate.c 2
/src/opus/celt/entdec.c 8
/src/opus/celt/vq.c 9
/src/opus/./celt/rate.h 3
/src/opus/celt/cwrs.c 4

Fuzzer: opus_projection_encoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 192 16.0%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 2 0.16%
lawngreen 50+ 999 83.7%
All colors 1193 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
121 121 1 :

['surround_analysis']

121 6072 opus_multistream_encode_native call site: 00174 /src/opus/src/opus_multistream_encoder.c:870
86 86 1 :

['alg_unquant']

86 86 quant_partition call site: 01086 /src/opus/celt/bands.c:1056
48 48 2 :

['ms_get_window_mem', 'ms_get_preemph_mem']

169 6820 opus_multistream_encode_native call site: 00165 /src/opus/src/opus_multistream_encoder.c:837
48 48 2 :

['ms_get_window_mem', 'ms_get_preemph_mem']

48 48 opus_multistream_encoder_init_impl call site: 00109 /src/opus/src/opus_multistream_encoder.c:488
28 28 1 :

['ec_dec_uint']

61 76 interp_bits2pulses call site: 01008 /src/opus/celt/rate.c:397
28 28 1 :

['ec_dec_uint']

34 79 compute_theta call site: 01067 /src/opus/celt/bands.c:799
18 24 3 :

['ec_decode', 'isqrt32', 'ec_dec_update']

24 75 compute_theta call site: 01069 /src/opus/celt/bands.c:806
18 18 2 :

['ec_decode', 'ec_dec_update']

24 69 compute_theta call site: 01064 /src/opus/celt/bands.c:784
9 9 1 :

['ec_dec_bit_logp']

33 33 interp_bits2pulses call site: 01012 /src/opus/celt/rate.c:414
9 9 1 :

['ec_dec_bit_logp']

9 29 compute_theta call site: 01079 /src/opus/celt/bands.c:863
6 6 1 :

['ec_dec_bits']

6 366 quant_band_stereo call site: 01141 /src/opus/celt/bands.c:1299
6 6 1 :

['celt_fatal']

6 21 silk_P_Ana_calc_corr_st3 call site: 00600 /src/opus/silk/float/pitch_analysis_core_FLP.c:512

Runtime coverage analysis

Covered functions
334
Functions that are reachable but not covered
36
Reachable functions
358
Percentage of reachable functions covered
89.94%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc 1
/src/opus/src/opus_projection_encoder.c 11
/src/opus/celt/mathops.c 1
/src/opus/src/mapping_matrix.c 3
/src/opus/src/opus_private.h 1
/src/opus/src/opus_multistream_encoder.c 15
/src/opus/src/opus_encoder.c 22
/src/opus/silk/enc_API.c 4
/src/opus/celt/celt_encoder.c 19
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/./celt/arch.h 1
/src/opus/celt/x86/x86cpu.c 4
/src/opus/src/opus_multistream.c 4
/src/opus/silk/init_encoder.c 1
/src/opus/silk/lin2log.c 1
/src/opus/./silk/Inlines.h 4
/src/opus/./silk/macros.h 1
/src/opus/./silk/SigProc_FIX.h 5
/src/opus/silk/VAD.c 1
/src/opus/celt/celt.c 3
/src/opus/src/analysis.c 7
/src/opus/tests/../celt/os_support.h 2
/src/opus/celt/x86/pitch_sse.c 4
/src/opus/celt/mdct.c 1
/src/opus/celt/kiss_fft.c 6
/src/opus/celt/bands.c 22
/src/opus/celt/quant_bands.c 6
/src/opus/src/repacketizer.c 6
/src/opus/./celt/mathops.h 2
/src/opus/./celt/float_cast.h 2
/src/opus/src/mlp.c 5
/src/opus/src/opus.c 4
/src/opus/src/opus_decoder.c 1
/src/opus/celt/entenc.c 13
/src/opus/silk/log2lin.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/check_control_input.c 1
/src/opus/silk/control_codec.c 5
/src/opus/silk/resampler.c 2
/src/opus/./silk/float/SigProc_FLP.h 5
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/silk/control_audio_bandwidth.c 1
/src/opus/./celt/entcode.h 6
/src/opus/silk/stereo_encode_pred.c 2
/src/opus/silk/encode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/encode_pulses.c 2
/src/opus/silk/shell_coder.c 3
/src/opus/silk/code_signs.c 1
/src/opus/silk/HP_variable_cutoff.c 1
/src/opus/silk/stereo_LR_to_MS.c 1
/src/opus/silk/stereo_find_predictor.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/inner_prod_aligned.c 1
/src/opus/silk/stereo_quant_pred.c 1
/src/opus/silk/float/encode_frame_FLP.c 3
/src/opus/silk/control_SNR.c 1
/src/opus/silk/LP_variable_cutoff.c 1
/src/opus/silk/biquad_alt.c 1
/src/opus/silk/float/find_pitch_lags_FLP.c 1
/src/opus/silk/float/apply_sine_window_FLP.c 1
/src/opus/silk/float/autocorrelation_FLP.c 1
/src/opus/silk/float/inner_product_FLP.c 1
/src/opus/silk/float/schur_FLP.c 1
/src/opus/silk/float/k2a_FLP.c 1
/src/opus/silk/float/bwexpander_FLP.c 1
/src/opus/silk/float/LPC_analysis_filter_FLP.c 6
/src/opus/silk/float/pitch_analysis_core_FLP.c 3
/src/opus/silk/resampler_down2.c 1
/src/opus/silk/resampler_down2_3.c 1
/src/opus/celt/pitch.c 7
/src/opus/silk/float/energy_FLP.c 1
/src/opus/silk/float/sort_FLP.c 1
/src/opus/silk/float/noise_shape_analysis_FLP.c 4
/src/opus/silk/float/warped_autocorrelation_FLP.c 1
/src/opus/silk/float/find_pred_coefs_FLP.c 1
/src/opus/silk/float/find_LTP_FLP.c 1
/src/opus/silk/float/corrMatrix_FLP.c 2
/src/opus/silk/float/scale_vector_FLP.c 1
/src/opus/silk/float/wrappers_FLP.c 5
/src/opus/silk/quant_LTP_gains.c 1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c 1
/src/opus/silk/float/LTP_analysis_filter_FLP.c 1
/src/opus/silk/float/scale_copy_vector_FLP.c 1
/src/opus/silk/float/find_LPC_FLP.c 1
/src/opus/silk/float/burg_modified_FLP.c 1
/src/opus/silk/A2NLSF.c 4
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/interpolate.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/silk/process_NLSFs.c 1
/src/opus/silk/NLSF_VQ_weights_laroia.c 1
/src/opus/silk/NLSF_encode.c 1
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/silk/sort.c 2
/src/opus/silk/NLSF_VQ.c 1
/src/opus/silk/NLSF_del_dec_quant.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/float/residual_energy_FLP.c 1
/src/opus/silk/float/process_gains_FLP.c 1
/src/opus/silk/gain_quant.c 3
/src/opus/celt/entcode.c 1
/src/opus/celt/celt_lpc.c 2
/src/opus/celt/laplace.c 2
/src/opus/celt/rate.c 2
/src/opus/celt/entdec.c 8
/src/opus/celt/vq.c 8
/src/opus/./celt/rate.h 3
/src/opus/celt/x86/vq_sse2.c 1
/src/opus/celt/cwrs.c 4

Fuzzer: opus_multistream_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 152 12.7%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 0 0.0%
lawngreen 50+ 1040 87.2%
All colors 1192 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
86 86 1 :

['alg_unquant']

86 86 quant_partition call site: 01078 /src/opus/celt/bands.c:1056
28 28 1 :

['ec_dec_uint']

61 76 interp_bits2pulses call site: 01003 /src/opus/celt/rate.c:397
28 28 1 :

['ec_dec_uint']

34 79 compute_theta call site: 01058 /src/opus/celt/bands.c:799
18 24 3 :

['ec_decode', 'isqrt32', 'ec_dec_update']

24 75 compute_theta call site: 01060 /src/opus/celt/bands.c:806
18 18 2 :

['ec_decode', 'ec_dec_update']

24 69 compute_theta call site: 01055 /src/opus/celt/bands.c:784
9 115 3 :

['silk_resampler', 'silk_short2float_array', 'silk_float2short_array']

9 179 silk_setup_resamplers call site: 00331 /src/opus/silk/control_codec.c:144
9 9 1 :

['ec_dec_bit_logp']

33 33 interp_bits2pulses call site: 01007 /src/opus/celt/rate.c:414
9 9 1 :

['ec_dec_bit_logp']

9 29 compute_theta call site: 01071 /src/opus/celt/bands.c:863
6 6 1 :

['ec_dec_bits']

6 366 quant_band_stereo call site: 01140 /src/opus/celt/bands.c:1299
6 6 1 :

['celt_fatal']

6 6 check_control_input call site: 00321 /src/opus/silk/check_control_input.c:100
6 6 1 :

['celt_fatal']

6 6 silk_InitEncoder call site: 00052 /src/opus/silk/enc_API.c:93
6 6 1 :

['celt_fatal']

6 6 silk_resampler_init call site: 00332 /src/opus/silk/resampler.c:148

Runtime coverage analysis

Covered functions
344
Functions that are reachable but not covered
25
Reachable functions
344
Percentage of reachable functions covered
92.73%
NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.
Function name source code lines source lines hit percentage hit

Files reached

filename functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc 1
/src/opus/src/opus_multistream_encoder.c 22
/src/opus/celt/mathops.c 7
/src/opus/src/opus_encoder.c 21
/src/opus/silk/enc_API.c 4
/src/opus/src/opus_private.h 1
/src/opus/celt/celt_encoder.c 19
/src/opus/celt/modes.c 1
/src/opus/./celt/os_support.h 2
/src/opus/celt/x86/x86cpu.c 4
/src/opus/src/opus_multistream.c 4
/src/opus/silk/init_encoder.c 1
/src/opus/silk/lin2log.c 1
/src/opus/./silk/Inlines.h 5
/src/opus/./silk/macros.h 1
/src/opus/./silk/SigProc_FIX.h 5
/src/opus/silk/VAD.c 1
/src/opus/./celt/arch.h 1
/src/opus/celt/celt.c 4
/src/opus/src/analysis.c 8
/src/opus/tests/../celt/os_support.h 2
/src/opus/celt/mdct.c 1
/src/opus/celt/kiss_fft.c 6
/src/opus/celt/bands.c 22
/src/opus/./celt/mathops.h 8
/src/opus/celt/quant_bands.c 6
/src/opus/src/repacketizer.c 6
/src/opus/./celt/float_cast.h 1
/src/opus/src/mlp.c 5
/src/opus/src/opus.c 4
/src/opus/src/opus_decoder.c 1
/src/opus/celt/entenc.c 13
/src/opus/silk/log2lin.c 1
/src/opus/./silk/typedef.h 1
/src/opus/silk/biquad_alt.c 2
/src/opus/silk/check_control_input.c 1
/src/opus/silk/control_codec.c 5
/src/opus/silk/resampler.c 2
/src/opus/silk/resampler_private_up2_HQ.c 2
/src/opus/silk/resampler_private_IIR_FIR.c 2
/src/opus/silk/resampler_private_down_FIR.c 2
/src/opus/silk/resampler_private_AR2.c 1
/src/opus/silk/control_audio_bandwidth.c 1
/src/opus/./celt/entcode.h 6
/src/opus/silk/stereo_encode_pred.c 2
/src/opus/silk/encode_indices.c 1
/src/opus/silk/NLSF_unpack.c 1
/src/opus/silk/encode_pulses.c 2
/src/opus/silk/shell_coder.c 3
/src/opus/silk/code_signs.c 1
/src/opus/silk/HP_variable_cutoff.c 1
/src/opus/silk/stereo_LR_to_MS.c 1
/src/opus/silk/stereo_find_predictor.c 1
/src/opus/silk/sum_sqr_shift.c 1
/src/opus/silk/inner_prod_aligned.c 1
/src/opus/silk/stereo_quant_pred.c 1
/src/opus/silk/fixed/encode_frame_FIX.c 3
/src/opus/silk/control_SNR.c 1
/src/opus/silk/LP_variable_cutoff.c 2
/src/opus/silk/fixed/find_pitch_lags_FIX.c 1
/src/opus/silk/fixed/apply_sine_window_FIX.c 1
/src/opus/silk/fixed/autocorr_FIX.c 1
/src/opus/celt/celt_lpc.c 2
/src/opus/celt/pitch.c 7
/src/opus/silk/fixed/schur_FIX.c 1
/src/opus/silk/fixed/k2a_FIX.c 1
/src/opus/silk/bwexpander.c 1
/src/opus/silk/LPC_analysis_filter.c 1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c 3
/src/opus/silk/resampler_down2.c 1
/src/opus/silk/resampler_down2_3.c 1
/src/opus/silk/fixed/vector_ops_FIX.c 2
/src/opus/silk/sort.c 3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c 3
/src/opus/silk/sigm_Q15.c 1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c 1
/src/opus/silk/fixed/schur64_FIX.c 1
/src/opus/silk/fixed/k2a_Q16_FIX.c 1
/src/opus/silk/bwexpander_32.c 1
/src/opus/silk/LPC_fit.c 1
/src/opus/silk/fixed/find_pred_coefs_FIX.c 1
/src/opus/silk/fixed/find_LTP_FIX.c 1
/src/opus/silk/fixed/corrMatrix_FIX.c 2
/src/opus/silk/quant_LTP_gains.c 1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c 1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c 1
/src/opus/silk/fixed/find_LPC_FIX.c 1
/src/opus/silk/A2NLSF.c 4
/src/opus/silk/interpolate.c 1
/src/opus/silk/NLSF2A.c 2
/src/opus/silk/LPC_inv_pred_gain.c 2
/src/opus/silk/process_NLSFs.c 1
/src/opus/silk/NLSF_VQ_weights_laroia.c 1
/src/opus/silk/NLSF_encode.c 1
/src/opus/silk/NLSF_stabilize.c 1
/src/opus/silk/NLSF_VQ.c 1
/src/opus/silk/NLSF_del_dec_quant.c 1
/src/opus/silk/NLSF_decode.c 2
/src/opus/silk/fixed/residual_energy_FIX.c 1
/src/opus/silk/fixed/process_gains_FIX.c 1
/src/opus/silk/gain_quant.c 3
/src/opus/celt/entcode.c 1
/src/opus/./celt/pitch.h 1
/src/opus/celt/laplace.c 2
/src/opus/celt/rate.c 2
/src/opus/celt/entdec.c 8
/src/opus/celt/vq.c 9
/src/opus/./celt/rate.h 3
/src/opus/celt/cwrs.c 4

Fuzzer: opus_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is
Color Runtime hitcount Callsite count Percentage
red 0 149 14.1%
gold [1:9] 0 0.0%
yellow [10:29] 0 0.0%
greenyellow [30:49] 2 0.18%
lawngreen 50+ 902 85.6%
All colors 1053 100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity Unique Reachable Complexities Unique Reachable Functions All non-covered Complexity All Reachable Complexity Function Name Function Callsite Blocked Branch
6 6 1 :

['celt_fatal']

6 21 silk_P_Ana_calc_corr_st3 call site: 00457 /src/opus/silk/float/pitch_analysis_core_FLP.c:512
6 6 1 :

['celt_fatal']

6 16 silk_P_Ana_calc_energy_st3 call site: 00466 /src/opus/silk/float/pitch_analysis_core_FLP.c:578
6 6 1 :

['celt_fatal']

6 6 check_control_input call site: 00190 /src/opus/silk/check_control_input.c:100
6 6 1 :

['celt_fatal']

6 6 silk_InitEncoder call site: 00031 /src/opus/silk/enc_API.c:93
0 115 3 :

['silk_resampler', 'silk_short2float_array', 'silk_float2short_array']

0 179 silk_setup_resamplers call site: 00200 /src/opus/silk/control_codec.c:144
0 103 1 :

['alg_quant']

0