High level conclusions

Fuzzers reach 90.28% of cyclomatic complexity.

Fuzzers reach 90.32% of all functions.

Fuzzers reach 92.65% code coverage.

Reachability and coverage overview

Functions statically reachable by fuzzers

504 / 558

Cyclomatic complexity statically reachable by fuzzers

5308 / 5879

Runtime code coverage of functions

517 / 558

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: opus_repacketizer_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	7.14%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13	92.8%
All colors	14	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	4	1 : View List ['parse_size']	0	4	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:304
0	2	1 : View List ['encode_size']	0	2	opus_repacketizer_out_range_impl	call site: 00010	/src/opus/src/repacketizer.c:207
0	0	None	0	6	opus_repacketizer_out_range_impl	call site: 00008	/src/opus/src/repacketizer.c:120
0	0	None	0	4	opus_repacketizer_out_range_impl	call site: 00009	/src/opus/src/repacketizer.c:159
0	0	None	0	4	opus_repacketizer_out_range_impl	call site: 00009	/src/opus/src/repacketizer.c:191
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:208
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:210
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:250
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:255
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:330
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:340
0	0	None	0	0	opus_packet_get_nb_frames	call site: 00000	/src/opus/src/opus_decoder.c:1007

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

0

Reachable functions

18

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	6
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	1

Fuzzer: opus_repacketizer_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1	7.14%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	13	92.8%
All colors	14	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
0	4	1 : View List ['parse_size']	0	4	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:304
0	2	1 : View List ['encode_size']	0	2	opus_repacketizer_out_range_impl	call site: 00010	/src/opus/src/repacketizer.c:207
0	0	None	0	6	opus_repacketizer_out_range_impl	call site: 00008	/src/opus/src/repacketizer.c:120
0	0	None	0	4	opus_repacketizer_out_range_impl	call site: 00009	/src/opus/src/repacketizer.c:159
0	0	None	0	4	opus_repacketizer_out_range_impl	call site: 00009	/src/opus/src/repacketizer.c:191
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:208
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:210
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:250
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:255
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:330
0	0	None	0	0	opus_packet_parse_impl	call site: 00000	/src/opus/src/opus.c:340
0	0	None	0	0	opus_packet_get_nb_frames	call site: 00000	/src/opus/src/opus_decoder.c:1007

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

0

Reachable functions

18

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	6
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	1

Fuzzer: opus_projection_decoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	98	14.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.42%
lawngreen	50+	598	85.5%
All colors	699	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
103	103	1 : View List ['alg_quant']	103	103	quant_partition	call site: 00559	/src/opus/celt/bands.c:1056
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00482	/src/opus/celt/rate.c:397
31	31	1 : View List ['ec_enc_uint']	62	82	compute_theta	call site: 00539	/src/opus/celt/bands.c:799
29	29	1 : View List ['stereo_itheta']	173	292	compute_theta	call site: 00522	/src/opus/celt/bands.c:734
25	25	2 : View List ['stereo_split', 'intensity_stereo']	25	45	compute_theta	call site: 00548	/src/opus/celt/bands.c:840
23	23	1 : View List ['intensity_stereo']	38	67	compute_theta	call site: 00551	/src/opus/celt/bands.c:850
22	22	1 : View List ['ec_encode']	53	73	compute_theta	call site: 00536	/src/opus/celt/bands.c:784
22	22	1 : View List ['ec_encode']	53	73	compute_theta	call site: 00541	/src/opus/celt/bands.c:806
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00492	/src/opus/celt/rate.c:414
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00552	/src/opus/celt/bands.c:863
12	12	1 : View List ['ec_enc_bits']	12	372	quant_band_stereo	call site: 00612	/src/opus/celt/bands.c:1299
7	7	1 : View List ['celt_exp2']	7	9	opus_decode_frame	call site: 00129	/src/opus/src/opus_decoder.c:604

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

27

Reachable functions

234

Percentage of reachable functions covered

88.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/usr/local/bin/../include/c++/v1/math.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	8
/src/opus/src/mapping_matrix.c	3
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	3
/src/opus/celt/celt_decoder.c	13
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/./celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	5
/src/opus/celt/celt.c	3
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/./silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	8
/src/opus/celt/x86/pitch_sse.c	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/./celt/mathops.h	1
/src/opus/celt/mathops.c	1
/src/opus/./celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4
/src/opus/./celt/stack_alloc.h	1

Fuzzer: opus_projection_decoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	14.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	624	85.5%
All colors	729	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
103	103	1 : View List ['alg_quant']	103	103	quant_partition	call site: 00578	/src/opus/celt/bands.c:1056
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00496	/src/opus/celt/rate.c:397
31	31	1 : View List ['ec_enc_uint']	62	82	compute_theta	call site: 00556	/src/opus/celt/bands.c:799
29	29	1 : View List ['stereo_itheta']	173	292	compute_theta	call site: 00536	/src/opus/celt/bands.c:734
25	25	2 : View List ['stereo_split', 'intensity_stereo']	25	45	compute_theta	call site: 00565	/src/opus/celt/bands.c:840
23	23	1 : View List ['intensity_stereo']	38	67	compute_theta	call site: 00570	/src/opus/celt/bands.c:850
22	22	1 : View List ['ec_encode']	53	73	compute_theta	call site: 00553	/src/opus/celt/bands.c:784
22	22	1 : View List ['ec_encode']	53	73	compute_theta	call site: 00558	/src/opus/celt/bands.c:806
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00506	/src/opus/celt/rate.c:414
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00571	/src/opus/celt/bands.c:863
12	12	1 : View List ['ec_enc_bits']	12	372	quant_band_stereo	call site: 00639	/src/opus/celt/bands.c:1299
0	53	1 : View List ['silk_resampler']	0	53	silk_Decode	call site: 00314	/src/opus/silk/dec_API.c:352

Runtime coverage analysis

Covered functions

217

Functions that are reachable but not covered

25

Reachable functions

240

Percentage of reachable functions covered

89.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/usr/local/bin/../include/c++/v1/math.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	8
/src/opus/src/mapping_matrix.c	3
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	3
/src/opus/celt/celt_decoder.c	13
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/./celt/arch.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	5
/src/opus/celt/celt.c	4
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/./silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	9
/src/opus/./celt/mathops.h	8
/src/opus/celt/mathops.c	7
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/./celt/fixed_generic.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/./celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/pitch.h	1
/src/opus/./celt/stack_alloc.h	1

Fuzzer: opus_multistream_decode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	97	14.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.44%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	575	85.0%
All colors	676	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
103	103	1 : View List ['alg_quant']	103	103	quant_partition	call site: 00538	/src/opus/celt/bands.c:1056
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00461	/src/opus/celt/rate.c:397
31	31	1 : View List ['ec_enc_uint']	62	82	compute_theta	call site: 00518	/src/opus/celt/bands.c:799
29	29	1 : View List ['stereo_itheta']	173	292	compute_theta	call site: 00501	/src/opus/celt/bands.c:734
25	25	2 : View List ['stereo_split', 'intensity_stereo']	25	45	compute_theta	call site: 00527	/src/opus/celt/bands.c:840
23	23	1 : View List ['intensity_stereo']	38	67	compute_theta	call site: 00530	/src/opus/celt/bands.c:850
22	22	1 : View List ['ec_encode']	53	73	compute_theta	call site: 00515	/src/opus/celt/bands.c:784
22	22	1 : View List ['ec_encode']	53	73	compute_theta	call site: 00520	/src/opus/celt/bands.c:806
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00471	/src/opus/celt/rate.c:414
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00531	/src/opus/celt/bands.c:863
12	12	1 : View List ['ec_enc_bits']	12	372	quant_band_stereo	call site: 00591	/src/opus/celt/bands.c:1299
7	7	1 : View List ['celt_exp2']	7	9	opus_decode_frame	call site: 00108	/src/opus/src/opus_decoder.c:604

Runtime coverage analysis

Covered functions

196

Functions that are reachable but not covered

25

Reachable functions

223

Percentage of reachable functions covered

88.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	11
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	3
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	13
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	5
/src/opus/celt/celt.c	3
/src/opus/./celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/./silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	8
/src/opus/celt/x86/pitch_sse.c	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/./celt/mathops.h	1
/src/opus/celt/mathops.c	1
/src/opus/./celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4
/src/opus/./celt/stack_alloc.h	1

Fuzzer: opus_multistream_decode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	104	14.7%
gold	[1:9]	1	0.14%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.56%
lawngreen	50+	597	84.5%
All colors	706	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
103	103	1 : View List ['alg_quant']	103	103	quant_partition	call site: 00557	/src/opus/celt/bands.c:1056
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00475	/src/opus/celt/rate.c:397
31	31	1 : View List ['ec_enc_uint']	62	82	compute_theta	call site: 00535	/src/opus/celt/bands.c:799
29	29	1 : View List ['stereo_itheta']	173	292	compute_theta	call site: 00515	/src/opus/celt/bands.c:734
25	25	2 : View List ['stereo_split', 'intensity_stereo']	25	45	compute_theta	call site: 00544	/src/opus/celt/bands.c:840
23	23	1 : View List ['intensity_stereo']	38	67	compute_theta	call site: 00549	/src/opus/celt/bands.c:850
22	22	1 : View List ['ec_encode']	53	73	compute_theta	call site: 00532	/src/opus/celt/bands.c:784
22	22	1 : View List ['ec_encode']	53	73	compute_theta	call site: 00537	/src/opus/celt/bands.c:806
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00485	/src/opus/celt/rate.c:414
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00550	/src/opus/celt/bands.c:863
12	12	1 : View List ['ec_enc_bits']	12	372	quant_band_stereo	call site: 00618	/src/opus/celt/bands.c:1299
0	53	1 : View List ['silk_resampler']	0	53	silk_Decode	call site: 00293	/src/opus/silk/dec_API.c:352

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

23

Reachable functions

229

Percentage of reachable functions covered

89.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	11
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	3
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	13
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	5
/src/opus/celt/celt.c	4
/src/opus/./celt/arch.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/./silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	9
/src/opus/./celt/mathops.h	8
/src/opus/celt/mathops.c	7
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/./celt/fixed_generic.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/./celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/pitch.h	1
/src/opus/./celt/stack_alloc.h	1

Fuzzer: opus_multistream_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	153	13.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1017	86.9%
All colors	1170	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
86	86	1 : View List ['alg_unquant']	86	86	quant_partition	call site: 01063	/src/opus/celt/bands.c:1056
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 00985	/src/opus/celt/rate.c:397
28	28	1 : View List ['ec_dec_uint']	34	79	compute_theta	call site: 01044	/src/opus/celt/bands.c:799
18	24	3 : View List ['ec_decode', 'isqrt32', 'ec_dec_update']	24	75	compute_theta	call site: 01046	/src/opus/celt/bands.c:806
18	18	2 : View List ['ec_decode', 'ec_dec_update']	24	69	compute_theta	call site: 01041	/src/opus/celt/bands.c:784
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 00989	/src/opus/celt/rate.c:414
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 01056	/src/opus/celt/bands.c:863
6	6	1 : View List ['ec_dec_bits']	6	366	quant_band_stereo	call site: 01118	/src/opus/celt/bands.c:1299
6	6	1 : View List ['celt_fatal']	6	21	silk_P_Ana_calc_corr_st3	call site: 00577	/src/opus/silk/float/pitch_analysis_core_FLP.c:512
6	6	1 : View List ['celt_fatal']	6	16	silk_P_Ana_calc_energy_st3	call site: 00586	/src/opus/silk/float/pitch_analysis_core_FLP.c:578
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00310	/src/opus/silk/check_control_input.c:100
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00052	/src/opus/silk/enc_API.c:93

Runtime coverage analysis

Covered functions

333

Functions that are reachable but not covered

29

Reachable functions

350

Percentage of reachable functions covered

91.71%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	22
/src/opus/celt/mathops.c	1
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	19
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/./silk/Inlines.h	4
/src/opus/./silk/macros.h	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/./celt/arch.h	1
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/src/repacketizer.c	6
/src/opus/./celt/mathops.h	2
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/celt/entenc.c	13
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	5
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./celt/entcode.h	6
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	1
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/inner_product_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/celt/pitch.c	7
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/./celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_encoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	190	15.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.16%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	1021	84.1%
All colors	1214	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
121	121	1 : View List ['surround_analysis']	121	6072	opus_multistream_encode_native	call site: 00174	/src/opus/src/opus_multistream_encoder.c:870
86	86	1 : View List ['alg_unquant']	86	86	quant_partition	call site: 01101	/src/opus/celt/bands.c:1056
48	48	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	169	6820	opus_multistream_encode_native	call site: 00165	/src/opus/src/opus_multistream_encoder.c:837
48	48	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	48	48	opus_multistream_encoder_init_impl	call site: 00109	/src/opus/src/opus_multistream_encoder.c:488
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01026	/src/opus/celt/rate.c:397
28	28	1 : View List ['ec_dec_uint']	34	79	compute_theta	call site: 01081	/src/opus/celt/bands.c:799
18	24	3 : View List ['ec_decode', 'isqrt32', 'ec_dec_update']	24	75	compute_theta	call site: 01083	/src/opus/celt/bands.c:806
18	18	2 : View List ['ec_decode', 'ec_dec_update']	24	69	compute_theta	call site: 01078	/src/opus/celt/bands.c:784
9	115	3 : View List ['silk_resampler', 'silk_short2float_array', 'silk_float2short_array']	9	179	silk_setup_resamplers	call site: 00354	/src/opus/silk/control_codec.c:144
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 01030	/src/opus/celt/rate.c:414
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 01094	/src/opus/celt/bands.c:863
6	6	1 : View List ['ec_dec_bits']	6	366	quant_band_stereo	call site: 01162	/src/opus/celt/bands.c:1299

Runtime coverage analysis

Covered functions

345

Functions that are reachable but not covered

32

Reachable functions

352

Percentage of reachable functions covered

90.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	11
/src/opus/celt/mathops.c	7
/src/opus/src/mapping_matrix.c	3
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	19
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/./celt/arch.h	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/./silk/Inlines.h	5
/src/opus/./silk/macros.h	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/./celt/mathops.h	8
/src/opus/celt/quant_bands.c	6
/src/opus/src/repacketizer.c	6
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/celt/entenc.c	13
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./celt/entcode.h	6
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.c	1
/src/opus/./celt/pitch.h	1
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	9
/src/opus/./celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	86	7.99%
gold	[1:9]	1	0.09%
yellow	[10:29]	2	0.18%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	986	91.6%
All colors	1076	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
86	86	1 : View List ['alg_unquant']	86	86	quant_partition	call site: 00963	/src/opus/celt/bands.c:1056
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 00888	/src/opus/celt/rate.c:397
28	28	1 : View List ['ec_dec_uint']	34	79	compute_theta	call site: 00943	/src/opus/celt/bands.c:799
24	24	3 : View List ['ec_decode', 'isqrt32', 'ec_dec_update']	30	75	compute_theta	call site: 00945	/src/opus/celt/bands.c:806
18	18	2 : View List ['ec_decode', 'ec_dec_update']	24	69	compute_theta	call site: 00940	/src/opus/celt/bands.c:784
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 00892	/src/opus/celt/rate.c:414
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 00956	/src/opus/celt/bands.c:863
6	6	1 : View List ['ec_dec_bits']	6	366	quant_band_stereo	call site: 01025	/src/opus/celt/bands.c:1299
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00200	/src/opus/silk/check_control_input.c:100
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00031	/src/opus/silk/enc_API.c:93
6	6	1 : View List ['celt_fatal']	6	6	silk_resampler_init	call site: 00211	/src/opus/silk/resampler.c:148
4	4	1 : View List ['parse_size']	4	4	opus_packet_parse_impl	call site: 00156	/src/opus/src/opus.c:304

Runtime coverage analysis

Covered functions

321

Functions that are reachable but not covered

21

Reachable functions

315

Percentage of reachable functions covered

93.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	23
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	19
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/./silk/Inlines.h	5
/src/opus/./silk/macros.h	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/./celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/./celt/mathops.h	8
/src/opus/celt/kiss_fft.c	6
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/celt/mathops.c	7
/src/opus/src/repacketizer.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/celt/entenc.c	13
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./celt/entcode.h	6
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.c	1
/src/opus/./celt/pitch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	9
/src/opus/./celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_encoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	192	16.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.16%
lawngreen	50+	999	83.7%
All colors	1193	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
121	121	1 : View List ['surround_analysis']	121	6072	opus_multistream_encode_native	call site: 00174	/src/opus/src/opus_multistream_encoder.c:870
86	86	1 : View List ['alg_unquant']	86	86	quant_partition	call site: 01086	/src/opus/celt/bands.c:1056
48	48	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	169	6820	opus_multistream_encode_native	call site: 00165	/src/opus/src/opus_multistream_encoder.c:837
48	48	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	48	48	opus_multistream_encoder_init_impl	call site: 00109	/src/opus/src/opus_multistream_encoder.c:488
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01008	/src/opus/celt/rate.c:397
28	28	1 : View List ['ec_dec_uint']	34	79	compute_theta	call site: 01067	/src/opus/celt/bands.c:799
18	24	3 : View List ['ec_decode', 'isqrt32', 'ec_dec_update']	24	75	compute_theta	call site: 01069	/src/opus/celt/bands.c:806
18	18	2 : View List ['ec_decode', 'ec_dec_update']	24	69	compute_theta	call site: 01064	/src/opus/celt/bands.c:784
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 01012	/src/opus/celt/rate.c:414
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 01079	/src/opus/celt/bands.c:863
6	6	1 : View List ['ec_dec_bits']	6	366	quant_band_stereo	call site: 01141	/src/opus/celt/bands.c:1299
6	6	1 : View List ['celt_fatal']	6	21	silk_P_Ana_calc_corr_st3	call site: 00600	/src/opus/silk/float/pitch_analysis_core_FLP.c:512

Runtime coverage analysis

Covered functions

334

Functions that are reachable but not covered

36

Reachable functions

358

Percentage of reachable functions covered

89.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	11
/src/opus/celt/mathops.c	1
/src/opus/src/mapping_matrix.c	3
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	19
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/./celt/arch.h	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/./silk/Inlines.h	4
/src/opus/./silk/macros.h	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/src/repacketizer.c	6
/src/opus/./celt/mathops.h	2
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/celt/entenc.c	13
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	5
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./celt/entcode.h	6
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	1
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/inner_product_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/celt/pitch.c	7
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/./celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	152	12.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1040	87.2%
All colors	1192	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
86	86	1 : View List ['alg_unquant']	86	86	quant_partition	call site: 01078	/src/opus/celt/bands.c:1056
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01003	/src/opus/celt/rate.c:397
28	28	1 : View List ['ec_dec_uint']	34	79	compute_theta	call site: 01058	/src/opus/celt/bands.c:799
18	24	3 : View List ['ec_decode', 'isqrt32', 'ec_dec_update']	24	75	compute_theta	call site: 01060	/src/opus/celt/bands.c:806
18	18	2 : View List ['ec_decode', 'ec_dec_update']	24	69	compute_theta	call site: 01055	/src/opus/celt/bands.c:784
9	115	3 : View List ['silk_resampler', 'silk_short2float_array', 'silk_float2short_array']	9	179	silk_setup_resamplers	call site: 00331	/src/opus/silk/control_codec.c:144
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 01007	/src/opus/celt/rate.c:414
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 01071	/src/opus/celt/bands.c:863
6	6	1 : View List ['ec_dec_bits']	6	366	quant_band_stereo	call site: 01140	/src/opus/celt/bands.c:1299
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00321	/src/opus/silk/check_control_input.c:100
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00052	/src/opus/silk/enc_API.c:93
6	6	1 : View List ['celt_fatal']	6	6	silk_resampler_init	call site: 00332	/src/opus/silk/resampler.c:148

Runtime coverage analysis

Covered functions

344

Functions that are reachable but not covered

25

Reachable functions

344

Percentage of reachable functions covered

92.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	22
/src/opus/celt/mathops.c	7
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	19
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/./silk/Inlines.h	5
/src/opus/./silk/macros.h	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/./celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/./celt/mathops.h	8
/src/opus/celt/quant_bands.c	6
/src/opus/src/repacketizer.c	6
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/celt/entenc.c	13
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./celt/entcode.h	6
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.c	1
/src/opus/./celt/pitch.h	1
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	9
/src/opus/./celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	149	14.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.18%
lawngreen	50+	902	85.6%
All colors	1053	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
6	6	1 : View List ['celt_fatal']	6	21	silk_P_Ana_calc_corr_st3	call site: 00457	/src/opus/silk/float/pitch_analysis_core_FLP.c:512
6	6	1 : View List ['celt_fatal']	6	16	silk_P_Ana_calc_energy_st3	call site: 00466	/src/opus/silk/float/pitch_analysis_core_FLP.c:578
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00190	/src/opus/silk/check_control_input.c:100
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00031	/src/opus/silk/enc_API.c:93
0	115	3 : View List ['silk_resampler', 'silk_short2float_array', 'silk_float2short_array']	0	179	silk_setup_resamplers	call site: 00200	/src/opus/silk/control_codec.c:144
0	103	1 : View List ['alg_quant']	0