High level conclusions

Fuzzers reach 87.64% of cyclomatic complexity.

Fuzzers reach 81.69% of all functions.

Fuzzers reach 86.67% code coverage.

Reachability and coverage overview

Functions statically reachable by fuzzers

558 / 683

Cyclomatic complexity statically reachable by fuzzers

5890 / 6720

Runtime code coverage of functions

592 / 683

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: opus_repacketizer_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	7.01%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	53	92.9%
All colors	57	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00032	/src/opus/src/extensions.c:191
0	4	1 : View List ['parse_size']	0	4	opus_packet_parse_impl	call site: 00014	/src/opus/src/opus.c:342
0	2	1 : View List ['encode_size']	6	88	opus_repacketizer_out_range_impl	call site: 00051	/src/opus/src/repacketizer.c:294
0	0	None	6	296	opus_repacketizer_out_range_impl	call site: 00017	/src/opus/src/repacketizer.c:138
0	0	None	6	170	opus_repacketizer_out_range_impl	call site: 00041	/src/opus/src/repacketizer.c:222
0	0	None	6	59	opus_extension_iterator_next	call site: 00034	/src/opus/src/extensions.c:271
0	0	None	0	0	opus_extension_iterator_next	call site: 00025	/src/opus/src/extensions.c:229
0	0	None	0	0	opus_packet_extensions_parse	call site: 00040	/src/opus/src/extensions.c:372
0	0	None	0	0	opus_packet_extensions_generate	call site: 00045	/src/opus/src/extensions.c:606
0	0	None	0	0	opus_packet_extensions_generate	call site: 00050	/src/opus/src/extensions.c:634
0	0	None	0	0	skip_extension	call site: 00028	/src/opus/src/extensions.c:103
0	0	None	0	0	skip_extension	call site: 00028	/src/opus/src/extensions.c:107

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_multistream_decode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	114	14.9%
gold	[1:9]	1	0.13%
yellow	[10:29]	2	0.26%
greenyellow	[30:49]	2	0.26%
lawngreen	50+	645	84.4%
All colors	764	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
137	137	1 : View List ['alg_quant']	137	137	quant_partition	call site: 00600	/src/opus/celt/bands.c:1112
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00509	/src/opus/celt/rate.c:398
22	22	1 : View List ['stereo_itheta']	161	350	compute_theta	call site: 00551	/src/opus/celt/bands.c:735
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00576	/src/opus/celt/bands.c:786
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00581	/src/opus/celt/bands.c:808
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00519	/src/opus/celt/rate.c:415
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00593	/src/opus/celt/bands.c:889
12	12	1 : View List ['ec_enc_bits']	12	468	quant_band_stereo	call site: 00665	/src/opus/celt/bands.c:1472
7	7	2 : View List ['intensity_stereo', 'stereo_split']	7	27	compute_theta	call site: 00588	/src/opus/celt/bands.c:866
5	5	1 : View List ['intensity_stereo']	20	49	compute_theta	call site: 00592	/src/opus/celt/bands.c:876
0	50	1 : View List ['silk_resampler']	0	50	silk_Decode	call site: 00301	/src/opus/silk/dec_API.c:437
0	2	1 : View List ['celt_exp2']	0	4	opus_decode_frame	call site: 00114	/src/opus/src/opus_decoder.c:680

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

24

Reachable functions

244

Percentage of reachable functions covered

90.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/celt/arch.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	13
/src/opus/celt/mathops.h	8
/src/opus/celt/mathops.c	11
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/fixed_generic.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1

Fuzzer: opus_projection_decoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	114	14.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	675	85.5%
All colors	789	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
137	137	1 : View List ['alg_quant']	137	137	quant_partition	call site: 00619	/src/opus/celt/bands.c:1112
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00528	/src/opus/celt/rate.c:398
22	22	1 : View List ['stereo_itheta']	161	350	compute_theta	call site: 00570	/src/opus/celt/bands.c:735
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00595	/src/opus/celt/bands.c:786
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00600	/src/opus/celt/bands.c:808
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00538	/src/opus/celt/rate.c:415
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00612	/src/opus/celt/bands.c:889
12	12	1 : View List ['ec_enc_bits']	12	468	quant_band_stereo	call site: 00684	/src/opus/celt/bands.c:1472
7	7	2 : View List ['intensity_stereo', 'stereo_split']	7	27	compute_theta	call site: 00607	/src/opus/celt/bands.c:866
5	5	1 : View List ['intensity_stereo']	20	49	compute_theta	call site: 00611	/src/opus/celt/bands.c:876
0	50	1 : View List ['silk_resampler']	0	50	silk_Decode	call site: 00320	/src/opus/silk/dec_API.c:437
0	2	1 : View List ['celt_exp2']	0	4	opus_decode_frame	call site: 00133	/src/opus/src/opus_decoder.c:680

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

24

Reachable functions

253

Percentage of reachable functions covered

90.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	13
/src/opus/celt/mathops.h	8
/src/opus/celt/mathops.c	11
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/fixed_generic.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1

Fuzzer: opus_projection_decoder_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	16.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.24%
greenyellow	[30:49]	2	0.24%
lawngreen	50+	692	83.3%
All colors	830	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
137	137	1 : View List ['alg_quant']	137	137	quant_partition	call site: 00625	/src/opus/celt/bands.c:1112
55	55	2 : View List ['median_of_5_val16', 'ec_enc_depth']	55	57	clt_compute_extra_allocation	call site: 00515	/src/opus/celt/rate.c:769
53	53	2 : View List ['ec_enc_uint', 'stereo_itheta']	53	285	cubic_quant_partition	call site: 00565	/src/opus/celt/bands.c:1212
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00482	/src/opus/celt/rate.c:398
31	31	1 : View List ['ec_enc_uint']	38	60	compute_theta	call site: 00609	/src/opus/celt/bands.c:848
22	22	1 : View List ['stereo_itheta']	161	350	compute_theta	call site: 00583	/src/opus/celt/bands.c:735
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00593	/src/opus/celt/bands.c:786
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00598	/src/opus/celt/bands.c:808
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00492	/src/opus/celt/rate.c:415
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00616	/src/opus/celt/bands.c:889
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00801	/src/opus/src/extensions.c:191
12	12	1 : View List ['ec_enc_bits']	12	468	quant_band_stereo	call site: 00710	/src/opus/celt/bands.c:1472

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

32

Reachable functions

258

Percentage of reachable functions covered

87.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.h	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_decode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	100	14.4%
gold	[1:9]	1	0.14%
yellow	[10:29]	2	0.28%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	590	85.0%
All colors	694	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
137	137	1 : View List ['alg_quant']	137	137	quant_partition	call site: 00543	/src/opus/celt/bands.c:1112
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00460	/src/opus/celt/rate.c:398
22	22	1 : View List ['stereo_itheta']	161	350	compute_theta	call site: 00502	/src/opus/celt/bands.c:735
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00520	/src/opus/celt/bands.c:786
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00525	/src/opus/celt/bands.c:808
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00470	/src/opus/celt/rate.c:415
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00536	/src/opus/celt/bands.c:889
12	12	1 : View List ['ec_enc_bits']	12	468	quant_band_stereo	call site: 00596	/src/opus/celt/bands.c:1472
7	7	2 : View List ['intensity_stereo', 'stereo_split']	7	27	compute_theta	call site: 00532	/src/opus/celt/bands.c:866
5	5	1 : View List ['intensity_stereo']	20	49	compute_theta	call site: 00535	/src/opus/celt/bands.c:876
0	50	1 : View List ['silk_resampler']	0	50	silk_Decode	call site: 00301	/src/opus/silk/dec_API.c:437
0	2	1 : View List ['celt_exp2']	0	4	opus_decode_frame	call site: 00114	/src/opus/src/opus_decoder.c:680

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

24

Reachable functions

228

Percentage of reachable functions covered

89.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.h	3
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_projection_decoder_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	156	17.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.22%
greenyellow	[30:49]	2	0.22%
lawngreen	50+	745	82.3%
All colors	905	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
137	137	1 : View List ['alg_quant']	137	137	quant_partition	call site: 00681	/src/opus/celt/bands.c:1112
55	55	2 : View List ['median_of_5_val16', 'ec_enc_depth']	55	57	clt_compute_extra_allocation	call site: 00556	/src/opus/celt/rate.c:769
53	53	2 : View List ['ec_enc_uint', 'stereo_itheta']	57	285	cubic_quant_partition	call site: 00613	/src/opus/celt/bands.c:1212
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00523	/src/opus/celt/rate.c:398
31	31	1 : View List ['ec_enc_uint']	38	60	compute_theta	call site: 00664	/src/opus/celt/bands.c:848
22	22	1 : View List ['stereo_itheta']	161	350	compute_theta	call site: 00638	/src/opus/celt/bands.c:735
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00648	/src/opus/celt/bands.c:786
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00653	/src/opus/celt/bands.c:808
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00533	/src/opus/celt/rate.c:415
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00672	/src/opus/celt/bands.c:889
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00879	/src/opus/src/extensions.c:191
12	12	1 : View List ['ec_enc_bits']	12	468	quant_band_stereo	call site: 00782	/src/opus/celt/bands.c:1472

Runtime coverage analysis

Covered functions

244

Functions that are reachable but not covered

33

Reachable functions

276

Percentage of reachable functions covered

88.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	21
/src/opus/celt/mathops.h	10
/src/opus/celt/mathops.c	13
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/arch.h	1

Fuzzer: opus_multistream_decode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	156	17.7%
gold	[1:9]	1	0.11%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.45%
lawngreen	50+	719	81.7%
All colors	880	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
137	137	1 : View List ['alg_quant']	137	137	quant_partition	call site: 00662	/src/opus/celt/bands.c:1112
55	55	2 : View List ['median_of_5_val16', 'ec_enc_depth']	55	57	clt_compute_extra_allocation	call site: 00537	/src/opus/celt/rate.c:769
53	53	2 : View List ['ec_enc_uint', 'stereo_itheta']	57	285	cubic_quant_partition	call site: 00594	/src/opus/celt/bands.c:1212
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00504	/src/opus/celt/rate.c:398
31	31	1 : View List ['ec_enc_uint']	38	60	compute_theta	call site: 00645	/src/opus/celt/bands.c:848
22	22	1 : View List ['stereo_itheta']	161	350	compute_theta	call site: 00619	/src/opus/celt/bands.c:735
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00629	/src/opus/celt/bands.c:786
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00634	/src/opus/celt/bands.c:808
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00514	/src/opus/celt/rate.c:415
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00653	/src/opus/celt/bands.c:889
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00860	/src/opus/src/extensions.c:191
12	12	1 : View List ['ec_enc_bits']	12	468	quant_band_stereo	call site: 00763	/src/opus/celt/bands.c:1472

Runtime coverage analysis

Covered functions

235

Functions that are reachable but not covered

33

Reachable functions

267

Percentage of reachable functions covered

87.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	21
/src/opus/celt/mathops.h	10
/src/opus/celt/mathops.c	13
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/arch.h	1

Fuzzer: opus_projection_encoder_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	300	22.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.14%
lawngreen	50+	1058	77.7%
All colors	1360	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
121	121	1 : View List ['surround_analysis']	121	6544	opus_multistream_encode_native	call site: 00182	/src/opus/src/opus_multistream_encoder.c:877
114	114	1 : View List ['cubic_quant_partition']	116	128	quant_band	call site: 01125	/src/opus/celt/bands.c:1329
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 01198	/src/opus/celt/bands.c:1112
95	99	4 : View List ['median_of_5_val16', 'ec_enc_depth', 'ec_dec_depth', 'ec_tell_frac']	95	99	clt_compute_extra_allocation	call site: 01090	/src/opus/celt/rate.c:762
95	97	3 : View List ['cubic_unquant', 'cubic_quant', 'ec_tell_frac']	95	97	quant_partition	call site: 01198	/src/opus/celt/bands.c:1122
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00336	/src/opus/src/repacketizer.c:308
57	69	4 : View List ['op_pvq_search_extra', 'ec_enc_bits', 'ec_enc_refine', 'ec_tell.833']	57	155	alg_quant	call site: 01227	/src/opus/celt/vq.c:584
52	52	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	173	7334	opus_multistream_encode_native	call site: 00173	/src/opus/src/opus_multistream_encoder.c:844
52	52	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	52	52	opus_multistream_encoder_init_impl	call site: 00116	/src/opus/src/opus_multistream_encoder.c:495
38	154	5 : View List ['amp2Log2', 'compute_band_energies', 'normalise_bands', 'encode_qext_stereo_params', 'quant_coarse_energy']	38	1600	celt_encode_with_ec	call site: 01078	/src/opus/celt/celt_encoder.c:2603
28	91	3 : View List ['ec_enc_uint', 'celt_sudiv', 'ec_dec_uint']	28	122	compute_theta	call site: 01180	/src/opus/celt/bands.c:844
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01056	/src/opus/celt/rate.c:398

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

55

Reachable functions

390

Percentage of reachable functions covered

85.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	1
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	6
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1

Fuzzer: opus_multistream_encode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	260	19.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.07%
lawngreen	50+	1069	80.3%
All colors	1330	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
114	114	1 : View List ['cubic_quant_partition']	116	128	quant_band	call site: 01098	/src/opus/celt/bands.c:1329
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 01171	/src/opus/celt/bands.c:1112
95	99	4 : View List ['median_of_5_val16', 'ec_enc_depth', 'ec_dec_depth', 'ec_tell_frac']	95	99	clt_compute_extra_allocation	call site: 01063	/src/opus/celt/rate.c:762
95	97	3 : View List ['cubic_unquant', 'cubic_quant', 'ec_tell_frac']	95	97	quant_partition	call site: 01171	/src/opus/celt/bands.c:1122
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00308	/src/opus/src/repacketizer.c:308
57	69	4 : View List ['op_pvq_search_extra', 'ec_enc_bits', 'ec_enc_refine', 'ec_tell.833']	57	155	alg_quant	call site: 01200	/src/opus/celt/vq.c:584
38	154	5 : View List ['amp2Log2', 'compute_band_energies', 'normalise_bands', 'encode_qext_stereo_params', 'quant_coarse_energy']	38	1600	celt_encode_with_ec	call site: 01051	/src/opus/celt/celt_encoder.c:2603
28	91	3 : View List ['ec_enc_uint', 'celt_sudiv', 'ec_dec_uint']	28	122	compute_theta	call site: 01153	/src/opus/celt/bands.c:844
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01029	/src/opus/celt/rate.c:398
18	24	3 : View List ['ec_dec_update', 'ec_decode', 'isqrt32']	52	158	compute_theta	call site: 01144	/src/opus/celt/bands.c:808
18	18	2 : View List ['ec_decode', 'ec_dec_update']	52	152	compute_theta	call site: 01139	/src/opus/celt/bands.c:786
10	33	3 : View List ['ec_enc_shrink', 'compute_qext_mode', 'ec_enc_bit_logp']	48	1798	celt_encode_with_ec	call site: 01016	/src/opus/celt/celt_encoder.c:2521

Runtime coverage analysis

Covered functions

380

Functions that are reachable but not covered

48

Reachable functions

382

Percentage of reachable functions covered

87.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	23
/src/opus/celt/mathops.c	1
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	6
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1

Fuzzer: opus_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	9.56%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.27%
lawngreen	50+	990	90.1%
All colors	1098	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 00986	/src/opus/celt/bands.c:1112
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00186	/src/opus/src/repacketizer.c:308
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 00902	/src/opus/celt/rate.c:398
24	24	3 : View List ['ec_dec_update', 'ec_decode', 'isqrt32']	58	158	compute_theta	call site: 00968	/src/opus/celt/bands.c:808
18	18	2 : View List ['ec_decode', 'ec_dec_update']	52	152	compute_theta	call site: 00963	/src/opus/celt/bands.c:786
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 00906	/src/opus/celt/rate.c:415
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 00979	/src/opus/celt/bands.c:889
6	6	1 : View List ['ec_dec_bits']	6	462	quant_band_stereo	call site: 01040	/src/opus/celt/bands.c:1472
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00231	/src/opus/silk/check_control_input.c:103
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00032	/src/opus/silk/enc_API.c:97
6	6	1 : View List ['celt_fatal']	6	6	silk_resampler_init	call site: 00244	/src/opus/silk/resampler.c:157
4	4	1 : View List ['parse_size']	4	4	opus_packet_parse_impl	call site: 00151	/src/opus/src/opus.c:342

Runtime coverage analysis

Covered functions

356

Functions that are reachable but not covered

28

Reachable functions

336

Percentage of reachable functions covered

91.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	25
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/./celt/mathops.h	3
/src/opus/celt/kiss_fft.c	6
/src/opus/./celt/arch.h	1
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/mathops.h	5
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.c	1
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_encoder_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	308	20.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.13%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1165	78.9%
All colors	1476	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
121	121	1 : View List ['surround_analysis']	121	6544	opus_multistream_encode_native	call site: 00182	/src/opus/src/opus_multistream_encoder.c:877
114	114	1 : View List ['cubic_quant_partition']	116	128	quant_band	call site: 01206	/src/opus/celt/bands.c:1329
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 01289	/src/opus/celt/bands.c:1112
95	99	4 : View List ['median_of_5_val16', 'ec_enc_depth', 'ec_dec_depth', 'ec_tell_frac']	95	99	clt_compute_extra_allocation	call site: 01171	/src/opus/celt/rate.c:762
95	97	3 : View List ['cubic_unquant', 'cubic_quant', 'ec_tell_frac']	95	97	quant_partition	call site: 01289	/src/opus/celt/bands.c:1122
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00366	/src/opus/src/repacketizer.c:308
57	69	4 : View List ['op_pvq_search_extra', 'ec_enc_bits', 'ec_enc_refine', 'ec_tell.833']	57	155	alg_quant	call site: 01327	/src/opus/celt/vq.c:584
52	52	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	173	7334	opus_multistream_encode_native	call site: 00173	/src/opus/src/opus_multistream_encoder.c:844
52	52	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	52	52	opus_multistream_encoder_init_impl	call site: 00116	/src/opus/src/opus_multistream_encoder.c:495
38	154	5 : View List ['amp2Log2', 'compute_band_energies', 'normalise_bands', 'encode_qext_stereo_params', 'quant_coarse_energy']	38	1600	celt_encode_with_ec	call site: 01159	/src/opus/celt/celt_encoder.c:2603
28	91	3 : View List ['ec_enc_uint', 'celt_sudiv', 'ec_dec_uint']	28	122	compute_theta	call site: 01270	/src/opus/celt/bands.c:844
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01137	/src/opus/celt/rate.c:398

Runtime coverage analysis

Covered functions

400

Functions that are reachable but not covered

52

Reachable functions

400

Percentage of reachable functions covered

87.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	13
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	11
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_decoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	100	13.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	619	86.0%
All colors	719	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
137	137	1 : View List ['alg_quant']	137	137	quant_partition	call site: 00562	/src/opus/celt/bands.c:1112
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00479	/src/opus/celt/rate.c:398
22	22	1 : View List ['stereo_itheta']	161	350	compute_theta	call site: 00521	/src/opus/celt/bands.c:735
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00539	/src/opus/celt/bands.c:786
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00544	/src/opus/celt/bands.c:808
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00489	/src/opus/celt/rate.c:415
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00555	/src/opus/celt/bands.c:889
12	12	1 : View List ['ec_enc_bits']	12	468	quant_band_stereo	call site: 00615	/src/opus/celt/bands.c:1472
7	7	2 : View List ['intensity_stereo', 'stereo_split']	7	27	compute_theta	call site: 00551	/src/opus/celt/bands.c:866
5	5	1 : View List ['intensity_stereo']	20	49	compute_theta	call site: 00554	/src/opus/celt/bands.c:876
0	50	1 : View List ['silk_resampler']	0	50	silk_Decode	call site: 00320	/src/opus/silk/dec_API.c:437
0	2	1 : View List ['celt_exp2']	0	4	opus_decode_frame	call site: 00133	/src/opus/src/opus_decoder.c:680

Runtime coverage analysis

Covered functions

213

Functions that are reachable but not covered

24

Reachable functions

237

Percentage of reachable functions covered

89.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.h	3
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_repacketizer_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	7.01%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	53	92.9%
All colors	57	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00032	/src/opus/src/extensions.c:191
0	4	1 : View List ['parse_size']	0	4	opus_packet_parse_impl	call site: 00014	/src/opus/src/opus.c:342
0	2	1 : View List ['encode_size']	6	88	opus_repacketizer_out_range_impl	call site: 00051	/src/opus/src/repacketizer.c:294
0	0	None	6	296	opus_repacketizer_out_range_impl	call site: 00017	/src/opus/src/repacketizer.c:138
0	0	None	6	170	opus_repacketizer_out_range_impl	call site: 00041	/src/opus/src/repacketizer.c:222
0	0	None	6	59	opus_extension_iterator_next	call site: 00034	/src/opus/src/extensions.c:271
0	0	None	0	0	opus_extension_iterator_next	call site: 00025	/src/opus/src/extensions.c:229
0	0	None	0	0	opus_packet_extensions_parse	call site: 00040	/src/opus/src/extensions.c:372
0	0	None	0	0	opus_packet_extensions_generate	call site: 00050	/src/opus/src/extensions.c:634
0	0	None	0	0	skip_extension	call site: 00028	/src/opus/src/extensions.c:103
0	0	None	0	0	skip_extension	call site: 00028	/src/opus/src/extensions.c:107
0	0	None	0	0	write_extension_payload	call site: 00048	/src/opus/src/extensions.c:428

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_repacketizer_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	7.01%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	53	92.9%
All colors	57	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00032	/src/opus/src/extensions.c:191
0	4	1 : View List ['parse_size']	0	4	opus_packet_parse_impl	call site: 00014	/src/opus/src/opus.c:342
0	2	1 : View List ['encode_size']	6	88	opus_repacketizer_out_range_impl	call site: 00051	/src/opus/src/repacketizer.c:294
0	0	None	6	296	opus_repacketizer_out_range_impl	call site: 00017	/src/opus/src/repacketizer.c:138
0	0	None	6	170	opus_repacketizer_out_range_impl	call site: 00041	/src/opus/src/repacketizer.c:222
0	0	None	6	59	opus_extension_iterator_next	call site: 00034	/src/opus/src/extensions.c:271
0	0	None	0	0	opus_extension_iterator_next	call site: 00025	/src/opus/src/extensions.c:229
0	0	None	0	0	opus_packet_extensions_parse	call site: 00040	/src/opus/src/extensions.c:372
0	0	None	0	0	opus_packet_extensions_generate	call site: 00050	/src/opus/src/extensions.c:634
0	0	None	0	0	skip_extension	call site: 00028	/src/opus/src/extensions.c:103
0	0	None	0	0	skip_extension	call site: 00028	/src/opus/src/extensions.c:107
0	0	None	0	0	write_extension_payload	call site: 00048	/src/opus/src/extensions.c:428

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_repacketizer_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4	7.01%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	53	92.9%
All colors	57	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00032	/src/opus/src/extensions.c:191
0	4	1 : View List ['parse_size']	0	4	opus_packet_parse_impl	call site: 00014	/src/opus/src/opus.c:342
0	2	1 : View List ['encode_size']	6	88	opus_repacketizer_out_range_impl	call site: 00051	/src/opus/src/repacketizer.c:294
0	0	None	6	296	opus_repacketizer_out_range_impl	call site: 00017	/src/opus/src/repacketizer.c:138
0	0	None	6	170	opus_repacketizer_out_range_impl	call site: 00041	/src/opus/src/repacketizer.c:222
0	0	None	6	59	opus_extension_iterator_next	call site: 00034	/src/opus/src/extensions.c:271
0	0	None	0	0	opus_extension_iterator_next	call site: 00025	/src/opus/src/extensions.c:229
0	0	None	0	0	opus_packet_extensions_parse	call site: 00040	/src/opus/src/extensions.c:372
0	0	None	0	0	opus_packet_extensions_generate	call site: 00050	/src/opus/src/extensions.c:634
0	0	None	0	0	skip_extension	call site: 00028	/src/opus/src/extensions.c:103
0	0	None	0	0	skip_extension	call site: 00028	/src/opus/src/extensions.c:107
0	0	None	0	0	write_extension_payload	call site: 00048	/src/opus/src/extensions.c:428

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_multistream_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	168	13.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1051	86.2%
All colors	1219	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 01102	/src/opus/celt/bands.c:1112
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00306	/src/opus/src/repacketizer.c:308
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01018	/src/opus/celt/rate.c:398
18	24	3 : View List ['ec_dec_update', 'ec_decode', 'isqrt32']	52	158	compute_theta	call site: 01084	/src/opus/celt/bands.c:808
18	18	2 : View List ['ec_decode', 'ec_dec_update']	52	152	compute_theta	call site: 01079	/src/opus/celt/bands.c:786
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 01022	/src/opus/celt/rate.c:415
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 01095	/src/opus/celt/bands.c:889
6	6	1 : View List ['ec_dec_bits']	6	462	quant_band_stereo	call site: 01156	/src/opus/celt/bands.c:1472
6	6	1 : View List ['celt_fatal']	6	16	silk_P_Ana_calc_energy_st3	call site: 00624	/src/opus/silk/float/pitch_analysis_core_FLP.c:578
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00351	/src/opus/silk/check_control_input.c:103
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00053	/src/opus/silk/enc_API.c:97
6	6	1 : View List ['celt_fatal']	6	6	silk_P_Ana_calc_corr_st3	call site: 00616	/src/opus/silk/float/pitch_analysis_core_FLP.c:512

Runtime coverage analysis

Covered functions

378

Functions that are reachable but not covered

33

Reachable functions

365

Percentage of reachable functions covered

90.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	23
/src/opus/celt/mathops.c	1
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	5
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_encoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	207	15.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.22%
lawngreen	50+	1128	84.3%
All colors	1338	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
121	121	1 : View List ['surround_analysis']	121	6544	opus_multistream_encode_native	call site: 00180	/src/opus/src/opus_multistream_encoder.c:877
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 01197	/src/opus/celt/bands.c:1112
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00353	/src/opus/src/repacketizer.c:308
52	52	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	173	7334	opus_multistream_encode_native	call site: 00171	/src/opus/src/opus_multistream_encoder.c:844
52	52	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	52	52	opus_multistream_encoder_init_impl	call site: 00114	/src/opus/src/opus_multistream_encoder.c:495
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01108	/src/opus/celt/rate.c:398
18	24	3 : View List ['ec_dec_update', 'ec_decode', 'isqrt32']	52	158	compute_theta	call site: 01178	/src/opus/celt/bands.c:808
18	18	2 : View List ['ec_decode', 'ec_dec_update']	52	152	compute_theta	call site: 01173	/src/opus/celt/bands.c:786
9	109	3 : View List ['silk_resampler', 'silk_float2short_array', 'silk_short2float_array']	9	185	silk_setup_resamplers	call site: 00407	/src/opus/silk/control_codec.c:144
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 01112	/src/opus/celt/rate.c:415
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 01190	/src/opus/celt/bands.c:889
6	6	1 : View List ['ec_dec_bits']	6	462	quant_band_stereo	call site: 01269	/src/opus/celt/bands.c:1472

Runtime coverage analysis

Covered functions

394

Functions that are reachable but not covered

36

Reachable functions

378

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	12
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	9
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_decode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	16.6%
gold	[1:9]	1	0.12%
yellow	[10:29]	4	0.49%
greenyellow	[30:49]	1	0.12%
lawngreen	50+	665	82.6%
All colors	805	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
137	137	1 : View List ['alg_quant']	137	137	quant_partition	call site: 00606	/src/opus/celt/bands.c:1112
55	55	2 : View List ['median_of_5_val16', 'ec_enc_depth']	55	57	clt_compute_extra_allocation	call site: 00496	/src/opus/celt/rate.c:769
53	53	2 : View List ['ec_enc_uint', 'stereo_itheta']	53	285	cubic_quant_partition	call site: 00546	/src/opus/celt/bands.c:1212
31	31	1 : View List ['ec_enc_uint']	70	79	interp_bits2pulses	call site: 00463	/src/opus/celt/rate.c:398
31	31	1 : View List ['ec_enc_uint']	38	60	compute_theta	call site: 00590	/src/opus/celt/bands.c:848
22	22	1 : View List ['stereo_itheta']	161	350	compute_theta	call site: 00564	/src/opus/celt/bands.c:735
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00574	/src/opus/celt/bands.c:786
22	22	1 : View List ['ec_encode']	66	156	compute_theta	call site: 00579	/src/opus/celt/bands.c:808
15	15	1 : View List ['ec_enc_bit_logp']	39	39	interp_bits2pulses	call site: 00473	/src/opus/celt/rate.c:415
15	15	1 : View List ['ec_enc_bit_logp']	15	35	compute_theta	call site: 00597	/src/opus/celt/bands.c:889
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00782	/src/opus/src/extensions.c:191
12	12	1 : View List ['ec_enc_bits']	12	468	quant_band_stereo	call site: 00691	/src/opus/celt/bands.c:1472

Runtime coverage analysis

Covered functions

217

Functions that are reachable but not covered

32

Reachable functions

249

Percentage of reachable functions covered

87.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.h	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	169	12.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1139	87.0%
All colors	1308	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 01170	/src/opus/celt/bands.c:1112
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00325	/src/opus/src/repacketizer.c:308
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01081	/src/opus/celt/rate.c:398
18	24	3 : View List ['ec_dec_update', 'ec_decode', 'isqrt32']	52	158	compute_theta	call site: 01151	/src/opus/celt/bands.c:808
18	18	2 : View List ['ec_decode', 'ec_dec_update']	52	152	compute_theta	call site: 01146	/src/opus/celt/bands.c:786
9	109	3 : View List ['silk_resampler', 'silk_float2short_array', 'silk_short2float_array']	9	185	silk_setup_resamplers	call site: 00380	/src/opus/silk/control_codec.c:144
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 01085	/src/opus/celt/rate.c:415
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 01163	/src/opus/celt/bands.c:889
6	6	1 : View List ['ec_dec_bits']	6	462	quant_band_stereo	call site: 01242	/src/opus/celt/bands.c:1472
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00370	/src/opus/silk/check_control_input.c:103
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00053	/src/opus/silk/enc_API.c:97
6	6	1 : View List ['celt_fatal']	6	6	silk_resampler_init	call site: 00383	/src/opus/silk/resampler.c:157

Runtime coverage analysis

Covered functions

393

Functions that are reachable but not covered

29

Reachable functions

370

Percentage of reachable functions covered

92.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	23
/src/opus/celt/mathops.c	12
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	9
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_encode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	270	18.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1175	81.2%
All colors	1446	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
114	114	1 : View List ['cubic_quant_partition']	116	128	quant_band	call site: 01179	/src/opus/celt/bands.c:1329
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 01262	/src/opus/celt/bands.c:1112
95	99	4 : View List ['median_of_5_val16', 'ec_enc_depth', 'ec_dec_depth', 'ec_tell_frac']	95	99	clt_compute_extra_allocation	call site: 01144	/src/opus/celt/rate.c:762
95	97	3 : View List ['cubic_unquant', 'cubic_quant', 'ec_tell_frac']	95	97	quant_partition	call site: 01262	/src/opus/celt/bands.c:1122
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00338	/src/opus/src/repacketizer.c:308
57	69	4 : View List ['op_pvq_search_extra', 'ec_enc_bits', 'ec_enc_refine', 'ec_tell.833']	57	155	alg_quant	call site: 01300	/src/opus/celt/vq.c:584
38	154	5 : View List ['amp2Log2', 'compute_band_energies', 'normalise_bands', 'encode_qext_stereo_params', 'quant_coarse_energy']	38	1600	celt_encode_with_ec	call site: 01132	/src/opus/celt/celt_encoder.c:2603
28	91	3 : View List ['ec_enc_uint', 'celt_sudiv', 'ec_dec_uint']	28	122	compute_theta	call site: 01243	/src/opus/celt/bands.c:844
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01110	/src/opus/celt/rate.c:398
18	24	3 : View List ['ec_dec_update', 'ec_decode', 'isqrt32']	52	158	compute_theta	call site: 01234	/src/opus/celt/bands.c:808
18	18	2 : View List ['ec_decode', 'ec_dec_update']	52	152	compute_theta	call site: 01229	/src/opus/celt/bands.c:786
10	33	3 : View List ['ec_enc_shrink', 'compute_qext_mode', 'ec_enc_bit_logp']	48	1798	celt_encode_with_ec	call site: 01096	/src/opus/celt/celt_encoder.c:2521

Runtime coverage analysis

Covered functions

399

Functions that are reachable but not covered

45

Reachable functions

392

Percentage of reachable functions covered

88.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	23
/src/opus/celt/mathops.c	13
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	11
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_encoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	208	16.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	1040	83.2%
All colors	1249	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
121	121	1 : View List ['surround_analysis']	121	6544	opus_multistream_encode_native	call site: 00180	/src/opus/src/opus_multistream_encoder.c:877
97	97	1 : View List ['alg_unquant']	97	97	quant_partition	call site: 01129	/src/opus/celt/bands.c:1112
86	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	86	86	opus_repacketizer_out_range_impl	call site: 00334	/src/opus/src/repacketizer.c:308
52	52	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	173	7334	opus_multistream_encode_native	call site: 00171	/src/opus/src/opus_multistream_encoder.c:844
52	52	2 : View List ['ms_get_window_mem', 'ms_get_preemph_mem']	52	52	opus_multistream_encoder_init_impl	call site: 00114	/src/opus/src/opus_multistream_encoder.c:495
28	28	1 : View List ['ec_dec_uint']	61	76	interp_bits2pulses	call site: 01045	/src/opus/celt/rate.c:398
18	24	3 : View List ['ec_dec_update', 'ec_decode', 'isqrt32']	52	158	compute_theta	call site: 01111	/src/opus/celt/bands.c:808
18	18	2 : View List ['ec_decode', 'ec_dec_update']	52	152	compute_theta	call site: 01106	/src/opus/celt/bands.c:786
9	9	1 : View List ['ec_dec_bit_logp']	33	33	interp_bits2pulses	call site: 01049	/src/opus/celt/rate.c:415
9	9	1 : View List ['ec_dec_bit_logp']	9	29	compute_theta	call site: 01122	/src/opus/celt/bands.c:889
6	6	1 : View List ['ec_dec_bits']	6	462	quant_band_stereo	call site: 01183	/src/opus/celt/bands.c:1472
6	6	1 : View List ['celt_fatal']	6	16	silk_P_Ana_calc_energy_st3	call site: 00651	/src/opus/silk/float/pitch_analysis_core_FLP.c:578

Runtime coverage analysis

Covered functions

379

Functions that are reachable but not covered

40

Reachable functions

373

Percentage of reachable functions covered

89.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	1
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	5
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	144	12.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.33%
lawngreen	50+	1040	87.5%
All colors	1188	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
57	69	4 : View List ['op_pvq_search_extra', 'ec_enc_bits', 'ec_enc_refine', 'ec_tell.833']	57	155	alg_quant	call site: 01066	/src/opus/celt/vq.c:584
55	55	2 : View List ['median_of_5_val16', 'ec_enc_depth']	55	57	clt_compute_extra_allocation	call site: 00000	/src/opus/celt/rate.c:769
52	52	1 : View List ['cubic_quant']	52	52	quant_partition	call site: 01055	/src/opus/celt/bands.c:1131
38	154	5 : View List ['amp2Log2', 'compute_band_energies', 'normalise_bands', 'encode_qext_stereo_params', 'quant_coarse_energy']	38	1600	celt_encode_with_ec	call site: 00988	/src/opus/celt/celt_encoder.c:2603
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00180	/src/opus/src/extensions.c:191
6	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	6	86	opus_repacketizer_out_range_impl	call site: 00200	/src/opus/src/repacketizer.c:308
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00245	/src/opus/silk/check_control_input.c:103
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00032	/src/opus/silk/enc_API.c:97
6	6	1 : View List ['celt_fatal']	6	6	silk_resampler_init	call site: 00258	/src/opus/silk/resampler.c:157
0	605	4 : View List ['ec_enc_init', 'quant_fine_energy', 'ec_tell_frac', 'quant_all_bands']	0	709	celt_encode_with_ec	call site: 00991	/src/opus/celt/celt_encoder.c:2644
0	268	2 : View List ['gen_toc', 'opus_packet_pad']	0	268	opus_encode_native	call site: 00153	/src/opus/src/opus_encoder.c:1290
0	121	1 : View List ['surround_analysis']	0	6544	opus_multistream_encode_native	call site: 00000	/src/opus/src/opus_multistream_encoder.c:877

Runtime coverage analysis

Covered functions

607

Functions that are reachable but not covered

8

Reachable functions

341

Percentage of reachable functions covered

97.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	24
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/./celt/mathops.h	6
/src/opus/celt/kiss_fft.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/celt/mathops.c	12
/src/opus/celt/mathops.h	9
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	239	18.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.30%
lawngreen	50+	1084	81.6%
All colors	1327	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
57	69	4 : View List ['op_pvq_search_extra', 'ec_enc_bits', 'ec_enc_refine', 'ec_tell.833']	57	155	alg_quant	call site: 01186	/src/opus/celt/vq.c:584
55	55	2 : View List ['median_of_5_val16', 'ec_enc_depth']	55	57	clt_compute_extra_allocation	call site: 01030	/src/opus/celt/rate.c:769
52	52	1 : View List ['cubic_quant']	52	52	quant_partition	call site: 01148	/src/opus/celt/bands.c:1131
38	154	5 : View List ['amp2Log2', 'compute_band_energies', 'normalise_bands', 'encode_qext_stereo_params', 'quant_coarse_energy']	38	1600	celt_encode_with_ec	call site: 01018	/src/opus/celt/celt_encoder.c:2603
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00194	/src/opus/src/extensions.c:191
6	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	6	86	opus_repacketizer_out_range_impl	call site: 00214	/src/opus/src/repacketizer.c:308
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00260	/src/opus/silk/check_control_input.c:103
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00032	/src/opus/silk/enc_API.c:97
6	6	1 : View List ['celt_fatal']	6	6	silk_resampler_init	call site: 00273	/src/opus/silk/resampler.c:157
0	605	4 : View List ['ec_enc_init', 'quant_fine_energy', 'ec_tell_frac', 'quant_all_bands']	0	709	celt_encode_with_ec	call site: 01046	/src/opus/celt/celt_encoder.c:2644
0	268	2 : View List ['gen_toc', 'opus_packet_pad']	0	268	opus_encode_native	call site: 00167	/src/opus/src/opus_encoder.c:1290
0	121	1 : View List ['surround_analysis']	0	6544	opus_multistream_encode_native	call site: 00000	/src/opus/src/opus_multistream_encoder.c:877

Runtime coverage analysis

Covered functions

607

Functions that are reachable but not covered

16

Reachable functions

363

Percentage of reachable functions covered

95.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	25
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/./celt/mathops.h	6
/src/opus/celt/kiss_fft.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/celt/mathops.c	13
/src/opus/celt/mathops.h	11
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	158	13.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.24%
lawngreen	50+	1049	86.6%
All colors	1210	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
57	69	4 : View List ['op_pvq_search_extra', 'ec_enc_bits', 'ec_enc_refine', 'ec_tell.833']	57	155	alg_quant	call site: 01085	/src/opus/celt/vq.c:584
55	55	2 : View List ['median_of_5_val16', 'ec_enc_depth']	55	57	clt_compute_extra_allocation	call site: 00948	/src/opus/celt/rate.c:769
52	52	1 : View List ['cubic_quant']	52	52	quant_partition	call site: 01056	/src/opus/celt/bands.c:1131
38	154	5 : View List ['amp2Log2', 'compute_band_energies', 'normalise_bands', 'encode_qext_stereo_params', 'quant_coarse_energy']	38	1600	celt_encode_with_ec	call site: 00936	/src/opus/celt/celt_encoder.c:2603
12	41	3 : View List ['skip_extension_payload', 'skip_extension', 'celt_fatal']	12	41	opus_extension_iterator_next_repeat	call site: 00169	/src/opus/src/extensions.c:191
6	86	2 : View List ['opus_packet_extensions_generate', 'celt_fatal']	6	86	opus_repacketizer_out_range_impl	call site: 00189	/src/opus/src/repacketizer.c:308
6	6	1 : View List ['celt_fatal']	6	6	check_control_input	call site: 00234	/src/opus/silk/check_control_input.c:103
6	6	1 : View List ['celt_fatal']	6	6	silk_InitEncoder	call site: 00032	/src/opus/silk/enc_API.c:97
6	6	1 : View List ['celt_fatal']	6	6	silk_resampler_init	call site: 00247	/src/opus/silk/resampler.c:157
0	605	4 : View List ['ec_enc_init', 'quant_fine_energy', 'ec_tell_frac', 'quant_all_bands']	0	709	celt_encode_with_ec	call site: 00964	/src/opus/celt/celt_encoder.c:2644
0	268	2 : View List ['gen_toc', 'opus_packet_pad']	0	268	opus_encode_native	call site: 00142	/src/opus/src/opus_encoder.c:1290
0	121	1 : View List ['surround_analysis']	0	6544	opus_multistream_encode_native	call site: 00000	/src/opus/src/opus_multistream_encoder.c:877

Runtime coverage analysis

Covered functions

607

Functions that are reachable but not covered

19

Reachable functions

353

Percentage of reachable functions covered

94.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	25
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/./celt/mathops.h	3
/src/opus/celt/kiss_fft.c	6
/src/opus/./celt/arch.h	1
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/mathops.h	6
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.c	1
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1