High level conclusions

Fuzzers reach 87.59% of cyclomatic complexity.

Fuzzers reach 81.69% of all functions.

Fuzzers reach 85.94% code coverage.

Reachability and coverage overview

Functions statically reachable by fuzzers

558 / 683

Cyclomatic complexity statically reachable by fuzzers

5901 / 6737

Runtime code coverage of functions

587 / 683

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: opus_repacketizer_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	8.77%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	91.2%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	20	opus_extension_iterator_init	call site: 00020	fprintf
1	14	opus_packet_parse_impl	call site: 00014	parse_size
1	16	LLVMFuzzerTestOneInput	call site: 00016	opus_repacketizer_out_range_impl
1	51	opus_repacketizer_out_range_impl	call site: 00051	encode_size

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_repacketizer_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	8.77%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	91.2%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	20	opus_extension_iterator_init	call site: 00020	fprintf
1	14	opus_packet_parse_impl	call site: 00014	parse_size
1	16	LLVMFuzzerTestOneInput	call site: 00016	opus_repacketizer_out_range_impl
1	51	opus_repacketizer_out_range_impl	call site: 00051	encode_size

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_projection_decoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	101	14.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	618	85.9%
All colors	719	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	87	silk_ResetDecoder	call site: 00087	opus_decoder_ctl
9	479	interp_bits2pulses	call site: 00479	ec_enc_uint
9	523	compute_qn	call site: 00523	stereo_itheta
6	471	interp_bits2pulses	call site: 00471	ec_enc_bit_logp
5	551	compute_theta	call site: 00551	intensity_stereo
5	578	exp_rotation	call site: 00578	exp_rotation1
5	584	extract_collapse_mask	call site: 00584	encode_pulses
4	569	quant_partition	call site: 00569	alg_quant
4	627	stereo_merge	call site: 00627	quant_band_stereo
3	83	opus_multistream_decoder_ctl_va_list	call site: 00083	opus_custom_decoder_ctl
3	145	silk_decoder_set_fs	call site: 00145	celt_fatal
3	537	bitexact_cos	call site: 00537	ec_encode

Runtime coverage analysis

Covered functions

213

Functions that are reachable but not covered

24

Reachable functions

237

Percentage of reachable functions covered

89.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.h	3
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_decode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	101	14.5%
gold	[1:9]	1	0.14%
yellow	[10:29]	2	0.28%
greenyellow	[30:49]	1	0.14%
lawngreen	50+	589	84.8%
All colors	694	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	68	silk_ResetDecoder	call site: 00068	opus_decoder_ctl
9	460	interp_bits2pulses	call site: 00460	ec_enc_uint
9	504	compute_qn	call site: 00504	stereo_itheta
6	452	interp_bits2pulses	call site: 00452	ec_enc_bit_logp
5	532	compute_theta	call site: 00532	intensity_stereo
5	559	exp_rotation	call site: 00559	exp_rotation1
5	565	extract_collapse_mask	call site: 00565	encode_pulses
4	550	quant_partition	call site: 00550	alg_quant
4	608	stereo_merge	call site: 00608	quant_band_stereo
3	44	celt_decoder_init	call site: 00044	celt_fatal
3	64	opus_multistream_decoder_ctl_va_list	call site: 00064	opus_custom_decoder_ctl
3	126	silk_decoder_set_fs	call site: 00126	celt_fatal

Runtime coverage analysis

Covered functions

204

Functions that are reachable but not covered

24

Reachable functions

228

Percentage of reachable functions covered

89.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.h	3
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_decode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	115	15.0%
gold	[1:9]	1	0.13%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	0.52%
lawngreen	50+	644	84.2%
All colors	764	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	68	silk_ResetDecoder	call site: 00068	opus_decoder_ctl
10	621	exp_rotation	call site: 00621	op_pvq_search_c
9	509	interp_bits2pulses	call site: 00509	ec_enc_uint
9	560	celt_rsqrt_norm32	call site: 00560	celt_atan2p_norm
6	501	interp_bits2pulses	call site: 00501	ec_enc_bit_logp
6	553	compute_qn	call site: 00553	stereo_itheta
6	588	compute_theta	call site: 00588	intensity_stereo
5	632	extract_collapse_mask	call site: 00632	encode_pulses
4	607	quant_partition	call site: 00607	alg_quant
4	679	stereo_merge	call site: 00679	quant_band_stereo
3	44	celt_decoder_init	call site: 00044	celt_fatal
3	64	opus_multistream_decoder_ctl_va_list	call site: 00064	opus_custom_decoder_ctl

Runtime coverage analysis

Covered functions

221

Functions that are reachable but not covered

24

Reachable functions

244

Percentage of reachable functions covered

90.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/celt/arch.h	2
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	13
/src/opus/celt/mathops.h	8
/src/opus/celt/mathops.c	11
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/fixed_generic.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1

Fuzzer: opus_projection_decoder_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	16.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.24%
greenyellow	[30:49]	3	0.36%
lawngreen	50+	691	83.2%
All colors	830	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	654	normalise_residual	call site: 00654	exp_rotation
14	89	silk_ResetDecoder	call site: 00089	opus_decoder_ctl
10	565	cubic_quant_partition	call site: 00565	stereo_itheta
9	482	interp_bits2pulses	call site: 00482	ec_enc_uint
8	515	clt_compute_extra_allocation	call site: 00515	ec_enc_depth
6	474	interp_bits2pulses	call site: 00474	ec_enc_bit_logp
6	647	extract_collapse_mask	call site: 00647	encode_pulses
5	612	compute_theta	call site: 00612	intensity_stereo
4	554	cubic_quant_partition	call site: 00554	ec_enc_uint
4	633	quant_partition	call site: 00633	alg_quant
4	642	exp_rotation	call site: 00642	exp_rotation1
4	722	stereo_merge	call site: 00722	quant_band_stereo

Runtime coverage analysis

Covered functions

226

Functions that are reachable but not covered

32

Reachable functions

258

Percentage of reachable functions covered

87.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.h	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	170	12.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1138	87.0%
All colors	1308	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	1213	alg_quant	call site: 01213	alg_unquant
10	362	check_control_input	call site: 00362	celt_fatal
10	1084	interp_bits2pulses	call site: 01084	ec_dec_uint
9	314	opus_repacketizer_out_range_impl	call site: 00314	opus_packet_extensions_generate
9	1283	opus_encode_frame_native	call site: 01283	celt_encode_with_ec
7	111	opus_multistream_encoder_ctl_va_list	call site: 00111	opus_encoder_ctl
7	121	opus_multistream_encoder_ctl_va_list	call site: 00121	opus_encoder_ctl
7	388	silk_resampler	call site: 00388	silk_resampler_private_IIR_FIR
5	73	opus_encoder_ctl	call site: 00073	opus_custom_encoder_ctl
5	373	silk_Encode	call site: 00373	silk_init_encoder
5	381	silk_setup_resamplers	call site: 00381	silk_resampler
5	565	silk_LP_variable_cutoff	call site: 00565	silk_LP_interpolate_filter_taps

Runtime coverage analysis

Covered functions

393

Functions that are reachable but not covered

29

Reachable functions

370

Percentage of reachable functions covered

92.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	23
/src/opus/celt/mathops.c	12
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	9
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_encode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	260	19.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1070	80.4%
All colors	1330	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	1220	alg_quant	call site: 01220	alg_unquant
16	1062	celt_encode_with_ec	call site: 01062	ec_enc_depth
16	1098	quant_band	call site: 01098	cubic_quant_partition
13	1201	normalise_residual	call site: 01201	encode_pulses
10	345	check_control_input	call site: 00345	celt_fatal
10	1032	interp_bits2pulses	call site: 01032	ec_dec_uint
9	297	opus_repacketizer_out_range_impl	call site: 00297	opus_packet_extensions_generate
9	1305	opus_encode_frame_native	call site: 01305	celt_encode_with_ec
7	113	opus_multistream_encoder_ctl_va_list	call site: 00113	opus_encoder_ctl
7	123	opus_multistream_encoder_ctl_va_list	call site: 00123	opus_encoder_ctl
7	373	silk_resampler	call site: 00373	silk_resampler_private_IIR_FIR
7	1053	quant_fine_energy	call site: 01053	quant_coarse_energy

Runtime coverage analysis

Covered functions

380

Functions that are reachable but not covered

48

Reachable functions

382

Percentage of reachable functions covered

87.43%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	23
/src/opus/celt/mathops.c	1
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	6
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1

Fuzzer: opus_multistream_encode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	271	18.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1174	81.1%
All colors	1446	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	1328	alg_quant	call site: 01328	alg_unquant
20	1179	quant_band	call site: 01179	cubic_quant_partition
16	1143	celt_encode_with_ec	call site: 01143	ec_enc_depth
15	1302	normalise_residual	call site: 01302	encode_pulses
10	376	check_control_input	call site: 00376	celt_fatal
10	1113	interp_bits2pulses	call site: 01113	ec_dec_uint
9	327	opus_repacketizer_out_range_impl	call site: 00327	opus_packet_extensions_generate
9	1421	opus_encode_frame_native	call site: 01421	celt_encode_with_ec
7	113	opus_multistream_encoder_ctl_va_list	call site: 00113	opus_encoder_ctl
7	123	opus_multistream_encoder_ctl_va_list	call site: 00123	opus_encoder_ctl
7	402	silk_resampler	call site: 00402	silk_resampler_private_IIR_FIR
7	1134	quant_fine_energy	call site: 01134	quant_coarse_energy

Runtime coverage analysis

Covered functions

399

Functions that are reachable but not covered

45

Reachable functions

392

Percentage of reachable functions covered

88.52%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	23
/src/opus/celt/mathops.c	13
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	11
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_decoder_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	156	17.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.22%
greenyellow	[30:49]	3	0.33%
lawngreen	50+	744	82.2%
All colors	905	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	718	normalise_residual	call site: 00718	exp_rotation
16	613	cubic_quant_partition	call site: 00613	stereo_itheta
14	89	silk_ResetDecoder	call site: 00089	opus_decoder_ctl
9	523	interp_bits2pulses	call site: 00523	ec_enc_uint
8	556	clt_compute_extra_allocation	call site: 00556	ec_enc_depth
8	595	cubic_quant_partition	call site: 00595	ec_enc_uint
6	515	interp_bits2pulses	call site: 00515	ec_enc_bit_logp
6	667	compute_theta	call site: 00667	intensity_stereo
6	703	exp_rotation	call site: 00703	exp_rotation1
6	710	extract_collapse_mask	call site: 00710	encode_pulses
4	689	quant_partition	call site: 00689	alg_quant
4	796	stereo_merge	call site: 00796	quant_band_stereo

Runtime coverage analysis

Covered functions

244

Functions that are reachable but not covered

33

Reachable functions

276

Percentage of reachable functions covered

88.04%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	21
/src/opus/celt/mathops.h	10
/src/opus/celt/mathops.c	13
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/arch.h	1

Fuzzer: opus_projection_decoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	115	14.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	674	85.4%
All colors	789	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	87	silk_ResetDecoder	call site: 00087	opus_decoder_ctl
10	640	exp_rotation	call site: 00640	op_pvq_search_c
9	528	interp_bits2pulses	call site: 00528	ec_enc_uint
9	579	celt_rsqrt_norm32	call site: 00579	celt_atan2p_norm
6	520	interp_bits2pulses	call site: 00520	ec_enc_bit_logp
6	572	compute_qn	call site: 00572	stereo_itheta
6	607	compute_theta	call site: 00607	intensity_stereo
5	651	extract_collapse_mask	call site: 00651	encode_pulses
4	626	quant_partition	call site: 00626	alg_quant
4	698	stereo_merge	call site: 00698	quant_band_stereo
3	83	opus_multistream_decoder_ctl_va_list	call site: 00083	opus_custom_decoder_ctl
3	145	silk_decoder_set_fs	call site: 00145	celt_fatal

Runtime coverage analysis

Covered functions

230

Functions that are reachable but not covered

24

Reachable functions

253

Percentage of reachable functions covered

90.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_decoder_fuzzer.cc	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus_projection_decoder.c	10
/src/opus/src/mapping_matrix.c	5
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_decoder.c	7
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	20
/src/opus/celt/vq.c	13
/src/opus/celt/mathops.h	8
/src/opus/celt/mathops.c	11
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/fixed_generic.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	2
/src/opus/celt/entenc.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	1

Fuzzer: opus_repacketizer_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	8.77%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	91.2%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	20	opus_extension_iterator_init	call site: 00020	fprintf
1	14	opus_packet_parse_impl	call site: 00014	parse_size
1	16	LLVMFuzzerTestOneInput	call site: 00016	opus_repacketizer_out_range_impl
1	51	opus_repacketizer_out_range_impl	call site: 00051	encode_size

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_repacketizer_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5	8.77%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	52	91.2%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2	20	opus_extension_iterator_init	call site: 00020	fprintf
1	14	opus_packet_parse_impl	call site: 00014	parse_size
1	16	LLVMFuzzerTestOneInput	call site: 00016	opus_repacketizer_out_range_impl
1	51	opus_repacketizer_out_range_impl	call site: 00051	encode_size

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

3

Reachable functions

31

Percentage of reachable functions covered

90.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_repacketizer_fuzzer.cc	2
/src/opus/src/repacketizer.c	8
/src/opus/./celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/arch.h	1

Fuzzer: opus_projection_encoder_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	310	21.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	2	0.13%
greenyellow	[30:49]	1	0.06%
lawngreen	50+	1163	78.7%
All colors	1476	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	1355	alg_quant	call site: 01355	alg_unquant
20	1206	quant_band	call site: 01206	cubic_quant_partition
16	1170	celt_encode_with_ec	call site: 01170	ec_enc_depth
15	1329	normalise_residual	call site: 01329	encode_pulses
13	116	opus_multistream_encoder_init_impl	call site: 00116	ms_get_preemph_mem
10	1140	interp_bits2pulses	call site: 01140	ec_dec_uint
9	355	opus_repacketizer_out_range_impl	call site: 00355	opus_packet_extensions_generate
9	404	check_control_input	call site: 00404	celt_fatal
9	1448	opus_encode_frame_native	call site: 01448	celt_encode_with_ec
7	104	opus_encoder_ctl	call site: 00104	opus_custom_encoder_ctl
7	139	opus_multistream_encoder_ctl_va_list	call site: 00139	opus_encoder_ctl
7	149	opus_multistream_encoder_ctl_va_list	call site: 00149	opus_encoder_ctl

Runtime coverage analysis

Covered functions

400

Functions that are reachable but not covered

52

Reachable functions

400

Percentage of reachable functions covered

87.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	13
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	11
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_projection_encoder_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	301	22.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.07%
greenyellow	[30:49]	3	0.22%
lawngreen	50+	1055	77.5%
All colors	1360	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
21	1247	alg_quant	call site: 01247	alg_unquant
16	1089	celt_encode_with_ec	call site: 01089	ec_enc_depth
16	1125	quant_band	call site: 01125	cubic_quant_partition
13	116	opus_multistream_encoder_init_impl	call site: 00116	ms_get_preemph_mem
13	1228	normalise_residual	call site: 01228	encode_pulses
10	1059	interp_bits2pulses	call site: 01059	ec_dec_uint
9	325	opus_repacketizer_out_range_impl	call site: 00325	opus_packet_extensions_generate
9	373	check_control_input	call site: 00373	celt_fatal
9	1332	opus_encode_frame_native	call site: 01332	celt_encode_with_ec
8	182	opus_multistream_encode_native	call site: 00182	surround_analysis
7	104	opus_encoder_ctl	call site: 00104	opus_custom_encoder_ctl
7	139	opus_multistream_encoder_ctl_va_list	call site: 00139	opus_encoder_ctl

Runtime coverage analysis

Covered functions

381

Functions that are reachable but not covered

55

Reachable functions

390

Percentage of reachable functions covered

85.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	1
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	6
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1

Fuzzer: opus_projection_encoder_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	209	16.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.16%
lawngreen	50+	1038	83.1%
All colors	1249	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	114	opus_multistream_encoder_init_impl	call site: 00114	ms_get_preemph_mem
10	1048	interp_bits2pulses	call site: 01048	ec_dec_uint
10	1159	alg_quant	call site: 01159	alg_unquant
9	323	opus_repacketizer_out_range_impl	call site: 00323	opus_packet_extensions_generate
9	371	check_control_input	call site: 00371	celt_fatal
9	1221	opus_encode_frame_native	call site: 01221	celt_encode_with_ec
8	180	opus_multistream_encode_native	call site: 00180	surround_analysis
7	102	opus_encoder_ctl	call site: 00102	opus_custom_encoder_ctl
7	137	opus_multistream_encoder_ctl_va_list	call site: 00137	opus_encoder_ctl
7	147	opus_multistream_encoder_ctl_va_list	call site: 00147	opus_encoder_ctl
7	213	opus_multistream_encode_native	call site: 00213	opus_encoder_ctl
7	398	silk_resampler	call site: 00398	silk_resampler_private_IIR_FIR

Runtime coverage analysis

Covered functions

379

Functions that are reachable but not covered

40

Reachable functions

373

Percentage of reachable functions covered

89.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	1
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	5
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_decode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	134	16.6%
gold	[1:9]	1	0.12%
yellow	[10:29]	3	0.37%
greenyellow	[30:49]	1	0.12%
lawngreen	50+	666	82.7%
All colors	805	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
19	635	normalise_residual	call site: 00635	exp_rotation
14	70	silk_ResetDecoder	call site: 00070	opus_decoder_ctl
10	546	cubic_quant_partition	call site: 00546	stereo_itheta
9	463	interp_bits2pulses	call site: 00463	ec_enc_uint
8	496	clt_compute_extra_allocation	call site: 00496	ec_enc_depth
6	455	interp_bits2pulses	call site: 00455	ec_enc_bit_logp
6	628	extract_collapse_mask	call site: 00628	encode_pulses
5	593	compute_theta	call site: 00593	intensity_stereo
4	535	cubic_quant_partition	call site: 00535	ec_enc_uint
4	614	quant_partition	call site: 00614	alg_quant
4	623	exp_rotation	call site: 00623	exp_rotation1
4	703	stereo_merge	call site: 00703	quant_band_stereo

Runtime coverage analysis

Covered functions

217

Functions that are reachable but not covered

32

Reachable functions

249

Percentage of reachable functions covered

87.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	3
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	4
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.h	4
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	5
/src/opus/celt/pitch.c	4
/src/opus/celt/celt_lpc.c	4
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/mathops.c	2
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/./celt/mathops.h	1
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/float_cast.h	2

Fuzzer: opus_multistream_decode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	156	17.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.34%
greenyellow	[30:49]	3	0.34%
lawngreen	50+	718	81.5%
All colors	880	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	699	normalise_residual	call site: 00699	exp_rotation
16	594	cubic_quant_partition	call site: 00594	stereo_itheta
14	70	silk_ResetDecoder	call site: 00070	opus_decoder_ctl
9	504	interp_bits2pulses	call site: 00504	ec_enc_uint
8	537	clt_compute_extra_allocation	call site: 00537	ec_enc_depth
8	576	cubic_quant_partition	call site: 00576	ec_enc_uint
6	496	interp_bits2pulses	call site: 00496	ec_enc_bit_logp
6	648	compute_theta	call site: 00648	intensity_stereo
6	684	exp_rotation	call site: 00684	exp_rotation1
6	691	extract_collapse_mask	call site: 00691	encode_pulses
4	670	quant_partition	call site: 00670	alg_quant
4	777	stereo_merge	call site: 00777	quant_band_stereo

Runtime coverage analysis

Covered functions

235

Functions that are reachable but not covered

33

Reachable functions

267

Percentage of reachable functions covered

87.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_decode_fuzzer.cc	1
/src/opus/src/opus_multistream_decoder.c	13
/src/opus/src/opus_decoder.c	12
/src/opus/silk/dec_API.c	5
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_decoder.c	15
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_decoder.c	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/CNG.c	3
/src/opus/silk/PLC.c	6
/src/opus/celt/celt.c	4
/src/opus/celt/arch.h	1
/src/opus/tests/../celt/os_support.h	2
/src/opus/src/opus.c	3
/src/opus/celt/entdec.c	11
/src/opus/silk/decoder_set_fs.c	1
/src/opus/silk/resampler.c	2
/src/opus/silk/stereo_decode_pred.c	2
/src/opus/silk/decode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/decode_pulses.c	1
/src/opus/silk/shell_coder.c	2
/src/opus/silk/code_signs.c	1
/src/opus/silk/decode_frame.c	1
/src/opus/silk/decode_parameters.c	1
/src/opus/silk/gain_quant.c	1
/src/opus/silk/SigProc_FIX.h	6
/src/opus/silk/log2lin.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/typedef.h	1
/src/opus/silk/sort.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/macros.h	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/bwexpander.c	1
/src/opus/silk/decode_pitch.c	1
/src/opus/silk/decode_core.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/stereo_MS_to_LR.c	1
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/./celt/entcode.h	1
/src/opus/celt/entcode.h	4
/src/opus/celt/bands.c	21
/src/opus/celt/vq.c	21
/src/opus/celt/mathops.h	10
/src/opus/celt/mathops.c	13
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/pitch.c	5
/src/opus/celt/celt_lpc.c	3
/src/opus/celt/pitch.h	1
/src/opus/celt/quant_bands.c	3
/src/opus/celt/laplace.c	2
/src/opus/celt/entcode.c	1
/src/opus/celt/rate.c	6
/src/opus/celt/entenc.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/./celt/mathops.h	2
/src/opus/./celt/stack_alloc.h	1
/src/opus/src/extensions.c	6
/src/opus/./celt/arch.h	1

Fuzzer: opus_projection_encoder_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	209	15.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.22%
lawngreen	50+	1126	84.1%
All colors	1338	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	114	opus_multistream_encoder_init_impl	call site: 00114	ms_get_preemph_mem
11	1240	alg_quant	call site: 01240	alg_unquant
10	1111	interp_bits2pulses	call site: 01111	ec_dec_uint
9	342	opus_repacketizer_out_range_impl	call site: 00342	opus_packet_extensions_generate
9	390	check_control_input	call site: 00390	celt_fatal
9	1310	opus_encode_frame_native	call site: 01310	celt_encode_with_ec
7	102	opus_encoder_ctl	call site: 00102	opus_custom_encoder_ctl
7	137	opus_multistream_encoder_ctl_va_list	call site: 00137	opus_encoder_ctl
7	147	opus_multistream_encoder_ctl_va_list	call site: 00147	opus_encoder_ctl
7	224	opus_multistream_encode_native	call site: 00224	opus_encoder_ctl
7	415	silk_resampler	call site: 00415	silk_resampler_private_IIR_FIR
6	180	opus_multistream_encode_native	call site: 00180	surround_analysis

Runtime coverage analysis

Covered functions

394

Functions that are reachable but not covered

36

Reachable functions

378

Percentage of reachable functions covered

90.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_projection_encoder_fuzzer.cc	1
/src/opus/src/opus_projection_encoder.c	12
/src/opus/celt/mathops.c	12
/src/opus/src/mapping_matrix.c	4
/src/opus/src/opus_private.h	1
/src/opus/src/opus_multistream_encoder.c	15
/src/opus/src/opus_encoder.c	21
/src/opus/silk/enc_API.c	4
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/arch.h	1
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/mdct.c	1
/src/opus/celt/mathops.h	9
/src/opus/celt/kiss_fft.c	7
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/./celt/mathops.h	7
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_multistream_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	168	13.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1051	86.2%
All colors	1219	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	343	check_control_input	call site: 00343	celt_fatal
10	1021	interp_bits2pulses	call site: 01021	ec_dec_uint
10	1132	alg_quant	call site: 01132	alg_unquant
9	295	opus_repacketizer_out_range_impl	call site: 00295	opus_packet_extensions_generate
9	1194	opus_encode_frame_native	call site: 01194	celt_encode_with_ec
7	111	opus_multistream_encoder_ctl_va_list	call site: 00111	opus_encoder_ctl
7	121	opus_multistream_encoder_ctl_va_list	call site: 00121	opus_encoder_ctl
7	371	silk_resampler	call site: 00371	silk_resampler_private_IIR_FIR
5	73	opus_encoder_ctl	call site: 00073	opus_custom_encoder_ctl
5	354	silk_Encode	call site: 00354	silk_init_encoder
5	554	silk_LP_variable_cutoff	call site: 00554	silk_LP_interpolate_filter_taps
4	362	silk_setup_resamplers	call site: 00362	silk_float2short_array

Runtime coverage analysis

Covered functions

378

Functions that are reachable but not covered

33

Reachable functions

365

Percentage of reachable functions covered

90.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_multistream_encode_fuzzer.cc	1
/src/opus/src/opus_multistream_encoder.c	23
/src/opus/celt/mathops.c	1
/src/opus/src/opus_encoder.c	22
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/src/opus_multistream.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/tests/../celt/os_support.h	2
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/./celt/arch.h	1
/src/opus/celt/mdct.c	1
/src/opus/celt/kiss_fft.c	6
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/mathops.h	5
/src/opus/./celt/mathops.h	4
/src/opus/src/repacketizer.c	7
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_fixed_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	249	18.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.15%
lawngreen	50+	1076	81.0%
All colors	1327	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	65	opus_encoder_ctl	call site: 00065	opus_encode
15	1188	normalise_residual	call site: 01188	encode_pulses
10	252	check_control_input	call site: 00252	celt_fatal
9	1020	quant_fine_energy	call site: 01020	clt_compute_extra_allocation
9	1069	cubic_quant_partition	call site: 01069	ec_enc_uint
9	1307	opus_encode_frame_native	call site: 01307	celt_encode_with_ec
8	1127	compute_theta	call site: 01127	ec_enc_uint
7	57	opus_encoder_ctl	call site: 00057	opus_custom_encoder_ctl
7	982	celt_encode_with_ec	call site: 00982	ec_enc_bit_logp
7	1030	clt_compute_extra_allocation	call site: 01030	ec_enc_depth
6	1172	exp_rotation	call site: 01172	exp_rotation1
5	49	tonality_analysis_init	call site: 00049	opus_encoder_ctl

Runtime coverage analysis

Covered functions

602

Functions that are reachable but not covered

21

Reachable functions

363

Percentage of reachable functions covered

94.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	25
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	25
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/./celt/mathops.h	6
/src/opus/celt/kiss_fft.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/./celt/arch.h	1
/src/opus/celt/mathops.c	13
/src/opus/celt/mathops.h	11
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	21
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_floating

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	183	16.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.18%
lawngreen	50+	913	83.1%
All colors	1098	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	63	opus_encoder_ctl	call site: 00063	opus_encode
11	502	silk_pitch_analysis_core_FLP	call site: 00502	silk_energy_FLP
10	223	check_control_input	call site: 00223	celt_fatal
9	1078	opus_encode_frame_native	call site: 01078	celt_encode_with_ec
7	55	opus_encoder_ctl	call site: 00055	opus_custom_encoder_ctl
7	494	silk_pitch_analysis_core_FLP	call site: 00494	celt_fatal
5	47	tonality_analysis_init	call site: 00047	opus_encoder_ctl
5	234	silk_Encode	call site: 00234	silk_init_encoder
5	434	silk_LP_variable_cutoff	call site: 00434	silk_LP_interpolate_filter_taps
4	242	silk_setup_resamplers	call site: 00242	silk_float2short_array
4	733	ec_enc_bit_logp	call site: 00733	ec_enc_uint
4	755	opus_encode_frame_native	call site: 00755	celt_encode_with_ec

Runtime coverage analysis

Covered functions

602

Functions that are reachable but not covered

16

Reachable functions

336

Percentage of reachable functions covered

95.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	25
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	22
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/./celt/mathops.h	3
/src/opus/celt/kiss_fft.c	6
/src/opus/./celt/arch.h	1
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/mathops.h	5
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/vq.c	8
/src/opus/celt/mathops.c	1
/src/opus/celt/rate.h	3
/src/opus/celt/x86/vq_sse2.c	1
/src/opus/celt/cwrs.c	4

Fuzzer: opus_encode_fuzzer_floating_qext

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	269	22.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.16%
lawngreen	50+	939	77.6%
All colors	1210	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
15	65	opus_encoder_ctl	call site: 00065	opus_encode
13	1086	normalise_residual	call site: 01086	encode_pulses
11	505	silk_pitch_analysis_core_FLP	call site: 00505	silk_energy_FLP
10	226	check_control_input	call site: 00226	celt_fatal
9	938	quant_fine_energy	call site: 00938	clt_compute_extra_allocation
9	1190	opus_encode_frame_native	call site: 01190	celt_encode_with_ec
8	1036	compute_theta	call site: 01036	ec_enc_uint
7	57	opus_encoder_ctl	call site: 00057	opus_custom_encoder_ctl
7	497	silk_pitch_analysis_core_FLP	call site: 00497	celt_fatal
7	948	clt_compute_extra_allocation	call site: 00948	ec_enc_depth
6	901	celt_encode_with_ec	call site: 00901	ec_enc_bit_logp
5	49	tonality_analysis_init	call site: 00049	opus_encoder_ctl

Runtime coverage analysis

Covered functions

602

Functions that are reachable but not covered

24

Reachable functions

353

Percentage of reachable functions covered

93.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	25
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	23
/src/opus/celt/modes.c	2
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	2
/src/opus/celt/celt.c	3
/src/opus/src/analysis.c	7
/src/opus/./celt/mathops.h	3
/src/opus/celt/kiss_fft.c	6
/src/opus/./celt/arch.h	1
/src/opus/./celt/float_cast.h	2
/src/opus/src/mlp.c	5
/src/opus/celt/x86/pitch_sse.c	3
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/./silk/float/SigProc_FLP.h	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	4
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/float/encode_frame_FLP.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/biquad_alt.c	1
/src/opus/silk/float/SigProc_FLP.h	5
/src/opus/silk/float/find_pitch_lags_FLP.c	1
/src/opus/silk/float/apply_sine_window_FLP.c	1
/src/opus/silk/float/autocorrelation_FLP.c	1
/src/opus/silk/float/schur_FLP.c	1
/src/opus/silk/float/k2a_FLP.c	1
/src/opus/silk/float/bwexpander_FLP.c	1
/src/opus/silk/float/LPC_analysis_filter_FLP.c	6
/src/opus/silk/float/pitch_analysis_core_FLP.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/float/energy_FLP.c	1
/src/opus/silk/float/sort_FLP.c	1
/src/opus/silk/float/noise_shape_analysis_FLP.c	4
/src/opus/silk/float/warped_autocorrelation_FLP.c	1
/src/opus/silk/float/find_pred_coefs_FLP.c	1
/src/opus/silk/float/find_LTP_FLP.c	1
/src/opus/silk/float/corrMatrix_FLP.c	2
/src/opus/silk/float/scale_vector_FLP.c	1
/src/opus/silk/float/wrappers_FLP.c	5
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/float/LTP_scale_ctrl_FLP.c	1
/src/opus/silk/float/LTP_analysis_filter_FLP.c	1
/src/opus/silk/float/scale_copy_vector_FLP.c	1
/src/opus/silk/float/find_LPC_FLP.c	1
/src/opus/silk/float/burg_modified_FLP.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/sort.c	2
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/float/residual_energy_FLP.c	1
/src/opus/silk/float/process_gains_FLP.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/mathops.h	6
/src/opus/celt/pitch.c	6
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	23
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/rate.c	6
/src/opus/celt/entdec.c	9
/src/opus/celt/vq.c	16
/src/opus/celt/mathops.c	1
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4
/src/opus/celt/x86/vq_sse2.c	1

Fuzzer: opus_encode_fuzzer_fixed

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	149	12.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.16%
lawngreen	50+	1037	87.2%
All colors	1188	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	63	opus_encoder_ctl	call site: 00063	opus_encode
10	237	check_control_input	call site: 00237	celt_fatal
9	1168	opus_encode_frame_native	call site: 01168	celt_encode_with_ec
7	55	opus_encoder_ctl	call site: 00055	opus_custom_encoder_ctl
5	47	tonality_analysis_init	call site: 00047	opus_encoder_ctl
5	248	silk_Encode	call site: 00248	silk_init_encoder
5	256	silk_setup_resamplers	call site: 00256	silk_resampler
5	440	silk_LP_variable_cutoff	call site: 00440	silk_LP_interpolate_filter_taps
4	774	ec_enc_bit_logp	call site: 00774	ec_enc_uint
4	794	opus_encode_frame_native	call site: 00794	celt_encode_with_ec
4	1141	stereo_merge	call site: 01141	quant_band_stereo
3	28	silk_VAD_Init	call site: 00028	celt_fatal

Runtime coverage analysis

Covered functions

602

Functions that are reachable but not covered

13

Reachable functions

341

Percentage of reachable functions covered

96.19%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/opus/tests/opus_encode_fuzzer.cc	1
/src/opus/src/opus_encoder.c	24
/src/opus/silk/enc_API.c	4
/src/opus/src/opus_private.h	1
/src/opus/celt/celt_encoder.c	24
/src/opus/celt/modes.c	1
/src/opus/./celt/os_support.h	2
/src/opus/celt/x86/x86cpu.c	4
/src/opus/silk/init_encoder.c	1
/src/opus/silk/lin2log.c	1
/src/opus/silk/Inlines.h	4
/src/opus/silk/macros.h	1
/src/opus/silk/SigProc_FIX.h	5
/src/opus/silk/VAD.c	1
/src/opus/celt/arch.h	1
/src/opus/celt/celt.c	4
/src/opus/src/analysis.c	8
/src/opus/./celt/mathops.h	6
/src/opus/celt/kiss_fft.c	7
/src/opus/./celt/float_cast.h	1
/src/opus/src/mlp.c	5
/src/opus/celt/mathops.c	12
/src/opus/celt/mathops.h	9
/src/opus/src/repacketizer.c	6
/src/opus/src/opus.c	4
/src/opus/src/opus_decoder.c	1
/src/opus/src/extensions.c	10
/src/opus/celt/entenc.c	14
/src/opus/silk/log2lin.c	1
/src/opus/./silk/typedef.h	1
/src/opus/silk/biquad_alt.c	2
/src/opus/silk/check_control_input.c	1
/src/opus/silk/control_codec.c	5
/src/opus/silk/resampler.c	2
/src/opus/silk/resampler_private_up2_HQ.c	2
/src/opus/silk/resampler_private_IIR_FIR.c	2
/src/opus/silk/resampler_private_down_FIR.c	2
/src/opus/silk/resampler_private_AR2.c	1
/src/opus/silk/control_audio_bandwidth.c	1
/src/opus/./silk/SigProc_FIX.h	5
/src/opus/silk/typedef.h	1
/src/opus/./celt/entcode.h	1
/src/opus/silk/stereo_encode_pred.c	2
/src/opus/silk/encode_indices.c	1
/src/opus/silk/NLSF_unpack.c	1
/src/opus/silk/encode_pulses.c	2
/src/opus/silk/shell_coder.c	3
/src/opus/silk/code_signs.c	1
/src/opus/silk/HP_variable_cutoff.c	1
/src/opus/silk/stereo_LR_to_MS.c	1
/src/opus/silk/stereo_find_predictor.c	1
/src/opus/silk/sum_sqr_shift.c	1
/src/opus/silk/inner_prod_aligned.c	1
/src/opus/silk/stereo_quant_pred.c	1
/src/opus/silk/fixed/encode_frame_FIX.c	3
/src/opus/silk/control_SNR.c	1
/src/opus/silk/LP_variable_cutoff.c	2
/src/opus/silk/fixed/find_pitch_lags_FIX.c	1
/src/opus/silk/fixed/apply_sine_window_FIX.c	1
/src/opus/silk/fixed/autocorr_FIX.c	1
/src/opus/celt/celt_lpc.c	2
/src/opus/celt/pitch.c	7
/src/opus/celt/pitch.h	2
/src/opus/silk/fixed/schur_FIX.c	1
/src/opus/./silk/macros.h	1
/src/opus/./silk/Inlines.h	5
/src/opus/silk/fixed/k2a_FIX.c	1
/src/opus/silk/bwexpander.c	1
/src/opus/silk/LPC_analysis_filter.c	1
/src/opus/silk/fixed/pitch_analysis_core_FIX.c	3
/src/opus/silk/resampler_down2.c	1
/src/opus/silk/resampler_down2_3.c	1
/src/opus/silk/fixed/vector_ops_FIX.c	2
/src/opus/silk/sort.c	3
/src/opus/silk/fixed/noise_shape_analysis_FIX.c	3
/src/opus/silk/sigm_Q15.c	1
/src/opus/silk/fixed/warped_autocorrelation_FIX.c	1
/src/opus/silk/fixed/schur64_FIX.c	1
/src/opus/silk/fixed/k2a_Q16_FIX.c	1
/src/opus/silk/bwexpander_32.c	1
/src/opus/silk/LPC_fit.c	1
/src/opus/silk/fixed/find_pred_coefs_FIX.c	1
/src/opus/silk/fixed/find_LTP_FIX.c	1
/src/opus/silk/fixed/corrMatrix_FIX.c	2
/src/opus/silk/quant_LTP_gains.c	1
/src/opus/silk/fixed/LTP_scale_ctrl_FIX.c	1
/src/opus/silk/fixed/LTP_analysis_filter_FIX.c	1
/src/opus/silk/fixed/find_LPC_FIX.c	1
/src/opus/silk/A2NLSF.c	4
/src/opus/silk/interpolate.c	1
/src/opus/silk/NLSF2A.c	2
/src/opus/silk/LPC_inv_pred_gain.c	2
/src/opus/silk/process_NLSFs.c	1
/src/opus/silk/NLSF_VQ_weights_laroia.c	1
/src/opus/silk/NLSF_encode.c	1
/src/opus/silk/NLSF_stabilize.c	1
/src/opus/silk/NLSF_VQ.c	1
/src/opus/silk/NLSF_del_dec_quant.c	1
/src/opus/silk/NLSF_decode.c	2
/src/opus/silk/fixed/residual_energy_FIX.c	1
/src/opus/silk/fixed/process_gains_FIX.c	1
/src/opus/silk/gain_quant.c	3
/src/opus/celt/entcode.h	6
/src/opus/celt/entcode.c	1
/src/opus/celt/mdct.c	1
/src/opus/celt/bands.c	22
/src/opus/celt/quant_bands.c	6
/src/opus/celt/laplace.c	2
/src/opus/celt/vq.c	13
/src/opus/celt/rate.c	2
/src/opus/celt/entdec.c	8
/src/opus/celt/rate.h	3
/src/opus/celt/cwrs.c	4