High level conclusions

Fuzzers reach 37.30% of cyclomatic complexity.

Fuzzers reach 42.03% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

625 / 1487

Cyclomatic complexity statically reachable by fuzzers

3657 / 9803

Runtime code coverage of functions

524 / 1487

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz-crypto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9	10.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	4.87%
lawngreen	50+	69	84.1%
All colors	82	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
2	2	1 : View List ['abort']	2	2	encode_base64_differential	call site: 00028	/src/pjsip/tests/fuzz/fuzz-crypto.c:85
2	2	1 : View List ['abort']	2	2	md5_differential	call site: 00052	/src/pjsip/tests/fuzz/fuzz-crypto.c:120
2	2	1 : View List ['abort']	2	2	sha1_differential	call site: 00073	/src/pjsip/tests/fuzz/fuzz-crypto.c:145
2	2	1 : View List ['abort']	2	2	crc32_differential	call site: 00080	/src/pjsip/tests/fuzz/fuzz-crypto.c:161
0	0	None	2	2	encode_base64_differential	call site: 00017	/src/pjsip/tests/fuzz/fuzz-crypto.c:61
0	0	None	2	2	encode_base64_differential	call site: 00019	/src/pjsip/tests/fuzz/fuzz-crypto.c:67
0	0	None	0	12	pj_md5_update	call site: 00034	/src/pjsip/pjlib-util/build/../src/pjlib-util/md5.c:80
0	0	None	0	12	pj_md5_update	call site: 00034	/src/pjsip/pjlib-util/build/../src/pjlib-util/md5.c:88
0	0	None	0	4	pj_sha1_update	call site: 00056	/src/pjsip/pjlib-util/build/../src/pjlib-util/sha1.c:211

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

16

Reachable functions

43

Percentage of reachable functions covered

62.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-crypto.c	6
pjlib-util/build/../src/pjlib-util/base64.c	6
pjlib-util/build/../src/pjlib-util/md5.c	4
pjlib-util/build/../../pjlib/include/pj/string.h	3
pjlib-util/build/../src/pjlib-util/sha1.c	4
pjlib-util/build/../src/pjlib-util/crc32.c	4

Fuzzer: fuzz-vpx

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	55	28.0%
gold	[1:9]	65	33.1%
yellow	[10:29]	59	30.1%
greenyellow	[30:49]	12	6.12%
lawngreen	50+	5	2.55%
All colors	196	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
50	52	3 : View List ['pj_pool_zalloc', 'pj_memcpy', 'pjmedia_vpx_packetizer_cfg_default']	50	52	pjmedia_vpx_packetizer_create	call site: 00170	/src/pjsip/pjmedia/build/../src/pjmedia-codec/vpx_packetizer.c:63
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00107	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00007	/src/pjsip/pjlib/build/../src/pj/log.c:161
4	4	2 : View List ['pthread_mutex_unlock', 'pthread_mutex_destroy']	4	4	pj_mutex_destroy	call site: 00000	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1593
2	2	1 : View List ['pj_memset']	2	14	pj_log	call site: 00055	/src/pjsip/pjlib/build/../src/pj/log.c:454
2	2	1 : View List ['pthread_mutex_destroy']	2	2	init_mutex	call site: 00077	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1361
0	118	2 : View List ['pj_log_get_level', 'pj_log_4']	4	131	pj_thread_register	call site: 00021	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:573
0	13	1 : View List ['pj_ansi_strxcpy']	17	91	pj_log	call site: 00036	/src/pjsip/pjlib/build/../src/pj/log.c:374

Runtime coverage analysis

Covered functions

76

Functions that are reachable but not covered

35

Reachable functions

99

Percentage of reachable functions covered

64.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-vpx.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	13
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjlib/include/pj/string.h	1
pjmedia/build/../src/pjmedia-codec/vpx_packetizer.c	3
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/string.h	2

Fuzzer: fuzz-h264

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	51	25.0%
gold	[1:9]	65	31.8%
yellow	[10:29]	2	0.98%
greenyellow	[30:49]	2	0.98%
lawngreen	50+	84	41.1%
All colors	204	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00048	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00039	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00033	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00108	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00008	/src/pjsip/pjlib/build/../src/pj/log.c:161
4	4	2 : View List ['pthread_mutex_unlock', 'pthread_mutex_destroy']	4	4	pj_mutex_destroy	call site: 00000	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1593
2	2	1 : View List ['pj_memset']	2	14	pj_log	call site: 00056	/src/pjsip/pjlib/build/../src/pj/log.c:454
2	2	1 : View List ['pthread_mutex_destroy']	2	2	init_mutex	call site: 00078	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1361
0	118	2 : View List ['pj_log_get_level', 'pj_log_4']	4	131	pj_thread_register	call site: 00022	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:573
0	13	1 : View List ['pj_ansi_strxcpy']	17	91	pj_log	call site: 00037	/src/pjsip/pjlib/build/../src/pj/log.c:374
0	0	None	17	104	pj_log	call site: 00035	/src/pjsip/pjlib/build/../src/pj/log.c:368

Runtime coverage analysis

Covered functions

79

Functions that are reachable but not covered

31

Reachable functions

98

Percentage of reachable functions covered

68.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-h264.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	13
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjlib/include/pj/string.h	1
pjmedia/build/../src/pjmedia-codec/h264_packetizer.c	2
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/string.h	1

Fuzzer: fuzz-dns

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	35	13.8%
gold	[1:9]	65	25.7%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	152	60.3%
All colors	252	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00107	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00007	/src/pjsip/pjlib/build/../src/pj/log.c:161
4	4	2 : View List ['pthread_mutex_unlock', 'pthread_mutex_destroy']	4	4	pj_mutex_destroy	call site: 00000	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1593
2	2	1 : View List ['pj_memset']	2	14	pj_log	call site: 00055	/src/pjsip/pjlib/build/../src/pj/log.c:454
2	2	1 : View List ['pthread_mutex_destroy']	2	2	init_mutex	call site: 00077	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1361
0	118	2 : View List ['pj_log_get_level', 'pj_log_4']	4	131	pj_thread_register	call site: 00021	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:573
0	13	1 : View List ['pj_ansi_strxcpy']	17	91	pj_log	call site: 00036	/src/pjsip/pjlib/build/../src/pj/log.c:374
0	0	None	17	104	pj_log	call site: 00034	/src/pjsip/pjlib/build/../src/pj/log.c:368

Runtime coverage analysis

Covered functions

87

Functions that are reachable but not covered

32

Reachable functions

107

Percentage of reachable functions covered

70.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-dns.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	13
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjlib-util/build/../src/pjlib-util/dns.c	5
pjlib-util/build/../../pjlib/include/pj/pool.h	1
pjlib-util/build/../../pjlib/include/pj/string.h	1
pjlib/build/../src/pj/sock_bsd.c	3

Fuzzer: fuzz-xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	48	15.6%
gold	[1:9]	72	23.4%
yellow	[10:29]	4	1.30%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	183	59.6%
All colors	307	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
126	128	3 : View List ['pj_log_get_level', 'pj_exception_id_name', 'pj_log_1']	128	145	pj_throw_exception_	call site: 00173	/src/pjsip/pjlib/build/../src/pj/except.c:46
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00107	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00007	/src/pjsip/pjlib/build/../src/pj/log.c:161
4	4	2 : View List ['pthread_mutex_unlock', 'pthread_mutex_destroy']	4	4	pj_mutex_destroy	call site: 00000	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1593
2	2	1 : View List ['pj_memset']	2	14	pj_log	call site: 00055	/src/pjsip/pjlib/build/../src/pj/log.c:454
2	2	1 : View List ['pthread_mutex_destroy']	2	2	init_mutex	call site: 00077	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1361
0	118	2 : View List ['pj_log_get_level', 'pj_log_4']	4	131	pj_thread_register	call site: 00021	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:573
0	13	1 : View List ['pj_ansi_strxcpy']	17	91	pj_log	call site: 00036	/src/pjsip/pjlib/build/../src/pj/log.c:374

Runtime coverage analysis

Covered functions

103

Functions that are reachable but not covered

38

Reachable functions

130

Percentage of reachable functions covered

70.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-xml.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	2
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjlib-util/build/../src/pjlib-util/xml.c	7
pjlib-util/build/../src/pjlib-util/scanner.c	10
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjlib-util/build/../../pjlib/include/pj/string.h	2
pjlib-util/build/../../pjlib/include/pj/pool.h	1
pjlib-util/build/../../pjlib/include/pj/list.h	2
pjlib/include/pj/pool.h	1

Fuzzer: fuzz-http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	48	17.7%
gold	[1:9]	71	26.1%
yellow	[10:29]	1	0.36%
greenyellow	[30:49]	12	4.42%
lawngreen	50+	139	51.2%
All colors	271	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
126	128	3 : View List ['pj_log_get_level', 'pj_exception_id_name', 'pj_log_1']	128	145	pj_throw_exception_	call site: 00177	/src/pjsip/pjlib/build/../src/pj/except.c:46
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00107	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00007	/src/pjsip/pjlib/build/../src/pj/log.c:161
4	4	2 : View List ['pthread_mutex_unlock', 'pthread_mutex_destroy']	4	4	pj_mutex_destroy	call site: 00000	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1593
2	2	1 : View List ['pj_memset']	2	14	pj_log	call site: 00055	/src/pjsip/pjlib/build/../src/pj/log.c:454
2	2	1 : View List ['pthread_mutex_destroy']	2	2	init_mutex	call site: 00077	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1361
0	118	2 : View List ['pj_log_get_level', 'pj_log_4']	4	131	pj_thread_register	call site: 00021	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:573
0	13	1 : View List ['pj_ansi_strxcpy']	17	91	pj_log	call site: 00036	/src/pjsip/pjlib/build/../src/pj/log.c:374

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

38

Reachable functions

126

Percentage of reachable functions covered

69.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-http.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	5
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	4
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	6
tests/fuzz/./../../pjlib-util/src/pjlib-util/http_client.c	4
pjlib/include/pj/string.h	2
pjlib-util/build/../src/pjlib-util/scanner.c	7
pjlib-util/build/../../pjlib/include/pj/string.h	1
pjlib-util/build/../include/pjlib-util/scanner.h	1
pjlib/build/../include/pj/ctype.h	1
pjlib-util/include/pjlib-util/scanner.h	1

Fuzzer: fuzz-sdp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	98	17.8%
gold	[1:9]	91	16.5%
yellow	[10:29]	15	2.73%
greenyellow	[30:49]	4	0.72%
lawngreen	50+	341	62.1%
All colors	549	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
126	128	3 : View List ['pj_log_get_level', 'pj_exception_id_name', 'pj_log_1']	128	145	pj_throw_exception_	call site: 00282	/src/pjsip/pjlib/build/../src/pj/except.c:46
91	123	2 : View List ['pj_mutex_lock', 'pj_mutex_create_simple']	99	133	pj_thread_create	call site: 00192	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:768
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
51	121	4 : View List ['pj_mutex_lock', 'event_mgr_distribute_events', 'pj_sem_wait', 'pj_mutex_unlock']	51	121	event_worker_thread	call site: 00215	/src/pjsip/pjmedia/build/../src/pjmedia/event.c:165
11	11	1 : View List ['platform_strerror']	11	11	pj_strerror	call site: 00350	/src/pjsip/pjlib/build/../src/pj/errno.c:189
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_sem_create	call site: 00180	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1791
6	6	1 : View List ['__errno_location']	6	6	pj_sem_wait	call site: 00220	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1847
6	6	1 : View List ['__errno_location']	6	6	pj_sem_post	call site: 00234	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1904
6	6	1 : View List ['__errno_location']	6	6	pj_sem_destroy	call site: 00249	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1938
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39

Runtime coverage analysis

Covered functions

155

Functions that are reachable but not covered

53

Reachable functions

197

Percentage of reachable functions covered

73.1%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-sdp.c	2
pjlib/build/../src/pj/os_core_unix.c	28
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	3
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	7
pjlib/build/../include/pj/string.h	6
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjmedia/build/../src/pjmedia/event.c	5
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/list.h	1
pjlib/build/../include/pj/pool.h	1
pjmedia/build/../src/pjmedia/sdp.c	21
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	2
pjlib-util/build/../../pjlib/include/pj/string.h	3
pjlib-util/build/../src/pjlib-util/scanner.c	15
pjmedia/build/../../pjlib-util/include/pjlib-util/scanner.h	2
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjlib/build/../src/pj/errno.c	6
pjlib/build/../src/pj/os_error_unix.c	1
pjlib/build/../include/pj/ctype.h	3
pjlib/build/../src/pj/array.c	1
pjmedia/build/../../pjlib/include/pj/ctype.h	1

Fuzzer: fuzz-rtcp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	81	20.7%
gold	[1:9]	62	15.8%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	248	63.4%
All colors	391	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
116	122	3 : View List ['pj_log_get_level', 'pj_math_stat_update', 'pj_log_5']	116	131	parse_rtcp_report	call site: 00300	/src/pjsip/pjmedia/build/../src/pjmedia/rtcp.c:685
91	123	2 : View List ['pj_mutex_lock', 'pj_mutex_create_simple']	99	133	pj_thread_create	call site: 00192	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:768
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_sem_create	call site: 00180	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1791
6	6	1 : View List ['__errno_location']	6	6	pj_sem_wait	call site: 00220	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1847
6	6	1 : View List ['__errno_location']	6	6	pj_sem_post	call site: 00234	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1904
6	6	1 : View List ['__errno_location']	6	6	pj_sem_destroy	call site: 00249	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1938
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00107	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00007	/src/pjsip/pjlib/build/../src/pj/log.c:161

Runtime coverage analysis

Covered functions

121

Functions that are reachable but not covered

47

Reachable functions

157

Percentage of reachable functions covered

70.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-rtcp.c	2
pjlib/build/../src/pj/os_core_unix.c	28
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjmedia/build/../src/pjmedia/event.c	8
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/list.h	1
pjlib/build/../include/pj/pool.h	1
pjmedia/build/../src/pjmedia/rtcp.c	9
pjmedia/build/../../pjlib/include/pj/string.h	3
pjlib/build/../src/pj/sock_bsd.c	4
pjmedia/build/../../pjlib/include/pj/math.h	2
pjlib/build/../src/pj/errno.c	5
pjlib/build/../src/pj/os_error_unix.c	1
pjmedia/build/../src/pjmedia/rtcp_fb.c	2
pjmedia/build/../include/pjmedia/types.h	1

Fuzzer: fuzz-stun

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	140	35.1%
gold	[1:9]	68	17.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	1.50%
lawngreen	50+	184	46.2%
All colors	398	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
179	179	2 : View List ['pj_stun_msg_add_unknown_attr', 'pj_stun_msg_create_response']	179	179	pj_stun_msg_decode	call site: 00232	/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c:2404
147	147	1 : View List ['create_challenge']	147	147	pj_stun_authenticate_request	call site: 00366	/src/pjsip/pjnath/build/../src/pjnath/stun_auth.c:495
116	116	1 : View List ['pj_stun_msg_create_response']	116	258	pj_stun_msg_decode	call site: 00252	/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c:2460
116	116	1 : View List ['pj_stun_msg_create_response']	116	116	pj_stun_msg_decode	call site: 00200	/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c:2381
116	116	1 : View List ['pj_stun_msg_create_response']	116	116	pj_stun_msg_decode	call site: 00235	/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c:2421
116	116	1 : View List ['pj_stun_msg_create_response']	116	116	pj_stun_msg_decode	call site: 00270	/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c:2488
116	116	1 : View List ['pj_stun_msg_create_response']	116	116	pj_stun_msg_decode	call site: 00271	/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c:2500
116	116	1 : View List ['pj_stun_msg_create_response']	116	116	pj_stun_msg_decode	call site: 00272	/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c:2514
116	116	1 : View List ['pj_stun_msg_create_response']	116	116	pj_stun_msg_decode	call site: 00273	/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c:2525
109	109	3 : View List ['pj_getaddrinfo', 'pj_memcpy.1526', 'pj_inet_pton']	109	109	pj_sockaddr_set_str_addr	call site: 00000	/src/pjsip/pjlib/build/../src/pj/sock_common.c:175
100	100	3 : View List ['pj_getaddrinfo', 'pj_inet_addr', 'pj_memcpy.1526']	100	100	pj_sockaddr_in_set_str_addr	call site: 00000	/src/pjsip/pjlib/build/../src/pj/sock_common.c:134
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48

Runtime coverage analysis

Covered functions

131

Functions that are reachable but not covered

57

Reachable functions

155

Percentage of reachable functions covered

63.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-stun.c	2
pjlib/build/../src/pj/os_core_unix.c	17
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	4
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjnath/build/../src/pjnath/stun_msg.c	21
pjlib-util/build/../src/pjlib-util/crc32.c	4
pjnath/build/../../pjlib/include/pj/pool.h	1
pjnath/build/../../pjlib/include/pj/string.h	4
pjlib/build/../src/pj/sock_bsd.c	2
pjlib/build/../src/pj/errno.c	2
pjlib/build/../src/pj/os_error_unix.c	1
pjlib/include/pj/string.h	1
pjnath/build/../src/pjnath/stun_auth.c	5
pjlib-util/build/../src/pjlib-util/md5.c	4
pjlib-util/build/../../pjlib/include/pj/string.h	3
pjlib-util/build/../src/pjlib-util/hmac_sha1.c	3
pjlib-util/build/../src/pjlib-util/sha1.c	4

Fuzzer: fuzz-json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	52	15.7%
gold	[1:9]	70	21.2%
yellow	[10:29]	4	1.21%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	204	61.8%
All colors	330	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
126	128	3 : View List ['pj_log_get_level', 'pj_exception_id_name', 'pj_log_1']	128	145	pj_throw_exception_	call site: 00175	/src/pjsip/pjlib/build/../src/pj/except.c:46
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
7	7	2 : View List ['pj_thread_get_name', 'strlen']	7	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	15	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00107	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00007	/src/pjsip/pjlib/build/../src/pj/log.c:161
4	4	2 : View List ['pthread_mutex_unlock', 'pthread_mutex_destroy']	4	4	pj_mutex_destroy	call site: 00000	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1593
2	2	1 : View List ['pthread_mutex_destroy']	2	2	init_mutex	call site: 00077	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1361
0	118	2 : View List ['pj_log_get_level', 'pj_log_4']	4	131	pj_thread_register	call site: 00021	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:573
0	13	1 : View List ['pj_ansi_strxcpy']	15	91	pj_log	call site: 00036	/src/pjsip/pjlib/build/../src/pj/log.c:374
0	2	1 : View List ['pj_memset']	0	14	pj_log	call site: 00055	/src/pjsip/pjlib/build/../src/pj/log.c:454

Runtime coverage analysis

Covered functions

128

Functions that are reachable but not covered

37

Reachable functions

155

Percentage of reachable functions covered

76.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-json.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	7
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	6
pjlib-util/build/../src/pjlib-util/json.c	18
pjlib-util/build/../../pjlib/include/pj/string.h	5
pjlib-util/build/../src/pjlib-util/scanner.c	12
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	2
pjlib-util/build/../include/pjlib-util/scanner.h	3
pjlib/build/../include/pj/ctype.h	3
pjlib-util/build/../../pjlib/include/pj/ctype.h	3
pjlib-util/build/../../pjlib/include/pj/list.h	3

Fuzzer: fuzz-url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	67	25.0%
gold	[1:9]	87	32.5%
yellow	[10:29]	6	2.24%
greenyellow	[30:49]	4	1.49%
lawngreen	50+	103	38.5%
All colors	267	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
126	128	3 : View List ['pj_log_get_level', 'pj_exception_id_name', 'pj_log_1']	128	145	pj_throw_exception_	call site: 00172	/src/pjsip/pjlib/build/../src/pj/except.c:46
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00107	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00007	/src/pjsip/pjlib/build/../src/pj/log.c:161
4	4	2 : View List ['pthread_mutex_unlock', 'pthread_mutex_destroy']	4	4	pj_mutex_destroy	call site: 00000	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1593
2	2	1 : View List ['pj_memset']	2	14	pj_log	call site: 00055	/src/pjsip/pjlib/build/../src/pj/log.c:454
2	2	1 : View List ['pthread_mutex_destroy']	2	2	init_mutex	call site: 00077	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1361
0	118	2 : View List ['pj_log_get_level', 'pj_log_4']	4	131	pj_thread_register	call site: 00021	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:573
0	13	1 : View List ['pj_ansi_strxcpy']	17	91	pj_log	call site: 00036	/src/pjsip/pjlib/build/../src/pj/log.c:374

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

44

Reachable functions

125

Percentage of reachable functions covered

64.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-url.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	4
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	4
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	3
pjlib-util/build/../src/pjlib-util/http_client.c	4
pjlib-util/build/../../pjlib/include/pj/string.h	4
pjlib-util/build/../src/pjlib-util/scanner.c	9
pjlib-util/build/../include/pjlib-util/scanner.h	1
pjlib/build/../include/pj/ctype.h	1

Fuzzer: fuzz-uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	364	42.4%
gold	[1:9]	68	7.93%
yellow	[10:29]	10	1.16%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	415	48.4%
All colors	857	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
126	128	3 : View List ['pj_log_get_level', 'pj_exception_id_name', 'pj_log_1']	128	145	pj_throw_exception_	call site: 00269	/src/pjsip/pjlib/build/../src/pj/except.c:46
78	78	2 : View List ['term_set_color', 'term_restore_color']	78	78	pj_log_write	call site: 00000	/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c:48
7	7	2 : View List ['pj_thread_get_name', 'strlen']	9	46	pj_log	call site: 00047	/src/pjsip/pjlib/build/../src/pj/log.c:419
6	6	1 : View List ['pj_utoa']	17	78	pj_log	call site: 00038	/src/pjsip/pjlib/build/../src/pj/log.c:380
6	6	1 : View List ['__errno_location']	6	6	pj_gettimeofday	call site: 00032	/src/pjsip/pjlib/build/../src/pj/os_time_unix.c:39
6	6	1 : View List ['__errno_location']	6	6	pj_get_timestamp	call site: 00107	/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c:288
4	4	1 : View List ['pj_thread_local_free']	4	4	pj_log_init	call site: 00007	/src/pjsip/pjlib/build/../src/pj/log.c:161
4	4	2 : View List ['pthread_mutex_unlock', 'pthread_mutex_destroy']	4	4	pj_mutex_destroy	call site: 00000	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1593
4	4	1 : View List ['pj_memcmp']	4	4	compare_handler	call site: 00400	/src/pjsip/pjsip/build/../src/pjsip/sip_parser.c:594
2	2	1 : View List ['pj_memset']	2	14	pj_log	call site: 00055	/src/pjsip/pjlib/build/../src/pj/log.c:454
2	2	1 : View List ['pthread_mutex_destroy']	2	2	init_mutex	call site: 00077	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:1361
0	134	1 : View List ['pj_throw_exception_']	0	134	int_parse_sip_url	call site: 00292	/src/pjsip/pjsip/build/../src/pjsip/sip_parser.c:1521

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

132

Reachable functions

272

Percentage of reachable functions covered

51.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-uri.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	3
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	8
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	7
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjsip/build/..sip_parser.c	57
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	3
pjlib-util/build/../../pjlib/include/pj/string.h	4
pjlib-util/build/../src/pjlib-util/scanner.c	18
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjsip/build/..sip_uri.c	5
pjsip/build/../../pjlib/include/pj/string.h	5
pjsip/build/../../pjlib/include/pj/list.h	2
pjlib-util/build/../src/pjlib-util/string.c	1
pjlib-util/build/../../pjlib/include/pj/ctype.h	2
pjlib/build/../include/pj/ctype.h	4
pjsip/build/../../pjlib-util/include/pjlib-util/scanner.h	2
pjlib/build/../src/pj/hash.c	1
pjsip/build/../../pjlib/include/pj/ctype.h	1
pjsip/build/..sip_msg.c	39
pjsip/build/../include/pjsip/print_util.h	1
pjsip/build/..sip_auth_parser.c	11
pjsip/build/..sip_auth_msg.c	4
pjsip/build/../../pjlib/include/pj/pool.h	1

Fuzzer: fuzz-sip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	668	34.2%
gold	[1:9]	42	2.15%
yellow	[10:29]	1	0.05%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1238	63.5%
All colors	1949	100

Fuzz blockers

The followings are the branches where fuzzer fails to bypass.

Unique non-covered Complexity	Unique Reachable Complexities	Unique Reachable Functions	All non-covered Complexity	All Reachable Complexity	Function Name	Function Callsite	Blocked Branch
311	311	1 : View List ['pj_dns_resolver_destroy']	311	393	pjsip_resolver_destroy	call site: 01849	/src/pjsip/pjsip/build/../src/pjsip/sip_resolve.c:168
302	1012	8 : View List ['pj_rwmutex_destroy', 'pj_mutex_destroy', 'pj_timer_heap_destroy', 'deinit_sip_parser', 'pj_perror_4', 'pjsip_tpmgr_destroy', 'pj_pool_release', 'pj_ioqueue_destroy']	302	1012	pjsip_endpt_create	call site: 01230	/src/pjsip/pjsip/build/../src/pjsip/sip_endpoint.c:525
247	247	1 : View List ['pjsip_endpt_cancel_timer']	479	831	destroy_transport	call site: 01276	/src/pjsip/pjsip/build/../src/pjsip/sip_transport.c:1372
244	244	2 : View List ['pj_perror_3', 'pjsip_endpt_atexit']	244	244	mod_tsx_layer_unload	call site: 00000	/src/pjsip/pjsip/build/../src/pjsip/sip_transaction.c:862
190	190	1 : View List ['pjsip_endpt_unregister_module']	190	198	pjsip_tpmgr_destroy	call site: 01415	/src/pjsip/pjsip/build/../src/pjsip/sip_transport.c:2019
151	151	1 : View List ['pj_perror_2']	151	248	parse_multipart_part	call site: 01740	/src/pjsip/pjsip/build/../src/pjsip/sip_multipart.c:680
126	128	3 : View List ['pj_log_get_level', 'pj_exception_id_name', 'pj_log_1']	128	145	pj_throw_exception_	call site: 00348	/src/pjsip/pjlib/build/../src/pj/except.c:46
116	118	2 : View List ['pj_log_get_level', 'pj_log_4']	120	131	pj_thread_register	call site: 00022	/src/pjsip/pjlib/build/../src/pj/os_core_unix.c:573
116	118	2 : View List ['pj_log_get_level', 'pj_log_3']	116	210	destroy_transport	call site: 01329	/src/pjsip/pjsip/build/../src/pjsip/sip_transport.c:1422
97	97	1 : View List ['pj_create_unique_string']	97	151	pjsip_multipart_create	call site: 01722	/src/pjsip/pjsip/build/../src/pjsip/sip_multipart.c:248
8	8	1 : View List ['pj_gethostname']	310	2177	pjsip_endpt_create	call site: 00999	/src/pjsip/pjsip/build/../src/pjsip/sip_endpoint.c:477
8	8	1 : View List ['pjsip_media_type_init']	105	205	pjsip_multipart_create	call site: 01707	/src/pjsip/pjsip/build/../src/pjsip/sip_multipart.c:235

Runtime coverage analysis

Covered functions

337

Functions that are reachable but not covered

182

Reachable functions

502

Percentage of reachable functions covered

63.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-sip.c	2
pjlib/build/../src/pj/log.c	21
pjlib/build/../src/pj/os_core_unix.c	38
pjlib/build/../include/pj/string_i.h	12
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	9
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	7
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib-util/build/../src/pjlib-util/errno.c	2
pjlib/build/../src/pj/errno.c	7
pjlib/build/../src/pj/config.c	1
pjlib/build/../src/pj/ioqueue_select.c	7
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	2
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	7
pjlib/build/../include/pj/list_i.h	8
pjlib/build/../src/pj/lock.c	19
pjlib/build/../include/pj/pool_i.h	7
pjsip/build/..sip_endpoint.c	16
pjsip/build/..sip_errno.c	1
pjsip/build/..sip_msg.c	49
pjsip/build/../../pjlib/include/pj/string.h	9
pjsip/build/../../pjlib/include/pj/pool.h	1
pjsip/build/../../pjlib/include/pj/list.h	3
pjsip/build/..sip_parser.c	68
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	3
pjlib-util/build/../../pjlib/include/pj/string.h	5
pjlib-util/build/../src/pjlib-util/scanner.c	21
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjsip/build/..sip_uri.c	7
pjlib-util/build/../src/pjlib-util/string.c	1
pjlib-util/build/../../pjlib/include/pj/ctype.h	2
pjlib/build/../include/pj/ctype.h	5
pjsip/build/../../pjlib-util/include/pjlib-util/scanner.h	3
pjlib/build/../src/pj/hash.c	11
pjsip/build/../../pjlib/include/pj/ctype.h	2
pjsip/build/../include/pjsip/print_util.h	1
pjsip/build/..sip_auth_parser.c	11
pjsip/build/..sip_auth_msg.c	4
pjsip/build/..sip_tel_uri.c	3
pjlib/build/../src/pj/sock_bsd.c	2
pjsip/build/../include/pjsip/sip_config.h	1
pjlib/build/../src/pj/timer.c	22
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_common_abs.c	6
pjlib/build/../src/pj/sock_select.c	3
pjsip/build/..sip_transport.c	21
pjlib/build/../src/pj/os_error_unix.c	3
pjsip/build/..sip_resolve.c	2
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/types.c	1
pjsip/build/..sip_transaction.c	2
pjsip/build/..sip_transport_loop.c	2
pjsip/build/..sip_multipart.c	5
pjlib/build/../src/pj/guid.c	1
pjlib/include/pj/list.h	1
pjlib-util/build/../src/pjlib-util/resolver.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
tsx_on_state_calling	/src/pjsip/pjsip/build/../src/pjsip/sip_transaction.c	2	['N/A', 'N/A']	24	0	255	41	12	350	0	1969	1158
http_on_data_read	/src/pjsip/tests/fuzz/./../../pjlib-util/src/pjlib-util/http_client.c	5	['N/A', 'N/A', 'size_t', 'int', 'N/A']	17	0	805	121	46	255	1	1359	451
pjmedia_endpt_create_sdp	/src/pjsip/pjmedia/build/../src/pjmedia/endpoint.c	5	['N/A', 'N/A', 'int', 'N/A', 'N/A']	10	0	225	42	14	89	0	530	210
pjmedia_endpt_create2	/src/pjsip/pjmedia/build/../src/pjmedia/endpoint.c	4	['N/A', 'N/A', 'int', 'N/A']	9	0	328	63	18	158	0	729	196
pjsip_endpt_respond	/src/pjsip/pjsip/build/../src/pjsip/sip_util_statefull.c	8	['N/A', 'N/A', 'N/A', 'int', 'N/A', 'N/A', 'N/A', 'N/A']	19	0	236	41	14	203	0	917	169
pjsip_tpmgr_find_local_addr	/src/pjsip/pjsip/build/../src/pjsip/sip_transport.c	6	['N/A', 'N/A', 'int', 'N/A', 'N/A', 'N/A']	14	0	69	6	3	168	0	898	129
pjmedia_rtcp_fb_encode_sdp	/src/pjsip/pjmedia/build/../src/pjmedia/rtcp_fb.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'int', 'N/A']	9	0	388	73	21	117	0	579	118
on_read_complete	/src/pjsip/pjlib-util/build/../src/pjlib-util/resolver.c	3	['N/A', 'N/A', 'size_t']	10	0	508	69	19	159	0	780	106
pjsip_authorization_hdr_print	/src/pjsip/pjsip/build/../src/pjsip/sip_auth_msg.c	3	['N/A', 'N/A', 'size_t']	4	0	288	41	12	12	0	116	75
pjsip_url_print	/src/pjsip/pjsip/build/../src/pjsip/sip_uri.c	4	['int', 'N/A', 'N/A', 'size_t']	3	0	1281	190	61	13	0	107	61

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

903 / 1487

Cyclomatic complexity statically reachable by fuzzers

6240 / 9803

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

tests/fuzz/fuzz-crypto.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['md5_differential', 'encode_base64_differential', 'sha1_differential', 'crc32_differential']

tests/fuzz/fuzz-vpx.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_pool_alloc_from_block', 'pjmedia_vpx_packetizer_create', 'pj_ansi_strxcpy', 'pj_pool_destroy_int', 'pj_thread_this', 'pj_log_init', 'pj_thread_local_get', 'pj_gettimeofday', 'pj_time_decode']

tests/fuzz/fuzz-h264.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_pool_alloc_from_block', 'pj_ansi_strxcpy', 'pj_pool_destroy_int', 'pj_thread_this', 'pj_log_init', 'pj_thread_local_get', 'pj_gettimeofday', 'pj_time_decode', 'pj_log']

tests/fuzz/fuzz-dns.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_ansi_strxcpy', 'pj_thread_this', 'reset_pool', 'pj_log_init', 'pj_thread_local_get', 'pj_gettimeofday', 'pj_time_decode', 'pj_log', 'log_get_raw_indent']

tests/fuzz/fuzz-xml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_throw_exception_', 'pj_ansi_strxcpy', 'pj_thread_this', 'reset_pool', 'xml_parse_node', 'pj_log_init', 'pj_thread_local_get', 'pj_gettimeofday', 'pj_time_decode']

tests/fuzz/fuzz-http.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_throw_exception_', 'pj_ansi_strxcpy', 'pj_thread_this', 'reset_pool', 'pj_log_init', 'pj_thread_local_get', 'pj_gettimeofday', 'pj_time_decode', 'pj_log']

tests/fuzz/fuzz-sdp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_sem_wait', 'pj_throw_exception_', 'pj_ansi_strxcpy', 'pjlib_error', 'pj_thread_this', 'pj_strtoul4', 'reset_pool', 'pj_thread_create', 'thread_main', 'pj_strtoul3']

tests/fuzz/fuzz-rtcp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_sem_wait', 'pjlib_error', 'pj_ansi_strxcpy', 'pj_thread_this', 'pjmedia_rtcp_get_ntp_time', 'pjmedia_event_publish', 'reset_pool', 'pj_thread_create', 'thread_main', 'pj_log_init']

tests/fuzz/fuzz-stun.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_stun_create_key', 'pj_stun_msg_decode', 'pj_stun_authenticate_request', 'pj_ansi_strxcpy', 'pjlib_error', 'pj_thread_this']

tests/fuzz/fuzz-json.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_throw_exception_', 'pj_ansi_strxcpy', 'pj_thread_this', 'pj_strtoul2', 'reset_pool', 'pj_log_init', 'pj_thread_local_get', 'pj_gettimeofday', 'pj_time_decode']

tests/fuzz/fuzz-url.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pj_pool_alloc_from_block', 'LLVMFuzzerTestOneInput', 'pj_throw_exception_', 'pj_ansi_strxcpy', 'pj_thread_this', 'pj_log_init', 'pj_thread_local_get', 'pj_http_req_parse_url', 'pj_gettimeofday']

tests/fuzz/fuzz-uri.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['init_parser', 'pj_pool_calloc', 'pjsip_auth_init_parser', 'int_parse_uri_or_name_addr', 'on_syntax_error']

tests/fuzz/fuzz-sip.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['pjsip_endpt_create', 'pjsip_tpmgr_destroy', 'pjsip_endpt_destroy', 'pj_push_exception_handler_', 'pjsip_auth_init_parser', 'int_parse_msg', 'init_parser', 'unlock_timer_heap', 'pj_thread_this']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
event_mgr_distribute_events	31	10	32.25%	['fuzz-sdp', 'fuzz-rtcp']
pj_timer_heap_dump	32	8	25.0%	['fuzz-sip']
loop_transport_worker_thread	48	19	39.58%	['fuzz-sip']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/pjsip/pjmedia/build/../src/pjmedia/endpoint.c	[]	[]
/src/pjsip/pjlib/build/../src/pj/os_timestamp_posix.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjsip/build/../include/pjsip/print_util.h	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_auth_parser.c	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjmedia/build/../src/pjmedia/event.c	['fuzz-sdp', 'fuzz-rtcp']	[]
/src/pjsip/tests/fuzz/fuzz-h264.c	['fuzz-h264']	['fuzz-h264']
/src/pjsip/pjlib/build/../src/pj/pool_caching.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjmedia/build/../src/pjmedia/types.c	[]	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/hmac_sha1.c	['fuzz-stun']	[]
/src/pjsip/tests/fuzz/fuzz-sdp.c	['fuzz-sdp']	['fuzz-sdp']
/src/pjsip/pjlib-util/build/../include/pjlib-util/scanner.h	['fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/string.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/os_error_unix.c	['fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-sip']	[]
/src/pjsip/pjmedia/build/../src/pjmedia/rtcp.c	['fuzz-rtcp']	[]
/src/pjsip/pjlib/build/../src/pj/os_timestamp_common.c	['fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/except.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjmedia/build/../src/pjmedia-codec/h264_packetizer.c	['fuzz-h264']	[]
/src/pjsip/pjlib/build/../src/pj/array.c	['fuzz-sdp']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_tel_uri.c	['fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/pool.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/tests/fuzz/fuzz-crypto.c	['fuzz-crypto']	['fuzz-crypto']
/src/pjsip/pjlib/build/../include/pj/ctype.h	['fuzz-http', 'fuzz-sdp', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/tests/fuzz/fuzz-url.c	['fuzz-url']	['fuzz-url']
/src/pjsip/pjmedia/build/../src/pjmedia/sdp.c	['fuzz-sdp']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_util_statefull.c	[]	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/sha1.c	['fuzz-crypto', 'fuzz-stun']	[]
/src/pjsip/tests/fuzz/fuzz-uri.c	['fuzz-uri']	['fuzz-uri']
/src/pjsip/pjlib/build/../src/pj/guid.c	['fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/pool_buf.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/include/pj/string.h	['fuzz-vpx', 'fuzz-h264', 'fuzz-http', 'fuzz-stun']	[]
/src/pjsip/pjlib/build/../src/pj/sock_common.c	[]	[]
/src/pjsip/pjmedia/build/../src/pjmedia/codec.c	[]	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/crc32.c	['fuzz-crypto', 'fuzz-stun']	[]
/src/pjsip/pjlib-util/build/../../pjlib/include/pj/string.h	['fuzz-crypto', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../include/pj/os.h	['fuzz-sip']	[]
/src/pjsip/tests/fuzz/fuzz-json.c	['fuzz-json']	['fuzz-json']
/src/pjsip/pjsip/build/../src/pjsip/sip_util.c	[]	[]
/src/pjsip/pjmedia/build/../src/pjmedia/format.c	[]	[]
/src/pjsip/tests/fuzz/fuzz-sip.c	['fuzz-sip']	['fuzz-sip']
/src/pjsip/pjsip/build/../src/pjsip/sip_transaction.c	['fuzz-sip']	[]
/src/pjsip/pjsip/build/../../pjlib/include/pj/pool.h	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/ioqueue_common_abs.c	['fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/os_core_unix.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/sock_select.c	['fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/config.c	['fuzz-sip']	[]
/src/pjsip/pjmedia/build/../src/pjmedia/errno.c	[]	[]
/src/pjsip/pjmedia/build/../src/pjmedia/rtp.c	[]	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_parser.c	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjnath/build/../src/pjnath/stun_msg.c	['fuzz-stun']	[]
/src/pjsip/tests/fuzz/fuzz-dns.c	['fuzz-dns']	['fuzz-dns']
/src/pjsip/pjlib/build/../src/pj/os_time_common.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjmedia/build/../include/pjmedia/types.h	['fuzz-rtcp']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_msg.c	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../include/pj/string.h	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_multipart.c	['fuzz-sip']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/errno.c	['fuzz-sip']	[]
/src/pjsip/pjnath/build/../src/pjnath/stun_auth.c	['fuzz-stun']	[]
/src/pjsip/tests/fuzz/fuzz-http.c	['fuzz-http']	['fuzz-http']
/src/pjsip/pjsip/build/../../pjlib/include/pj/ctype.h	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/tests/fuzz/./../../pjlib-util/src/pjlib-util/http_client.c	['fuzz-http']	[]
/src/pjsip/pjlib/build/../src/pj/rand.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/tests/fuzz/fuzz-rtcp.c	['fuzz-rtcp']	['fuzz-rtcp']
/src/pjsip/pjlib-util/build/../src/pjlib-util/md5.c	['fuzz-crypto', 'fuzz-stun']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_transport_loop.c	['fuzz-sip']	[]
/src/pjsip/pjsip/build/../include/pjsip/sip_msg.h	[]	[]
/src/pjsip/pjlib/build/../src/pj/addr_resolv_sock.c	[]	[]
/src/pjsip/pjlib/build/../include/pj/string_i.h	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/http_client.c	['fuzz-url']	[]
/src/pjsip/pjmedia/build/../src/pjmedia-codec/vpx_packetizer.c	['fuzz-vpx']	[]
/src/pjsip/pjmedia/build/../../pjlib-util/include/pjlib-util/scanner.h	['fuzz-sdp']	[]
/src/pjsip/tests/fuzz/fuzz-vpx.c	['fuzz-vpx']	['fuzz-vpx']
/src/pjsip/tests/fuzz/fuzz-xml.c	['fuzz-xml']	['fuzz-xml']
/src/pjsip/pjsip/build/../src/pjsip/sip_errno.c	['fuzz-sip']	[]
/src/pjsip/pjsip/build/../include/pjsip/sip_uri.h	[]	[]
/src/pjsip/pjmedia/build/../src/pjmedia/rtcp_fb.c	['fuzz-rtcp']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_config.c	[]	[]
/src/pjsip/pjsip/build/../../pjlib-util/include/pjlib-util/scanner.h	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../include/pj/list_i.h	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/string.c	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/timer.c	['fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/log.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_resolve.c	['fuzz-sip']	[]
/src/pjsip/pjmedia/build/../../pjlib/include/pj/string.h	['fuzz-vpx', 'fuzz-h264', 'fuzz-rtcp']	[]
/src/pjsip/pjlib/build/../src/pj/log_writer_stdout.c	[]	[]
/src/pjsip/pjsip/build/../../pjlib/include/pj/string.h	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/pool_policy_malloc.c	[]	[]
/src/pjsip/pjlib/build/../src/pj/lock.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/hash.c	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/scanner.c	['fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../include/pj/pool.h	['fuzz-sdp', 'fuzz-rtcp', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/activesock.c	[]	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_uri.c	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_auth_msg.c	['fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjmedia/build/../src/pjmedia/vid_codec.c	[]	[]
/src/pjsip/pjlib/build/../src/pj/ioqueue_select.c	['fuzz-sip']	[]
/src/pjsip/pjmedia/build/../../pjlib/include/pj/math.h	['fuzz-rtcp']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	['fuzz-sdp', 'fuzz-json', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/ip_helper_generic.c	[]	[]
/src/pjsip/pjlib/build/../src/pj/errno.c	['fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-sip']	[]
/src/pjsip/pjlib/include/pj/ctype.h	[]	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/json.c	['fuzz-json']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/base64.c	['fuzz-crypto']	[]
/src/pjsip/pjlib/build/../include/pj/pool_i.h	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjsip/build/../include/pjsip/sip_config.h	['fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/sock_bsd.c	['fuzz-dns', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../include/pj/list.h	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/os_time_unix.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib-util/build/../../pjlib/include/pj/ctype.h	['fuzz-json', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib/build/../src/pj/types.c	['fuzz-sip']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/xml.c	['fuzz-xml']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/srv_resolver.c	[]	[]
/src/pjsip/pjlib/build/../src/pj/guid_simple.c	['fuzz-vpx', 'fuzz-h264', 'fuzz-dns', 'fuzz-xml', 'fuzz-http', 'fuzz-sdp', 'fuzz-rtcp', 'fuzz-stun', 'fuzz-json', 'fuzz-url', 'fuzz-uri', 'fuzz-sip']	[]
/src/pjsip/pjlib-util/build/../src/pjlib-util/dns.c	['fuzz-dns']	[]
/src/pjsip/pjlib/build/../include/pj/ip_helper.h	[]	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_endpoint.c	['fuzz-sip']	[]
/src/pjsip/pjsip/build/../src/pjsip/sip_transport.c	['fuzz-sip']	[]
/src/pjsip/tests/fuzz/fuzz-stun.c	['fuzz-stun']	['fuzz-stun']
/src/pjsip/pjlib-util/build/../src/pjlib-util/resolver.c	['fuzz-sip']	[]

Directories in report

Directory
/src/pjsip/pjlib/include/pj/
/src/pjsip/pjsip/build/../include/pjsip/
/src/pjsip/pjnath/build/../src/pjnath/
/src/pjsip/pjlib-util/build/../../pjlib/include/pj/
/src/pjsip/pjlib/build/../src/pj/
/src/pjsip/pjmedia/build/../../pjlib/include/pj/
/src/pjsip/pjmedia/build/../src/pjmedia-codec/
/src/pjsip/pjsip/build/../src/pjsip/
/src/pjsip/pjlib/build/../include/pj/
/src/pjsip/pjlib-util/build/../src/pjlib-util/
/src/pjsip/pjmedia/build/../src/pjmedia/
/src/pjsip/pjsip/build/../../pjlib/include/pj/
/src/pjsip/tests/fuzz/
/src/pjsip/pjmedia/build/../include/pjmedia/
/src/pjsip/pjmedia/build/../../pjlib-util/include/pjlib-util/
/src/pjsip/pjsip/build/../../pjlib-util/include/pjlib-util/
/src/pjsip/tests/fuzz/./../../pjlib-util/src/pjlib-util/
/src/pjsip/pjlib-util/build/../include/pjlib-util/