High level conclusions

Fuzzer glib/fuzzing/fuzz_resolver.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_resolver.c covers 24.45% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_uri_parse.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_uri_parse.c covers 25.94% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_bookmark.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_bookmark.c covers 28.60% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_date_parse.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_date_parse.c covers 27.77% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_dbus_message.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_dbus_message.c covers 23.01% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_text.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_text.c covers 20.61% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_binary.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_binary.c covers 22.82% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_variant_binary_byteswap.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_variant_binary_byteswap.c covers 22.73% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer glib/fuzzing/fuzz_date_time_new_from_iso8601.c is blocked:

The runtime code coverage of glib/fuzzing/fuzz_date_time_new_from_iso8601.c covers 20.29% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 9.821% of cyclomatic complexity.

Fuzzers reach 7.576% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1263 / 16669

Cyclomatic complexity statically reachable by fuzzers

11532 / 117418

Runtime code coverage of functions

619 / 16669

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: glib/fuzzing/fuzz_uuid_string_is_valid.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	71.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	73	28.6%
All colors	255	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
9	245	g_strndup	call site: 00245	g_uuid_string_is_valid
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
3	240	g_logv	call site: 00240	g_mutex_unlock
2	10	g_logv	call site: 00010

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

210

Reachable functions

308

Percentage of reachable functions covered

31.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uuid_string_is_valid.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/guuid.c	2

Fuzzer: glib/fuzzing/fuzz_key.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	175	71.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	71	28.8%
All colors	246	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
5	240	g_logv	call site: 00240	test_parse
2	10	g_logv	call site: 00010
2	15	g_vasprintf	call site: 00015	_g_gnulib_vasprintf

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

245

Reachable functions

409

Percentage of reachable functions covered

40.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_key.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: glib/fuzzing/fuzz_inet_address_mask_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	785	57.8%
gold	[1:9]	93	6.85%
yellow	[10:29]	16	1.17%
greenyellow	[30:49]	50	3.68%
lawngreen	50+	413	30.4%
All colors	1357	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	538	type_data_unref_U	call site: 00538	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	929	g_param_value_validate	call site: 00929	g_strdup_value_contents
30	207	g_error_allocate	call site: 00207	g_warning
26	1232	g_signal_handlers_destroy	call site: 01232	remove_invalid_closure_notify
25	322	g_type_class_ref	call site: 00322	type_data_ref_Wm
21	457	type_iface_peek_holder_L	call site: 00457	type_data_ref_Wm
20	1335	g_type_free_instance	call site: 01335	g_object_unref
19	1126	g_object_new_valist	call site: 01126	g_inet_address_mask_new
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
16	354	check_type_info_I	call site: 00354	type_data_make_W
16	1013	g_string_append_printf	call site: 01013	g_critical

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

381

Reachable functions

577

Percentage of reachable functions covered

33.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_address_mask_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	25
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetaddressmask.c	3
glib/gio/ginetaddress.c	4
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	22
glib/gobject/gtype.c	42
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	9
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/gio/ginitable.c	3
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	6

Fuzzer: glib/fuzzing/fuzz_network_address_parse_uri.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	991	65.1%
gold	[1:9]	85	5.58%
yellow	[10:29]	16	1.05%
greenyellow	[30:49]	50	3.28%
lawngreen	50+	379	24.9%
All colors	1521	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
216	493	g_getenv	call site: 00493	g_object_new
78	1332	g_param_value_validate	call site: 01332	g_strdup_value_contents
72	951	type_data_unref_U	call site: 00951	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
46	272	g_string_sized_new	call site: 00272	parse_userinfo
38	349	g_utf8_validate	call site: 00349	parse_host
30	207	g_error_allocate	call site: 00207	g_warning
25	443	g_error_free	call site: 00443	g_hostname_to_ascii
25	735	g_type_class_ref	call site: 00735	type_data_ref_Wm
21	870	type_iface_peek_holder_L	call site: 00870	type_data_ref_Wm
19	472	g_string_new	call site: 00472	g_utf8_strdown
17	99	g_strdup_printf	call site: 00099	g_log_default_handler

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

409

Reachable functions

602

Percentage of reachable functions covered

32.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_network_address_parse_uri.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	10
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	14
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	22
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gnetworkaddress.c	1
glib/glib/guri.c	13
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1
glib/glib/ghostutils.c	13
glib/glib/guniprop.c	8
glib/glib/gwin32.c	1
glib/glib/genviron.c	1
glib/glib/gunidecomp.c	8
glib/gobject/gobject.c	20
glib/gobject/gtype.c	41
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	4
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_date_time_new_from_iso8601.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1632	82.8%
gold	[1:9]	33	1.67%
yellow	[10:29]	13	0.66%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	291	14.7%
All colors	1969	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
387	1119	g_string_maybe_expand	call site: 01119	init_zone_from_iana_info
237	1517	g_hash_table_remove_internal	call site: 01517	g_time_zone_new_identifier
205	1763	g_string_append_printf	call site: 01763	g_date_time_format
83	1034	get_contents_posix	call site: 01034	zone_identifier_illumos
79	479	try_conversion	call site: 00479	_g_charset_get_aliases
71	838	g_build_path_va	call site: 00838	g_lstat
70	750	g_string_sized_new	call site: 00750	g_win32_readlink_utf8
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
58	640	g_convert_with_iconv	call site: 00640	g_realloc
31	699	g_get_console_charset	call site: 00699	g_locale_to_utf8
30	207	g_error_allocate	call site: 00207	g_warning
23	307	_g_locale_charset_raw	call site: 00307

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

491

Reachable functions

616

Percentage of reachable functions covered

20.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_date_time_new_from_iso8601.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	18
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	11
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	13
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	10
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	8
glib/glib/tests/messages-low-memory.c	1
glib/glib/gdatetime.c	37
glib/glib/gtimezone.c	47
glib/glib/gfileutils.c	17
glib/glib/gconvert.c	16
glib/glib/gthread.c	1
glib/glib/gmem.h	1
glib/glib/gcharset.c	7
glib/glib/libcharset/localcharset.c	3
glib/glib/genviron.c	1
glib/glib/garray.c	11
glib/glib/gutilsprivate.h	1
glib/glib/win_iconv.c	12
glib/glib/gwin32.c	2
glib/glib/gstring.c	8
glib/glib/gstdio.c	15
glib/glib/gstdio-private.c	2
glib/glib/ggettext.c	2
glib/.gitlab-ci/coverity-model.c	1
glib/glib/guniprop.c	11
glib/glib/gdate.c	17
glib/glib/gmappedfile.c	7
glib/glib/gbytes.c	3
glib/glib/gunidecomp.c	4

Fuzzer: glib/fuzzing/fuzz_variant_binary_byteswap.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	853	88.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.31%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	107	11.1%
All colors	963	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
262	640	g_string_new	call site: 00640	g_variant_deep_copy
259	362	fast_validate_len	call site: 00362	g_variant_deep_copy
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
58	904	g_utf8_validate	call site: 00904	g_variant_get_normal_form
54	240	g_logv	call site: 00240	g_variant_new_from_data
30	207	g_error_allocate	call site: 00207	g_warning
30	296	g_memdup2	call site: 00296	g_variant_byteswap
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
15	332	g_slist_free_1	call site: 00332	g_variant_serialised_is_normal
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

384

Reachable functions

497

Percentage of reachable functions covered

22.74%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_binary_byteswap.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	3
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	9
glib/glib/gslist.c	6
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant.c	27
glib/glib/gvarianttype.c	26
glib/glib/gbytes.c	8
glib/glib/gvariant-core.c	23
glib/glib/gvarianttypeinfo.c	4
glib/glib/gvariant-serialiser.c	10
glib/glib/gbitlock.c	5
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1

Fuzzer: glib/fuzzing/fuzz_inet_socket_address_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	817	59.5%
gold	[1:9]	93	6.77%
yellow	[10:29]	16	1.16%
greenyellow	[30:49]	50	3.64%
lawngreen	50+	396	28.8%
All colors	1372	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
84	1286	g_type_free_instance	call site: 01286	g_unix_socket_address_new_with_type
72	499	type_data_unref_U	call site: 00499	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	890	g_param_value_validate	call site: 00890	g_strdup_value_contents
30	207	g_error_allocate	call site: 00207	g_warning
26	1179	g_signal_handlers_destroy	call site: 01179	remove_invalid_closure_notify
25	283	g_type_class_ref	call site: 00283	type_data_ref_Wm
21	418	type_iface_peek_holder_L	call site: 00418	type_data_ref_Wm
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
16	315	check_type_info_I	call site: 00315	type_data_make_W
16	974	g_string_append_printf	call site: 00974	g_critical
16	1133	g_hash_table_remove_internal	call site: 01133	g_dataset_lookup

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

396

Reachable functions

593

Percentage of reachable functions covered

33.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_socket_address_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	25
glib/glib/gslice.c	2
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetsocketaddress.c	2
glib/gio/gsocketaddress.c	1
glib/gio/ginetaddress.c	3
glib/gobject/gobject.c	22
glib/gobject/gtype.c	42
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	9
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	6
glib/gio/gunixsocketaddress.c	3
glib/glib/garray.c	7
glib/gio/gnativesocketaddress.c	1
glib/gio/gnetworking.c	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_variant_binary.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	821	88.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.32%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	107	11.4%
All colors	931	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
275	599	g_string_new	call site: 00599	g_variant_deep_copy
213	367	fast_validate_len	call site: 00367	g_variant_deep_copy
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
54	240	g_logv	call site: 00240	g_variant_new_from_data
54	876	g_utf8_validate	call site: 00876	g_variant_get_string
35	296	g_memdup2	call site: 00296	g_variant_get_normal_form
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
15	337	g_slist_free_1	call site: 00337	g_variant_serialised_is_normal
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

382

Reachable functions

495

Percentage of reachable functions covered

22.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_binary.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	3
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	9
glib/glib/gslist.c	6
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant.c	26
glib/glib/gvarianttype.c	26
glib/glib/gbytes.c	8
glib/glib/gvariant-core.c	22
glib/glib/gvarianttypeinfo.c	4
glib/glib/gvariant-serialiser.c	9
glib/glib/gbitlock.c	5
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1

Fuzzer: glib/fuzzing/fuzz_utf8_validate.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	173	66.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	33.2%
All colors	259	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
3	240	g_logv	call site: 00240	g_utf8_validate_len
2	10	g_logv	call site: 00010
2	15	g_vasprintf	call site: 00015	_g_gnulib_vasprintf

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

205

Reachable functions

303

Percentage of reachable functions covered

32.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_utf8_validate.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	7
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: fuzz-repo.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3233	69.6%
gold	[1:9]	179	3.85%
yellow	[10:29]	20	0.43%
greenyellow	[30:49]	50	1.07%
lawngreen	50+	1162	25.0%
All colors	4644	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
435	1428	ptr_array_maybe_null_terminate	call site: 01428	create_file_metadata
346	761	g_slist_free_1	call site: 00761	g_variant_get_va
164	3596	reload_core_config	call site: 03596	g_file_new_for_path
156	4362	reload_remote_config	call site: 04362	g_file_new_for_path
124	4024	g_type_ensure	call site: 04024	try_implementation
112	3910	g_type_free_instance	call site: 03910	g_io_modules_scan_all_in_directory_with_scope
106	1109	g_strfreev	call site: 01109	g_variant_valist_get
79	492	try_conversion	call site: 00492	_g_charset_get_aliases
78	2428	g_param_value_validate	call site: 02428	g_strdup_value_contents
72	2095	type_data_unref_U	call site: 02095	type_data_last_unref_Wm
60	27	g_vasprintf	call site: 00027	g_pattern_match_simple
52	3369	regex_compile	call site: 03369	get_pcre2_error_string

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

912

Reachable functions

1312

Percentage of reachable functions covered

30.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz-repo.c	2
ostreelibostree/ostree-repo.c	24
glib/glib/gfileutils.c	15
glib/glib/gstring.c	9
glib/glib/gmessages.h	4
glib/glib/gmessages.c	18
glib/glib/gstrfuncs.c	22
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	16
glib/glib/gslist.c	11
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	14
glib/glib/ghash.c	32
glib/glib/gslice.c	3
glib/glib/gmem.c	9
glib/glib/tests/messages-low-memory.c	1
glib/glib/gutilsprivate.h	1
ostree/libglnx/glnx-fdio.h	4
ostree/libglnx/glnx-errors.c	5
glib/gio/gioerror.c	2
glib/glib/gcharset.c	12
glib/glib/gthread.c	1
glib/glib/gmem.h	1
glib/glib/genviron.c	1
glib/glib/gwin32.c	3
glib/glib/libcharset/localcharset.c	3
glib/glib/gconvert.c	15
glib/glib/win_iconv.c	12
ostree/libglnx/glnx-dirfd.c	3
ostree/libglnx/glnx-dirfd.h	1
glib/glib/gmain.h	1
glib/glib/gvariant.c	65
glib/glib/gvariant-core.c	19
glib/glib/gbitlock.c	5
glib/glib/gvariant-serialiser.c	8
glib/glib/gvarianttypeinfo.c	4
glib/glib/gbytes.c	7
glib/glib/gvarianttype.c	27
ostree/libglnx/glnx-fdio.c	12
glib/glib/grand.c	11
glib/glib/gmain.c	2
ostree/libglnx/glnx-missing-syscall.h	1
ostreelibostree/ostree-repo-commit.c	2
ostreelibostree/ostree-core.c	2
glib/glib/garray.c	11
glib/glib/gqsort.c	3
glib/gobject/gobject.c	28
glib/gobject/gtype.c	43
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	10
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstdio.c	3
glib/glib/ggettext.c	2
ostreelibotutil/ot-gio-utils.h	1
ostreelibotutil/ot-gio-utils.c	1
glib/glib/gquark.c	7
glib/glib/glib-private.h	1
glib/gio/gfile.c	6
ostree/libglnx/glnx-shutil.c	2
glib/gio/gcancellable.c	4
glib/glib/gkeyfile.c	46
glib/glib/glist.c	10
glib/.gitlab-ci/coverity-model.c	1
glib/glib/guniprop.c	3
ostreelibotutil/ot-keyfile-utils.c	9
glib/glib/gregex.c	25
ostreelibostree/ostree-repo-verity.c	1
ostreelibostree/ostree-repo-composefs.c	1
glib/gio/gvfs.c	3
glib/gio/glocalvfs.c	1
glib/gio/giomodule.c	17
glib/gmodule/gmodule.c	1
glib/glib/gdir.c	4
glib/gobject/gtypemodule.c	2
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	6
glib/gio/ginitable.c	3
ostreelibostree/ostree-remote.c	5
glib/glib/gqueue.c	3
ostreelibostree/ostree-sysroot.c	1
glib/gio/gfileenumerator.c	3
glib/gio/gfileinfo.c	10
glib/gio/gfileattribute.c	2

Fuzzer: glib/fuzzing/fuzz_variant_text.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1328	91.2%
gold	[1:9]	2	0.13%
yellow	[10:29]	3	0.20%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	8.44%
All colors	1456	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
397	723	g_utf8_validate	call site: 00723	maybe_parse
330	1125	get_C_locale	call site: 01125	g_variant_print
181	370	g_strndup	call site: 00370	g_variant_new_va
117	553	g_memdup2	call site: 00553	g_variant_new_array
87	281	g_string_append_printf	call site: 00281	array_parse
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
30	676	g_slist_free_1	call site: 00676	g_variant_new_string
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
10	240	g_logv	call site: 00240	g_variant_parse
9	0	EP	call site: 00000	fuzz_set_logging_func

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

462

Reachable functions

582

Percentage of reachable functions covered

20.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_variant_text.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	11
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	10
glib/glib/gslist.c	6
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/gvariant-parser.c	37
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gvariant.c	45
glib/glib/gvarianttype.c	29
glib/glib/gvariant-core.c	19
glib/glib/gvarianttypeinfo.c	4
glib/glib/gbytes.c	7
glib/glib/gbitlock.c	5
glib/glib/gvariant-serialiser.c	8
glib/glib/gmem.h	1
glib/glib/guniprop.c	1

Fuzzer: glib/fuzzing/fuzz_uri_escape.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	174	71.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	71	28.9%
All colors	245	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
4	240	g_logv	call site: 00240	test_bytes
2	10	g_logv	call site: 00010
2	15	g_vasprintf	call site: 00015	_g_gnulib_vasprintf

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

232

Reachable functions

340

Percentage of reachable functions covered

31.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_escape.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1

Fuzzer: glib/fuzzing/fuzz_inet_address_new_from_string.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	627	56.7%
gold	[1:9]	85	7.69%
yellow	[10:29]	16	1.44%
greenyellow	[30:49]	50	4.52%
lawngreen	50+	326	29.5%
All colors	1104	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	500	type_data_unref_U	call site: 00500	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	891	g_param_value_validate	call site: 00891	g_strdup_value_contents
30	207	g_error_allocate	call site: 00207	g_warning
25	284	g_type_class_ref	call site: 00284	type_data_ref_Wm
21	419	type_iface_peek_holder_L	call site: 00419	type_data_ref_Wm
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
16	316	check_type_info_I	call site: 00316	type_data_make_W
16	975	g_string_append_printf	call site: 00975	g_critical
13	153	g_logv	call site: 00153	g_utf8_to_utf16
13	245	g_strndup	call site: 00245	g_inet_address_new_from_string
13	1088	g_object_new_valist	call site: 01088	g_inet_address_new_from_bytes

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

334

Reachable functions

525

Percentage of reachable functions covered

36.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_inet_address_new_from_string.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	22
glib/glib/gslice.c	2
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/gio/ginetaddress.c	3
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	20
glib/gobject/gtype.c	41
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	4
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1

Fuzzer: glib/fuzzing/fuzz_dbus_message.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2577	80.4%
gold	[1:9]	102	3.18%
yellow	[10:29]	19	0.59%
greenyellow	[30:49]	50	1.56%
lawngreen	50+	455	14.2%
All colors	3203	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
779	1501	g_slist_free_1	call site: 01501	parse_value_from_blob
362	2661	g_clear_object	call site: 02661	g_dbus_message_to_blob
129	1369	g_utf8_validate	call site: 01369	g_variant_new_fixed_array
120	2540	g_hash_table_insert	call site: 02540	parse_value_from_blob
108	2418	g_strfreev	call site: 02418	g_variant_valist_get
107	1183	g_strndup	call site: 01183	g_variant_new_boolean
90	2326	g_propagate_error	call site: 02326	g_variant_get
72	531	type_data_unref_U	call site: 00531	type_data_last_unref_Wm
62	1119	g_object_new_valist	call site: 01119	parse_value_from_blob
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	922	g_param_value_validate	call site: 00922	g_strdup_value_contents
39	2283	get_C_locale	call site: 02283	g_variant_get_string

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

689

Reachable functions

895

Percentage of reachable functions covered

23.02%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_dbus_message.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	18
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	12
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	7
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	28
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gdbusmessage.c	37
glib/gobject/gobject.c	22
glib/gobject/gtype.c	42
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	9
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	8
glib/glib/gutilsprivate.h	1
glib/gio/gdbusprivate.c	1
glib/glib/gvarianttype.c	32
glib/glib/gvariant.c	73
glib/glib/gbytes.c	8
glib/glib/gvariant-core.c	24
glib/glib/gvarianttypeinfo.c	5
glib/glib/gvariant-serialiser.c	10
glib/glib/ggettext.c	2
glib/glib/gwin32.c	1
glib/glib/gbitlock.c	5
glib/glib/gmem.h	1
glib/glib/guniprop.c	1
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gquark.c	1
glib/gio/gdbusutils.c	6
glib/gio/gunixfdlist.c	1
glib/gobject/gsignal.c	4
glib/glib/gbsearcharray.h	2
glib/gobject/gclosure.c	6

Fuzzer: fuzz-bsdiff.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	599	54.8%
gold	[1:9]	85	7.77%
yellow	[10:29]	16	1.46%
greenyellow	[30:49]	50	4.57%
lawngreen	50+	343	31.3%
All colors	1093	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	483	type_data_unref_U	call site: 00483	type_data_last_unref_Wm
60	28	g_vasprintf	call site: 00028	g_pattern_match_simple
60	874	g_param_value_validate	call site: 00874	g_strdup_value_contents
30	220	g_error_allocate	call site: 00220	g_warning
25	267	g_type_class_ref	call site: 00267	type_data_ref_Wm
21	402	type_iface_peek_holder_L	call site: 00402	type_data_ref_Wm
17	109	g_strdup_printf	call site: 00109	g_log_default_handler
16	299	check_type_info_I	call site: 00299	type_data_make_W
16	958	g_string_append_printf	call site: 00958	g_critical
13	163	g_logv	call site: 00163	g_utf8_to_utf16
11	988	g_type_create_instance	call site: 00988	maybe_issue_deprecation_warning
11	1046	g_object_new_valist	call site: 01046	g_realloc

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

320

Reachable functions

520

Percentage of reachable functions covered

38.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz-bsdiff.c	1
glib/gio/gmemoryoutputstream.c	2
glib/gobject/gobject.c	19
glib/gobject/gtype.c	41
glib/glib/gmessages.h	3
glib/glib/gmessages.c	16
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	22
glib/glib/gslice.c	2
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	4
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
ostree/bsdiff/bsdiff.c	8

Fuzzer: glib/fuzzing/fuzz_uri_parse_params.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	278	58.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	13	2.74%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	182	38.4%
All colors	473	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
23	289	g_string_sized_new	call site: 00289	g_string_append_printf
22	343	g_utf8_validate	call site: 00343	uri_decode
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
17	265	g_hash_table_setup_storage	call site: 00265	g_uri_params_iter_next
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
8	240	g_logv	call site: 00240	g_uri_parse_params
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

220

Reachable functions

332

Percentage of reachable functions covered

33.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_parse_params.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	9
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	24
glib/glib/gslice.c	3
glib/glib/gmem.c	5
glib/glib/tests/messages-low-memory.c	1
glib/glib/guri.c	6
glib/glib/gstring.c	5
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1

Fuzzer: glib/fuzzing/fuzz_date_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	858	78.9%
gold	[1:9]	26	2.39%
yellow	[10:29]	13	1.19%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	190	17.4%
All colors	1087	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	360	g_realloc	call site: 00360	g_date_get_sunday_week_of_year
106	980	g_string_maybe_expand	call site: 00980	g_date_strftime
73	680	try_conversion	call site: 00680	_g_charset_get_aliases
60	20	g_vasprintf	call site: 00020	g_pattern_match_simple
58	270	fast_validate_len	call site: 00270	g_date_prepare_to_parse
46	860	g_convert_with_iconv	call site: 00860	g_realloc
30	209	g_error_allocate	call site: 00209	g_warning
27	933	g_iconv_close	call site: 00933	g_utf8_casefold
23	599	_g_locale_charset_raw	call site: 00599
21	330	g_utf8_validate	call site: 00330	win32_strftime_helper
19	907	g_get_console_charset	call site: 00907	g_locale_to_utf8
17	101	g_strdup_printf	call site: 00101	g_log_default_handler

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

273

Reachable functions

378

Percentage of reachable functions covered

27.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_date_parse.c	1
glib/glib/gdate.c	25
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	18
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	6
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	15
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	21
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/garray.c	6
glib/glib/gutilsprivate.h	1
glib/glib/gconvert.c	13
glib/glib/gcharset.c	5
glib/glib/gthread.c	1
glib/glib/gmem.h	1
glib/glib/libcharset/localcharset.c	3
glib/glib/genviron.c	1
glib/glib/win_iconv.c	12
glib/glib/gwin32.c	1
glib/glib/guniprop.c	2
glib/glib/gstring.c	6
glib/glib/gunidecomp.c	7

Fuzzer: glib/fuzzing/fuzz_bookmark.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	563	79.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	146	20.5%
All colors	709	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
128	570	g_error_new_valist	call site: 00570	unescape_gstring_inplace
68	384	g_utf8_get_char_validated	call site: 00384	emit_end_element
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
56	469	g_utf8_validate	call site: 00469	emit_start_element
42	263	g_hash_table_setup_storage	call site: 00263	g_bookmark_file_load_from_data
40	526	g_slist_prepend	call site: 00526	unescape_gstring_inplace
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
12	312	g_string_sized_new	call site: 00312	set_error
10	342	g_strconcat	call site: 00342	g_propagate_error
9	0	EP	call site: 00000	fuzz_set_logging_func

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

292

Reachable functions

409

Percentage of reachable functions covered

28.61%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_bookmark.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	4
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	11
glib/glib/gslist.c	10
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	8
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/gbookmarkfile.c	6
glib/glib/glist.c	3
glib/glib/gmarkup.c	36
glib/glib/gstring.c	2
glib/glib/gutilsprivate.h	1
glib/glib/guniprop.c	1

Fuzzer: glib/fuzzing/fuzz_network_address_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	651	56.7%
gold	[1:9]	85	7.40%
yellow	[10:29]	16	1.39%
greenyellow	[30:49]	50	4.35%
lawngreen	50+	346	30.1%
All colors	1148	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
72	546	type_data_unref_U	call site: 00546	type_data_last_unref_Wm
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
60	937	g_param_value_validate	call site: 00937	g_strdup_value_contents
30	207	g_error_allocate	call site: 00207	g_warning
25	330	g_type_class_ref	call site: 00330	type_data_ref_Wm
23	281	g_error_free	call site: 00281	g_network_address_new
21	465	type_iface_peek_holder_L	call site: 00465	type_data_ref_Wm
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
16	362	check_type_info_I	call site: 00362	type_data_make_W
16	1021	g_string_append_printf	call site: 01021	g_critical
13	153	g_logv	call site: 00153	g_utf8_to_utf16
11	1051	g_type_create_instance	call site: 01051	maybe_issue_deprecation_warning

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

334

Reachable functions

525

Percentage of reachable functions covered

36.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_network_address_parse.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	3
glib/glib/gstrfuncs.c	5
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	4
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	22
glib/glib/gslice.c	3
glib/glib/gmem.c	7
glib/glib/tests/messages-low-memory.c	1
glib/gio/gnetworkaddress.c	2
glib/gio/gnetworking.c	1
glib/gobject/gobject.c	20
glib/gobject/gtype.c	41
glib/gobject/gtypeplugin.c	4
glib/gobject/tests/type.c	1
glib/gobject/gparam.c	6
glib/glib/genviron.c	1
glib/gobject/gvalue.c	11
glib/glib/gdataset.c	4
glib/gobject/gvaluetypes.c	2
glib/gobject/gboxed.c	1
glib/glib/gstring.c	6
glib/glib/gutilsprivate.h	1
glib/gio/gsocketconnectable.c	1

Fuzzer: glib/fuzzing/fuzz_uri_parse.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	668	80.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	157	19.0%
All colors	825	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
273	498	g_getenv	call site: 00498	g_uri_to_string
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
51	773	g_utf8_get_char_validated	call site: 00773	test_with_flags
46	277	g_string_sized_new	call site: 00277	parse_userinfo
38	354	g_utf8_validate	call site: 00354	parse_host
30	207	g_error_allocate	call site: 00207	g_warning
25	448	g_error_free	call site: 00448	g_hostname_to_ascii
19	477	g_string_new	call site: 00477	g_utf8_strdown
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
17	245	g_strndup	call site: 00245	test_with_flags
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

314

Reachable functions

424

Percentage of reachable functions covered

25.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_uri_parse.c	2
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	8
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	15
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	8
glib/glib/ghash.c	4
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/glib/guri.c	23
glib/.gitlab-ci/coverity-model.c	1
glib/glib/gstring.c	9
glib/glib/gutilsprivate.h	1
glib/glib/gmem.h	1
glib/glib/ghostutils.c	13
glib/glib/guniprop.c	8
glib/glib/gwin32.c	1
glib/glib/genviron.c	1
glib/glib/gunidecomp.c	8
glib/glib/garcbox.c	1

Fuzzer: glib/fuzzing/fuzz_paths.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	222	75.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	73	24.7%
All colors	295	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
49	245	g_strndup	call site: 00245	g_path_get_basename
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
3	240	g_logv	call site: 00240	g_mutex_unlock
2	10	g_logv	call site: 00010

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

213

Reachable functions

311

Percentage of reachable functions covered

31.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_paths.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	3
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	5
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/gfileutils.c	3

Fuzzer: glib/fuzzing/fuzz_utf8_normalize.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	223	75.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	71	24.1%
All colors	294	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
53	240	g_logv	call site: 00240	g_utf8_normalize
30	207	g_error_allocate	call site: 00207	g_warning
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201
2	10	g_logv	call site: 00010
2	15	g_vasprintf	call site: 00015	_g_gnulib_vasprintf

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

217

Reachable functions

315

Percentage of reachable functions covered

31.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_utf8_normalize.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	2
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	8
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	3
glib/glib/tests/messages-low-memory.c	1
glib/glib/gunidecomp.c	7

Fuzzer: glib/fuzzing/fuzz_resolver.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	916	84.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	3	0.27%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	165	15.2%
All colors	1084	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
317	688	g_utf8_validate	call site: 00688	parse_res_txt
120	278	g_error_free	call site: 00278	parse_res_srv
117	518	g_memdup2	call site: 00518	g_variant_new_array
88	400	g_strndup	call site: 00400	g_variant_new_va
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
30	207	g_error_allocate	call site: 00207	g_warning
30	641	g_slist_free_1	call site: 00641	g_variant_new_string
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
11	1072	g_strconcat	call site: 01072	g_set_error
9	0	EP	call site: 00000	fuzz_set_logging_func
9	507	g_string_new	call site: 00507	g_memdup2

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

380

Reachable functions

503

Percentage of reachable functions covered

24.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_resolver.c	2
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	4
glib/glib/gstrfuncs.c	7
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	9
glib/glib/gslist.c	6
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	11
glib/glib/ghash.c	4
glib/glib/gslice.c	3
glib/glib/gmem.c	6
glib/glib/tests/messages-low-memory.c	1
glib/gio/gthreadedresolver.c	7
glib/glib/gvariant.c	39
glib/glib/gvarianttype.c	26
glib/glib/gvariant-core.c	11
glib/glib/gvarianttypeinfo.c	3
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1
glib/glib/gbytes.c	7
glib/glib/gbitlock.c	5
glib/glib/gvariant-serialiser.c	4
glib/glib/garray.c	7
glib/glib/gmem.h	1
glib/glib/glist.c	4

Fuzzer: glib/fuzzing/fuzz_canonicalize_filename.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	254	71.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	101	28.4%
All colors	355	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	18	g_vasprintf	call site: 00018	g_pattern_match_simple
34	320	g_build_path_va	call site: 00320	g_build_filename
30	207	g_error_allocate	call site: 00207	g_warning
28	245	g_strndup	call site: 00245	g_canonicalize_filename
17	99	g_strdup_printf	call site: 00099	g_log_default_handler
13	153	g_logv	call site: 00153	g_utf8_to_utf16
12	275	g_getenv	call site: 00275	g_build_filename
9	0	EP	call site: 00000	fuzz_set_logging_func
7	82	mklevel_prefix	call site: 00082	format_unsigned
7	134	g_log_structured_array	call site: 00134	_g_log_abort
6	126	g_log_structured_array	call site: 00126	change_even
5	201	g_slice_alloc0	call site: 00201

Runtime coverage analysis

Covered functions

682

Functions that are reachable but not covered

221

Reachable functions

327

Percentage of reachable functions covered

32.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
glib/fuzzing/fuzz_canonicalize_filename.c	1
glib/fuzzing/fuzz.h	1
glib/glib/gmessages.c	17
glib/glib/gmessages.h	2
glib/glib/gstrfuncs.c	3
glib/glib/gprintf.c	1
glib/glib/gnulib/printf.c	1
glib/glib/gutils.c	1
glib/glib/gtestutils.c	2
glib/glib/gpattern.c	5
glib/glib/gutf8.c	7
glib/glib/gslist.c	2
glib/glib/tests/rwlock.c	2
glib/glib/gerror.c	5
glib/glib/ghash.c	4
glib/glib/gslice.c	2
glib/glib/gmem.c	4
glib/glib/tests/messages-low-memory.c	1
glib/glib/gfileutils.c	7
glib/glib/genviron.c	1
glib/glib/gstring.c	3
glib/glib/gutilsprivate.h	1