High level conclusions

Fuzzers reach 54.90% code coverage.

Fuzzers reach 48.49% of cyclomatic complexity.

Fuzzers reach 47.97% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1330 / 2772

Cyclomatic complexity statically reachable by fuzzers

9286 / 19150

Runtime code coverage of functions

1522 / 2772

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzz-h264

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	47	24.1%
gold	[1:9]	65	33.3%
yellow	[10:29]	2	1.02%
greenyellow	[30:49]	2	1.02%
lawngreen	50+	79	40.5%
All colors	195	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	140	pj_pool_alloc_from_block	call site: 00140	pj_pool_allocate_find
5	38	pj_ansi_strxcpy	call site: 00038	pj_ansi_strxcpy
5	184	pj_pool_destroy_int	call site: 00184	pj_log_4
4	50	pj_thread_this	call site: 00050	pj_thread_get_name
2	8	pj_log_init	call site: 00008	pj_thread_local_free
2	12	pj_log_init	call site: 00012	pj_thread_local_free
2	23	pj_thread_local_get	call site: 00023	pj_log_4
1	33	pj_gettimeofday	call site: 00033	__errno_location
1	36	pj_time_decode	call site: 00036	pj_ansi_strxcpy
1	48	pj_log	call site: 00048	pj_thread_this
1	58	log_get_raw_indent	call site: 00058	pj_memset
1	60	pj_log	call site: 00060	snprintf

Runtime coverage analysis

Covered functions

79

Functions that are reachable but not covered

31

Reachable functions

98

Percentage of reachable functions covered

68.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-h264.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	13
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjlib/include/pj/string.h	1
pjmedia/build/../src/pjmedia-codec/h264_packetizer.c	2
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/string.h	1

Fuzzer: fuzz-vpx

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	51	27.2%
gold	[1:9]	65	34.7%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	44	23.5%
lawngreen	50+	27	14.4%
All colors	187	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	139	pj_pool_alloc_from_block	call site: 00139	pj_pool_allocate_find
8	161	pjmedia_vpx_packetizer_create	call site: 00161	pj_pool_zalloc
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
5	176	pj_pool_destroy_int	call site: 00176	pj_log_4
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
2	7	pj_log_init	call site: 00007	pj_thread_local_free
2	11	pj_log_init	call site: 00011	pj_thread_local_free
2	22	pj_thread_local_get	call site: 00022	pj_log_4
1	32	pj_gettimeofday	call site: 00032	__errno_location
1	35	pj_time_decode	call site: 00035	pj_ansi_strxcpy
1	47	pj_log	call site: 00047	pj_thread_this
1	57	log_get_raw_indent	call site: 00057	pj_memset

Runtime coverage analysis

Covered functions

76

Functions that are reachable but not covered

35

Reachable functions

99

Percentage of reachable functions covered

64.65%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-vpx.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	13
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjlib/include/pj/string.h	1
pjmedia/build/../src/pjmedia-codec/vpx_packetizer.c	3
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/string.h	2

Fuzzer: fuzz-json

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	51	15.9%
gold	[1:9]	70	21.8%
yellow	[10:29]	4	1.25%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	195	60.9%
All colors	320	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	166	pj_throw_exception_	call site: 00166	pj_log_1
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
4	227	pj_strtoul2	call site: 00227	pj_isxdigit
4	310	reset_pool	call site: 00310	pj_log_4
2	7	pj_log_init	call site: 00007	pj_thread_local_free
2	11	pj_log_init	call site: 00011	pj_thread_local_free
2	22	pj_thread_local_get	call site: 00022	pj_log_4
1	32	pj_gettimeofday	call site: 00032	__errno_location
1	35	pj_time_decode	call site: 00035	pj_ansi_strxcpy
1	47	pj_log	call site: 00047	pj_thread_this
1	57	log_get_raw_indent	call site: 00057	pj_memset

Runtime coverage analysis

Covered functions

128

Functions that are reachable but not covered

37

Reachable functions

155

Percentage of reachable functions covered

76.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-json.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	7
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	6
pjlib-util/build/../src/pjlib-util/json.c	18
pjlib-util/build/../../pjlib/include/pj/string.h	5
pjlib-util/build/../src/pjlib-util/scanner.c	12
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	2
pjlib-util/build/../include/pjlib-util/scanner.h	3
pjlib/build/../include/pj/ctype.h	3
pjlib-util/build/../../pjlib/include/pj/ctype.h	3
pjlib-util/build/../../pjlib/include/pj/list.h	3

Fuzzer: fuzz-rtp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	50	16.0%
gold	[1:9]	63	20.2%
yellow	[10:29]	5	1.60%
greenyellow	[30:49]	5	1.60%
lawngreen	50+	188	60.4%
All colors	311	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	36	pj_ansi_strxcpy	call site: 00036	pj_ansi_strxcpy
4	48	pj_thread_this	call site: 00048	pj_thread_get_name
4	301	reset_pool	call site: 00301	pj_log_4
3	264	pjmedia_jbuf_put_frame3	call site: 00264	jbuf_calculate_jitter
2	6	pj_log_init	call site: 00006	pj_thread_local_free
2	10	pj_log_init	call site: 00010	pj_thread_local_free
2	21	pj_thread_local_get	call site: 00021	pj_log_4
2	279	pjmedia_jbuf_get_frame3	call site: 00279	jb_framelist_remove_head
1	31	pj_gettimeofday	call site: 00031	__errno_location
1	34	pj_time_decode	call site: 00034	pj_ansi_strxcpy
1	46	pj_log	call site: 00046	pj_thread_this
1	56	log_get_raw_indent	call site: 00056	pj_memset

Runtime coverage analysis

Covered functions

122

Functions that are reachable but not covered

34

Reachable functions

144

Percentage of reachable functions covered

76.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-rtp.c	7
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	2
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjmedia/build/../src/pjmedia/rtp.c	9
pjlib/build/../src/pj/sock_bsd.c	4
pjmedia/build/../../pjlib/include/pj/string.h	3
pjmedia/build/../src/pjmedia/jbuf.c	21
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/math.h	4

Fuzzer: fuzz-http

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	47	17.9%
gold	[1:9]	71	27.0%
yellow	[10:29]	1	0.38%
greenyellow	[30:49]	9	3.43%
lawngreen	50+	134	51.1%
All colors	262	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	168	pj_throw_exception_	call site: 00168	pj_log_1
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
4	252	reset_pool	call site: 00252	pj_log_4
2	7	pj_log_init	call site: 00007	pj_thread_local_free
2	11	pj_log_init	call site: 00011	pj_thread_local_free
2	22	pj_thread_local_get	call site: 00022	pj_log_4
1	32	pj_gettimeofday	call site: 00032	__errno_location
1	35	pj_time_decode	call site: 00035	pj_ansi_strxcpy
1	47	pj_log	call site: 00047	pj_thread_this
1	57	log_get_raw_indent	call site: 00057	pj_memset
1	59	pj_log	call site: 00059	snprintf

Runtime coverage analysis

Covered functions

100

Functions that are reachable but not covered

38

Reachable functions

126

Percentage of reachable functions covered

69.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-http.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	5
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	4
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	6
tests/fuzz/./../../pjlib-util/src/pjlib-util/http_client.c	4
pjlib/include/pj/string.h	2
pjlib-util/build/../src/pjlib-util/scanner.c	7
pjlib-util/build/../../pjlib/include/pj/string.h	1
pjlib-util/build/../include/pjlib-util/scanner.h	1
pjlib/build/../include/pj/ctype.h	1
pjlib-util/include/pjlib-util/scanner.h	1

Fuzzer: fuzz-sdp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	95	17.5%
gold	[1:9]	91	16.8%
yellow	[10:29]	13	2.40%
greenyellow	[30:49]	5	0.92%
lawngreen	50+	336	62.2%
All colors	540	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
9	207	pj_sem_wait	call site: 00207	pjmedia_event_mgr_destroy
7	266	pj_throw_exception_	call site: 00266	pj_log_1
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
5	337	pjlib_error	call site: 00337	platform_strerror
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
4	366	pj_strtoul4	call site: 00366	pj_isxdigit
4	530	reset_pool	call site: 00530	pj_log_4
3	179	pj_thread_create	call site: 00179	pj_mutex_create_simple
3	193	thread_main	call site: 00193	pj_mutex_lock
3	406	pj_strtoul3	call site: 00406	pj_isxdigit
3	516	pj_strtoul2	call site: 00516	pj_isxdigit
2	7	pj_log_init	call site: 00007	pj_thread_local_free

Runtime coverage analysis

Covered functions

156

Functions that are reachable but not covered

53

Reachable functions

198

Percentage of reachable functions covered

73.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-sdp.c	2
pjlib/build/../src/pj/os_core_unix.c	29
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	3
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	7
pjlib/build/../include/pj/string.h	6
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjmedia/build/../src/pjmedia/event.c	5
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/list.h	1
pjlib/build/../include/pj/pool.h	1
pjmedia/build/../src/pjmedia/sdp.c	21
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	2
pjlib-util/build/../../pjlib/include/pj/string.h	3
pjlib-util/build/../src/pjlib-util/scanner.c	15
pjmedia/build/../../pjlib-util/include/pjlib-util/scanner.h	2
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjlib/build/../src/pj/errno.c	6
pjlib/build/../src/pj/os_error_unix.c	1
pjlib/build/../include/pj/ctype.h	3
pjlib/build/../src/pj/array.c	1
pjmedia/build/../../pjlib/include/pj/ctype.h	1

Fuzzer: fuzz-dns-records

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	12.7%
gold	[1:9]	93	38.1%
yellow	[10:29]	3	1.22%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	117	47.9%
All colors	244	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	36	pj_ansi_strxcpy	call site: 00036	pj_ansi_strxcpy
4	48	pj_thread_this	call site: 00048	pj_thread_get_name
2	6	pj_log_init	call site: 00006	pj_thread_local_free
2	10	pj_log_init	call site: 00010	pj_thread_local_free
2	21	pj_thread_local_get	call site: 00021	pj_log_4
1	31	pj_gettimeofday	call site: 00031	__errno_location
1	34	pj_time_decode	call site: 00034	pj_ansi_strxcpy
1	46	pj_log	call site: 00046	pj_thread_this
1	56	log_get_raw_indent	call site: 00056	pj_memset
1	58	pj_log	call site: 00058	snprintf
1	67	pj_thread_register	call site: 00067	snprintf
1	69	pj_thread_register	call site: 00069	pj_bzero

Runtime coverage analysis

Covered functions

85

Functions that are reachable but not covered

32

Reachable functions

102

Percentage of reachable functions covered

68.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-dns-records.c	1
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	13
pjlib/build/../include/pj/string_i.h	2
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	1
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	4
pjlib/build/../include/pj/list_i.h	1
pjlib/build/../src/pj/lock.c	2
pjlib/build/../include/pj/pool_i.h	7
pjlib-util/build/../src/pjlib-util/dns.c	5
pjlib-util/build/../../pjlib/include/pj/pool.h	1
pjlib-util/build/../../pjlib/include/pj/string.h	2
pjlib/build/../src/pj/sock_bsd.c	3
pjlib-util/build/../src/pjlib-util/resolver.c	2

Fuzzer: fuzz-srtp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	548	44.9%
gold	[1:9]	79	6.47%
yellow	[10:29]	1	0.08%
greenyellow	[30:49]	1	0.08%
lawngreen	50+	591	48.4%
All colors	1220	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
68	411	grp_lock_acquire	call site: 00411	ioqueue_dispatch_write_event
46	360	grp_lock_dec_ref	call site: 00360	ioqueue_dispatch_read_event_no_lock
26	296	pj_get_os_error	call site: 00296	increment_counter
22	1143	srtp_unprotect_rtcp_mki	call site: 01143	srtp_unprotect_rtcp_aead
19	685	pjmedia_srtp_init_lib	call site: 00685	pj_perror_4
19	923	srtp_stream_init_keys	call site: 00923	srtp_err_report
18	1048	srtp_unprotect_mki	call site: 01048	srtp_unprotect_aead
18	1068	be64_to_cpu	call site: 01068	srtp_stream_clone
12	163	pjmedia_aud_subsys_init	call site: 00163	pjmedia_aud_driver_init
11	326	pj_atomic_inc	call site: 00326	ioqueue_dispatch_read_event
10	627	srtp_auth_type_test	call site: 00627	srtp_crypto_kernel_list_debug_modules
9	1178	srtp_unprotect_rtcp_mki	call site: 01178	srtp_stream_clone

Runtime coverage analysis

Covered functions

289

Functions that are reachable but not covered

127

Reachable functions

375

Percentage of reachable functions covered

66.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-srtp.c	5
pjlib/build/../src/pj/os_core_unix.c	32
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	5
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	3
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	24
pjlib/build/../include/pj/pool_i.h	8
pjmedia/include/pjmedia/endpoint.h	2
pjmedia/build/../src/pjmedia-audiodev/audiodev.c	2
pjmedia/build/../src/pjmedia/audiodev.c	3
pjlib/build/../src/pj/errno.c	6
pjmedia/build/../src/pjmedia-audiodev/errno.c	1
pjmedia/build/../../pjlib/include/pj/string.h	5
pjmedia/build/../src/pjmedia/endpoint.c	6
pjmedia/build/../src/pjmedia/errno.c	1
pjmedia/build/../src/pjmedia/transport_srtp.c	14
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../src/pjmedia/codec.c	2
pjmedia/build/../../pjlib/include/pj/list.h	2
pjlib/build/../src/pj/ioqueue_select.c	10
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_common_abs.c	16
pjlib/build/../src/pj/sock_select.c	5
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/os_error_unix.c	4
pjlib/build/../src/pj/sock_bsd.c	7
pjlib/build/../src/pj/types.c	1
third_party/build/srtp/../../srtp/srtp/srtp.c	43
third_party/build/srtp/../../srtp/crypto/kernel/crypto_kernel.c	13
third_party/build/srtp/../../srtp/pjlib/srtp_err.c	2
third_party/build/srtp/../../srtp/crypto/cipher/cipher.c	14
third_party/build/srtp/../../srtp/crypto/math/datatypes.c	11
third_party/build/srtp/../../srtp/crypto/hash/auth.c	5
third_party/build/srtp/../../srtp/crypto/kernel/alloc.c	2
pjmedia/build/../src/pjmedia/transport_loop.c	4
pjmedia/build/../src/pjmedia/transport_srtp_sdes.c	1
pjlib/include/pj/string.h	2
third_party/build/srtp/../../srtp/crypto/replay/rdbx.c	10
third_party/build/srtp/../../srtp/crypto/replay/rdb.c	3
third_party/build/srtp/../../srtp/crypto/kernel/key.c	3
pjlib-util/build/../src/pjlib-util/base64.c	3
third_party/build/srtp/../../srtp/crypto/include/datatypes.h	2
pjmedia/include/pjmedia/transport.h	1

Fuzzer: fuzz-stream

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	328	53.4%
gold	[1:9]	186	30.2%
yellow	[10:29]	3	0.48%
greenyellow	[30:49]	1	0.16%
lawngreen	50+	96	15.6%
All colors	614	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
208	296	pj_get_os_error	call site: 00296	ioqueue_dispatch_read_event
13	50	pj_thread_this	call site: 00050	resume_logging
12	163	pjmedia_aud_subsys_init	call site: 00163	pjmedia_aud_driver_init
11	38	pj_ansi_strxcpy	call site: 00038	pj_ansi_strxcpy
8	506	reset_pool	call site: 00506	pj_log_4
7	23	pj_thread_local_get	call site: 00023	pj_log_4
7	178	pjmedia_endpt_create2	call site: 00178	pj_strncpy_with_null
6	31	pj_thread_local_set	call site: 00031	pj_ansi_strxcpy
6	221	pj_lock_create_recursive_mutex	call site: 00221	pj_mutex_destroy
4	553	pjmedia_codec_mgr_register_factory	call site: 00553	swap_codec
3	255	thread_main	call site: 00255	pj_mutex_lock
3	531	pjmedia_codec_mgr_register_factory	call site: 00531	pj_log_3

Runtime coverage analysis

Covered functions

283

Functions that are reachable but not covered

119

Reachable functions

235

Percentage of reachable functions covered

49.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-stream.c	2
pjlib/build/../src/pj/log.c	14
pjlib/build/../src/pj/os_core_unix.c	30
pjlib/build/../include/pj/string_i.h	4
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	3
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	21
pjlib/build/../include/pj/pool_i.h	7
pjmedia/include/pjmedia/endpoint.h	1
pjmedia/build/../src/pjmedia-audiodev/audiodev.c	2
pjmedia/build/../src/pjmedia/audiodev.c	3
pjlib/build/../src/pj/errno.c	1
pjmedia/build/../src/pjmedia-audiodev/errno.c	1
pjmedia/build/../../pjlib/include/pj/string.h	3
pjmedia/build/../src/pjmedia/endpoint.c	4
pjmedia/build/../src/pjmedia/errno.c	1
pjmedia/build/../src/pjmedia/transport_srtp.c	1
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../src/pjmedia/codec.c	12
pjmedia/build/../../pjlib/include/pj/list.h	2
pjlib/build/../src/pj/ioqueue_select.c	10
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_common_abs.c	16
pjlib/build/../src/pj/sock_select.c	5
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/os_error_unix.c	3
pjlib/build/../src/pj/sock_bsd.c	7
pjlib/build/../src/pj/types.c	1
pjmedia/build/../src/pjmedia/g711.c	1
pjlib/build/../src/pj/array.c	1
pjmedia/build/../src/pjmedia-codec/gsm.c	1
pjmedia/build/../src/pjmedia-codec/ilbc.c	1
pjlib/include/pj/string.h	2
pjmedia/include/pjmedia/codec.h	5

Fuzzer: fuzz-dns

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	37	15.2%
gold	[1:9]	65	26.7%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	141	58.0%
All colors	243	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
4	233	reset_pool	call site: 00233	pj_log_4
2	7	pj_log_init	call site: 00007	pj_thread_local_free
2	11	pj_log_init	call site: 00011	pj_thread_local_free
2	22	pj_thread_local_get	call site: 00022	pj_log_4
1	32	pj_gettimeofday	call site: 00032	__errno_location
1	35	pj_time_decode	call site: 00035	pj_ansi_strxcpy
1	47	pj_log	call site: 00047	pj_thread_this
1	57	log_get_raw_indent	call site: 00057	pj_memset
1	59	pj_log	call site: 00059	snprintf
1	68	pj_thread_register	call site: 00068	snprintf

Runtime coverage analysis

Covered functions

87

Functions that are reachable but not covered

32

Reachable functions

107

Percentage of reachable functions covered

70.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-dns.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	13
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjlib-util/build/../src/pjlib-util/dns.c	5
pjlib-util/build/../../pjlib/include/pj/pool.h	1
pjlib-util/build/../../pjlib/include/pj/string.h	1
pjlib/build/../src/pj/sock_bsd.c	3

Fuzzer: fuzz-auth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1021	51.8%
gold	[1:9]	420	21.3%
yellow	[10:29]	19	0.96%
greenyellow	[30:49]	5	0.25%
lawngreen	50+	504	25.5%
All colors	1969	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
171	1797	pj_ioqueue_poll	call site: 01797	ioqueue_dispatch_read_event
107	1577	test_auth_server_verify	call site: 01577	pjsip_auth_srv_verify
90	160	pjsip_endpt_create	call site: 00160	pjsip_get_status_text
80	1685	LLVMFuzzerTestOneInput	call site: 01685	test_auth_server_challenge
45	1321	pjsip_endpt_release_pool	call site: 01321	pjsip_endpt_unregister_module
45	1490	pjsip_param_clone	call site: 01490	parse_multipart_part
43	1244	pj_list_erase	call site: 01244	tx_data_destroy
36	1206	unlock_timer_heap	call site: 01206	cancel
32	828	pjsip_auth_init_parser	call site: 00828	int_parse_hdr_authorization
32	1117	pjsip_msg_find_hdr	call site: 01117	pjsip_endpt_process_rx_data
30	871	pjsip_auth_init_parser	call site: 00871	int_parse_hdr_authenticate
28	1088	pjsip_endpt_create	call site: 01088	pj_log_1

Runtime coverage analysis

Covered functions

280

Functions that are reachable but not covered

256

Reachable functions

525

Percentage of reachable functions covered

51.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-auth.c	5
pjlib/build/../src/pj/os_core_unix.c	33
pjlib/build/../src/pj/log.c	21
pjlib/build/../include/pj/string_i.h	12
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	10
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	7
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../src/pj/pool_caching.c	1
pjlib/build/../include/pj/list.h	3
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	5
pjlib/build/../include/pj/list_i.h	8
pjlib/build/../src/pj/lock.c	22
pjlib/build/../include/pj/pool_i.h	7
pjsip/build/..sip_endpoint.c	17
pjlib/build/../src/pj/errno.c	7
pjsip/build/..sip_errno.c	1
pjsip/build/..sip_msg.c	50
pjsip/build/../../pjlib/include/pj/string.h	8
pjsip/build/../../pjlib/include/pj/pool.h	1
pjsip/build/../../pjlib/include/pj/list.h	3
pjsip/build/..sip_parser.c	66
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	3
pjlib-util/build/../../pjlib/include/pj/string.h	6
pjlib-util/build/../src/pjlib-util/scanner.c	20
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjsip/build/..sip_uri.c	7
pjlib-util/build/../src/pjlib-util/string.c	1
pjlib-util/build/../../pjlib/include/pj/ctype.h	2
pjlib/build/../include/pj/ctype.h	6
pjsip/build/../../pjlib-util/include/pjlib-util/scanner.h	3
pjlib/build/../src/pj/hash.c	10
pjsip/build/../../pjlib/include/pj/ctype.h	3
pjsip/build/../include/pjsip/print_util.h	1
pjsip/build/..sip_auth_parser.c	11
pjsip/build/..sip_auth_msg.c	4
pjsip/build/..sip_tel_uri.c	3
pjlib/build/../src/pj/sock_bsd.c	8
pjsip/build/../include/pjsip/sip_config.h	1
pjlib/build/../src/pj/timer.c	22
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_select.c	10
pjlib/build/../src/pj/ioqueue_common_abs.c	17
pjlib/build/../src/pj/sock_select.c	5
pjsip/build/..sip_transport.c	15
pjlib/build/../src/pj/os_error_unix.c	4
pjsip/build/..sip_resolve.c	1
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/types.c	1
pjsip/build/..sip_auth_server.c	5
pjlib/include/pj/string.h	2
pjlib/include/pj/list.h	1
pjsip/build/..sip_multipart.c	5
pjlib/build/../src/pj/guid.c	1
pjsip/build/..sip_auth_client.c	5
pjlib-util/build/../src/pjlib-util/md5.c	4
pjsip/build/..sip_util.c	1
pjsip/build/../include/pjsip/sip_msg.h	1

Fuzzer: fuzz-crypto

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	9	10.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	4	4.87%
lawngreen	50+	69	84.1%
All colors	82	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
3	34	md5_differential	call site: 00034	pj_memcpy
1	17	encode_base64_differential	call site: 00017	abort
1	19	encode_base64_differential	call site: 00019	abort
1	28	encode_base64_differential	call site: 00028	abort
1	52	md5_differential	call site: 00052	abort
1	73	sha1_differential	call site: 00073	abort
1	80	crc32_differential	call site: 00080	abort

Runtime coverage analysis

Covered functions

27

Functions that are reachable but not covered

16

Reachable functions

43

Percentage of reachable functions covered

62.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-crypto.c	6
pjlib-util/build/../src/pjlib-util/base64.c	6
pjlib-util/build/../src/pjlib-util/md5.c	4
pjlib-util/build/../../pjlib/include/pj/string.h	3
pjlib-util/build/../src/pjlib-util/sha1.c	4
pjlib-util/build/../src/pjlib-util/crc32.c	4

Fuzzer: fuzz-rtcp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	84	21.5%
gold	[1:9]	64	16.4%
yellow	[10:29]	3	0.76%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	239	61.2%
All colors	390	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
9	207	pj_sem_wait	call site: 00207	pjmedia_event_mgr_destroy
6	314	pjlib_error	call site: 00314	platform_strerror
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
4	286	pjmedia_rtcp_get_ntp_time	call site: 00286	pj_log_5
4	337	pjmedia_event_publish	call site: 00337	event_queue_add_event
4	380	reset_pool	call site: 00380	pj_log_4
3	179	pj_thread_create	call site: 00179	pj_mutex_create_simple
3	193	thread_main	call site: 00193	pj_mutex_lock
2	7	pj_log_init	call site: 00007	pj_thread_local_free
2	11	pj_log_init	call site: 00011	pj_thread_local_free
2	22	pj_thread_local_get	call site: 00022	pj_log_4

Runtime coverage analysis

Covered functions

126

Functions that are reachable but not covered

47

Reachable functions

162

Percentage of reachable functions covered

70.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-rtcp.c	3
pjlib/build/../src/pj/os_core_unix.c	29
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjmedia/build/../src/pjmedia/event.c	8
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/list.h	1
pjlib/build/../include/pj/pool.h	1
pjmedia/build/../src/pjmedia/rtcp.c	9
pjmedia/build/../../pjlib/include/pj/string.h	4
pjlib/build/../src/pj/sock_bsd.c	4
pjmedia/build/../../pjlib/include/pj/math.h	2
pjlib/build/../src/pj/errno.c	5
pjlib/build/../src/pj/os_error_unix.c	1
pjmedia/build/../src/pjmedia/rtcp_fb.c	4
pjmedia/build/../include/pjmedia/types.h	1

Fuzzer: fuzz-video

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	41	17.0%
gold	[1:9]	93	38.5%
yellow	[10:29]	2	0.82%
greenyellow	[30:49]	1	0.41%
lawngreen	50+	104	43.1%
All colors	241	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	36	pj_ansi_strxcpy	call site: 00036	pj_ansi_strxcpy
4	48	pj_thread_this	call site: 00048	pj_thread_get_name
3	184	pjmedia_h264_packetize	call site: 00184	pj_log_2
2	6	pj_log_init	call site: 00006	pj_thread_local_free
2	10	pj_log_init	call site: 00010	pj_thread_local_free
2	21	pj_thread_local_get	call site: 00021	pj_log_4
2	189	pjmedia_h264_packetize	call site: 00189	pj_log_2
1	31	pj_gettimeofday	call site: 00031	__errno_location
1	34	pj_time_decode	call site: 00034	pj_ansi_strxcpy
1	46	pj_log	call site: 00046	pj_thread_this
1	56	log_get_raw_indent	call site: 00056	pj_memset
1	58	pj_log	call site: 00058	snprintf

Runtime coverage analysis

Covered functions

93

Functions that are reachable but not covered

30

Reachable functions

108

Percentage of reachable functions covered

72.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-video.c	6
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	1
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	1
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	4
pjlib/build/../include/pj/list_i.h	1
pjlib/build/../src/pj/lock.c	2
pjlib/build/../include/pj/pool_i.h	7
pjlib/include/pj/string.h	2
pjmedia/build/../src/pjmedia-codec/h264_packetizer.c	4
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../../pjlib/include/pj/string.h	3
pjmedia/build/../src/pjmedia-codec/h263_packetizer.c	5
pjmedia/build/../src/pjmedia-codec/vpx_packetizer.c	4

Fuzzer: fuzz-url

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	62	24.2%
gold	[1:9]	83	32.4%
yellow	[10:29]	6	2.34%
greenyellow	[30:49]	3	1.17%
lawngreen	50+	102	39.8%
All colors	256	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
10	240	LLVMFuzzerTestOneInput	call site: 00240	pj_log_4
8	139	pj_pool_alloc_from_block	call site: 00139	pj_pool_allocate_find
7	163	pj_throw_exception_	call site: 00163	pj_log_1
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
2	7	pj_log_init	call site: 00007	pj_thread_local_free
2	11	pj_log_init	call site: 00011	pj_thread_local_free
2	22	pj_thread_local_get	call site: 00022	pj_log_4
2	215	pj_http_req_parse_url	call site: 00215	pj_scan_skip_whitespace
1	32	pj_gettimeofday	call site: 00032	__errno_location
1	35	pj_time_decode	call site: 00035	pj_ansi_strxcpy
1	47	pj_log	call site: 00047	pj_thread_this

Runtime coverage analysis

Covered functions

84

Functions that are reachable but not covered

44

Reachable functions

125

Percentage of reachable functions covered

64.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-url.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	4
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	4
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	3
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	3
pjlib-util/build/../src/pjlib-util/http_client.c	4
pjlib-util/build/../../pjlib/include/pj/string.h	4
pjlib-util/build/../src/pjlib-util/scanner.c	9
pjlib-util/build/../include/pjlib-util/scanner.h	1
pjlib/build/../include/pj/ctype.h	1

Fuzzer: fuzz-uri

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	362	42.6%
gold	[1:9]	69	8.12%
yellow	[10:29]	10	1.17%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	408	48.0%
All colors	849	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
42	668	init_parser	call site: 00668	int_parse_via_param
30	719	pj_pool_calloc	call site: 00719	int_parse_hdr_authorization
30	760	pjsip_auth_init_parser	call site: 00760	int_parse_hdr_authenticate
22	477	int_parse_uri_or_name_addr	call site: 00477	int_parse_contact_param
18	402	init_parser	call site: 00402	parse_generic_array_hdr
15	586	init_parser	call site: 00586	parse_hdr_rr_route
14	512	init_parser	call site: 00512	int_parse_param
14	625	init_parser	call site: 00625	strtoi_validate
13	554	init_parser	call site: 00554	parse_hdr_fromto
11	529	init_parser	call site: 00529	strtoi_validate
10	604	init_parser	call site: 00604	parse_hdr_rr_route
9	440	init_parser	call site: 00440	int_parse_uri_or_name_addr

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

132

Reachable functions

272

Percentage of reachable functions covered

51.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-uri.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	3
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	8
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	7
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjsip/build/..sip_parser.c	57
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	3
pjlib-util/build/../../pjlib/include/pj/string.h	4
pjlib-util/build/../src/pjlib-util/scanner.c	18
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjsip/build/..sip_uri.c	5
pjsip/build/../../pjlib/include/pj/string.h	5
pjsip/build/../../pjlib/include/pj/list.h	2
pjlib-util/build/../src/pjlib-util/string.c	1
pjlib-util/build/../../pjlib/include/pj/ctype.h	2
pjlib/build/../include/pj/ctype.h	4
pjsip/build/../../pjlib-util/include/pjlib-util/scanner.h	2
pjlib/build/../src/pj/hash.c	1
pjsip/build/../../pjlib/include/pj/ctype.h	1
pjsip/build/..sip_msg.c	39
pjsip/build/../include/pjsip/print_util.h	1
pjsip/build/..sip_auth_parser.c	11
pjsip/build/..sip_auth_msg.c	4
pjsip/build/../../pjlib/include/pj/pool.h	1

Fuzzer: fuzz-sip-dialog

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	408	25.6%
gold	[1:9]	104	6.54%
yellow	[10:29]	85	5.34%
greenyellow	[30:49]	10	0.62%
lawngreen	50+	983	61.8%
All colors	1590	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
155	1432	pj_get_os_error	call site: 01432	ioqueue_dispatch_read_event
28	684	pjsip_auth_clt_init_req	call site: 00684	pj_log_5
20	883	pjsip_parse_headers	call site: 00883	pj_perror_2
16	1370	dlg_beautify_response	call site: 01370	pjsip_msg_find_hdr_by_name
6	8	pj_thread_local_get	call site: 00008	pj_log_1
6	650	pjsip_msg_find_hdr	call site: 00650	pj_pool_alloc
6	1018	tsx_on_destroy	call site: 01018	pj_grp_lock_create_w_handler
5	491	schedule_entry	call site: 00491	grow_heap
5	638	init_request_throw	call site: 00638	pjsip_generic_string_hdr_create
4	38	pj_thread_this	call site: 00038	pj_thread_get_name
4	645	init_request_throw	call site: 00645	get_msg_info
4	872	pjsip_parse_headers	call site: 00872	pj_log_4

Runtime coverage analysis

Covered functions

499

Functions that are reachable but not covered

100

Reachable functions

421

Percentage of reachable functions covered

76.25%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-sip-dialog.c	4
pjsip/build/..sip_endpoint.c	11
pjlib/build/../include/pj/pool_i.h	7
pjlib/build/../src/pj/pool.c	3
pjlib/build/../src/pj/except.c	5
pjlib/build/../src/pj/os_core_unix.c	23
pjlib/build/../src/pj/log.c	16
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	8
pjlib/build/../include/pj/string.h	4
pjlib/build/../include/pj/list_i.h	6
pjlib/include/pj/string.h	2
pjsip/build/..sip_ua_layer.c	5
pjsip/build/..sip_dialog.c	22
pjsip/build/../../pjlib/include/pj/string.h	5
pjsip/build/../../pjlib/include/pj/pool.h	1
pjsip/build/../../pjlib/include/pj/list.h	3
pjsip/build/..sip_auth_client.c	4
pjlib/build/../src/pj/lock.c	26
pjlib/build/../include/pj/pool.h	1
pjlib/build/../include/pj/list.h	3
pjsip/build/../include/pjsip/sip_util.h	1
pjlib/build/../include/pj/string_i.h	11
pjsip/build/..sip_parser.c	22
pjlib-util/build/../src/pjlib-util/scanner.c	13
pjsip/build/..sip_uri.c	4
pjlib-util/build/../../pjlib/include/pj/string.h	3
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjlib/build/../include/pj/ctype.h	4
pjsip/build/../../pjlib-util/include/pjlib-util/scanner.h	3
pjsip/build/../include/pjsip/sip_uri.h	5
pjlib/build/../src/pj/hash.c	8
pjsip/build/..sip_msg.c	33
pjsip/build/../include/pjsip/print_util.h	1
pjsip/build/..sip_util.c	6
pjlib/build/../src/pj/guid.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjsip/build/..sip_transport.c	16
pjlib/build/../src/pj/timer.c	19
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/types.c	1
pjlib/include/pj/list.h	2
pjlib/build/../src/pj/ioqueue_common_abs.c	13
pjsip/build/../include/pjsip/sip_msg.h	2
pjsip/build/../include/pjsip/sip_config.h	1
pjsip/build/..sip_auth_msg.c	1
pjsip/build/..sip_multipart.c	5
pjsip/build/../../pjlib/include/pj/ctype.h	1
pjlib/build/../src/pj/errno.c	5
pjlib/build/../src/pj/os_error_unix.c	4
pjsip/build/..sip_transaction.c	20
pjlib/build/../src/pj/ioqueue_select.c	7
pjlib/build/../src/pj/sock_select.c	4
pjlib/build/../src/pj/sock_bsd.c	7

Fuzzer: fuzz-sip-transaction

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1030	42.1%
gold	[1:9]	513	21.0%
yellow	[10:29]	23	0.94%
greenyellow	[30:49]	7	0.28%
lawngreen	50+	868	35.5%
All colors	2441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
154	2046	pj_ioqueue_poll	call site: 02046	ioqueue_dispatch_read_event
53	1482	pj_push_exception_handler_	call site: 01482	pjsip_parse_rdata
45	1328	pjsip_endpt_release_pool	call site: 01328	pjsip_endpt_unregister_module
36	1641	pj_create_unique_string	call site: 01641	parse_multipart_part
32	835	pjsip_auth_init_parser	call site: 00835	int_parse_hdr_authorization
30	878	pjsip_auth_init_parser	call site: 00878	int_parse_hdr_authenticate
28	1095	pjsip_endpt_create	call site: 01095	pj_log_1
27	1822	tsx_update_transport	call site: 01822	pjsip_transport_dec_ref
25	1901	pj_grp_lock_release	call site: 01901	tsx_shutdown
22	1937	mod_tsx_layer_register_tsx	call site: 01937	tsx_shutdown
21	1709	int_parse_msg	call site: 01709	pjsip_endpt_cancel_timer
20	1981	pjsip_msg_add_hdr	call site: 01981	pjsip_tx_data_dec_ref

Runtime coverage analysis

Covered functions

411

Functions that are reachable but not covered

224

Reachable functions

599

Percentage of reachable functions covered

62.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-sip-transaction.c	7
pjlib/build/../src/pj/log.c	21
pjlib/build/../src/pj/os_core_unix.c	39
pjlib/build/../include/pj/string_i.h	14
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	9
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	7
pjlib/build/../src/pj/guid_simple.c	3
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib-util/build/../src/pjlib-util/errno.c	2
pjlib/build/../src/pj/errno.c	7
pjlib/build/../src/pj/pool_caching.c	1
pjlib/build/../include/pj/list.h	3
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	5
pjlib/build/../include/pj/list_i.h	8
pjlib/build/../src/pj/lock.c	26
pjlib/build/../include/pj/pool_i.h	7
pjsip/build/..sip_endpoint.c	20
pjsip/build/..sip_errno.c	1
pjsip/build/..sip_msg.c	56
pjsip/build/../../pjlib/include/pj/string.h	9
pjsip/build/../../pjlib/include/pj/pool.h	1
pjsip/build/../../pjlib/include/pj/list.h	3
pjsip/build/..sip_parser.c	70
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	3
pjlib-util/build/../../pjlib/include/pj/string.h	5
pjlib-util/build/../src/pjlib-util/scanner.c	21
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjsip/build/..sip_uri.c	7
pjlib-util/build/../src/pjlib-util/string.c	1
pjlib-util/build/../../pjlib/include/pj/ctype.h	2
pjlib/build/../include/pj/ctype.h	5
pjsip/build/../../pjlib-util/include/pjlib-util/scanner.h	3
pjlib/build/../src/pj/hash.c	12
pjsip/build/../../pjlib/include/pj/ctype.h	2
pjsip/build/../include/pjsip/print_util.h	1
pjsip/build/..sip_auth_parser.c	11
pjsip/build/..sip_auth_msg.c	4
pjsip/build/..sip_tel_uri.c	3
pjlib/build/../src/pj/sock_bsd.c	8
pjsip/build/../include/pjsip/sip_config.h	1
pjlib/build/../src/pj/timer.c	23
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_select.c	10
pjlib/build/../src/pj/ioqueue_common_abs.c	17
pjlib/build/../src/pj/sock_select.c	5
pjsip/build/..sip_transport.c	29
pjlib/build/../src/pj/os_error_unix.c	4
pjsip/build/..sip_resolve.c	1
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/types.c	1
pjsip/build/..sip_transaction.c	23
pjsip/build/..sip_transport_loop.c	2
pjsip/build/..sip_multipart.c	5
pjlib/build/../src/pj/guid.c	1
pjlib/include/pj/string.h	2
pjlib/include/pj/list.h	1
pjsip/build/..sip_util.c	10
pjsip/build/../include/pjsip/sip_msg.h	2
pjsip/build/../include/pjsip/sip_uri.h	3

Fuzzer: fuzz-sip

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	755	31.3%
gold	[1:9]	443	18.3%
yellow	[10:29]	19	0.78%
greenyellow	[30:49]	4	0.16%
lawngreen	50+	1191	49.3%
All colors	2412	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	171	pjsip_endpt_create	call site: 00171	pjsip_get_status_text
53	1483	pj_push_exception_handler_	call site: 01483	pjsip_parse_rdata
47	1275	tx_data_destroy	call site: 01275	pjsip_transport_dec_ref
45	1329	pjsip_endpt_release_pool	call site: 01329	pjsip_endpt_unregister_module
33	1196	pjsip_endpt_create	call site: 01196	pjsip_tpmgr_destroy
32	1125	pjsip_msg_find_hdr	call site: 01125	pjsip_endpt_process_rx_data
31	1955	do_test_transaction_layer	call site: 01955	pjsip_tsx_layer_find_tsx
28	1096	pjsip_endpt_create	call site: 01096	pj_log_1
22	2040	pjsip_auth_clt_init_req	call site: 02040	pjsip_authorization_hdr_create
20	1711	int_parse_msg	call site: 01711	pjsip_endpt_cancel_timer
15	1252	pj_list_erase	call site: 01252	tx_data_destroy
14	747	init_parser	call site: 00747	strtoi_validate

Runtime coverage analysis

Covered functions

450

Functions that are reachable but not covered

168

Reachable functions

585

Percentage of reachable functions covered

71.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-sip.c	9
pjlib/build/../src/pj/log.c	21
pjlib/build/../src/pj/os_core_unix.c	39
pjlib/build/../include/pj/string_i.h	15
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	9
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	7
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib-util/build/../src/pjlib-util/errno.c	2
pjlib/build/../src/pj/errno.c	7
pjlib/build/../src/pj/pool_caching.c	1
pjlib/build/../include/pj/list.h	2
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	5
pjlib/build/../include/pj/list_i.h	9
pjlib/build/../src/pj/lock.c	21
pjlib/build/../include/pj/pool_i.h	8
pjsip/build/..sip_endpoint.c	18
pjsip/build/..sip_errno.c	1
pjsip/build/..sip_msg.c	56
pjsip/build/../../pjlib/include/pj/string.h	10
pjsip/build/../../pjlib/include/pj/pool.h	1
pjsip/build/../../pjlib/include/pj/list.h	3
pjsip/build/..sip_parser.c	70
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	3
pjlib-util/build/../../pjlib/include/pj/string.h	6
pjlib-util/build/../src/pjlib-util/scanner.c	21
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjsip/build/..sip_uri.c	8
pjlib-util/build/../src/pjlib-util/string.c	1
pjlib-util/build/../../pjlib/include/pj/ctype.h	2
pjlib/build/../include/pj/ctype.h	5
pjsip/build/../../pjlib-util/include/pjlib-util/scanner.h	3
pjlib/build/../src/pj/hash.c	13
pjsip/build/../../pjlib/include/pj/ctype.h	3
pjsip/build/../include/pjsip/print_util.h	1
pjsip/build/..sip_auth_parser.c	11
pjsip/build/..sip_auth_msg.c	4
pjsip/build/..sip_tel_uri.c	3
pjlib/build/../src/pj/sock_bsd.c	3
pjsip/build/../include/pjsip/sip_config.h	1
pjlib/build/../src/pj/timer.c	21
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_select.c	4
pjlib/build/../src/pj/ioqueue_common_abs.c	5
pjlib/build/../src/pj/sock_select.c	1
pjsip/build/..sip_transport.c	29
pjlib/build/../src/pj/os_error_unix.c	3
pjsip/build/..sip_resolve.c	1
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/types.c	1
pjsip/build/..sip_transaction.c	7
pjsip/build/..sip_transport_loop.c	2
pjsip/build/..sip_multipart.c	8
pjlib/build/../src/pj/guid.c	1
pjsip/build/..sip_ua_layer.c	6
pjlib/include/pj/string.h	2
pjsip/build/..sip_util.c	4
pjsip/build/../include/pjsip/sip_msg.h	2
pjsip/build/../include/pjsip/sip_uri.h	5
pjlib/include/pj/list.h	3
pjsip/build/..sip_auth_client.c	19
pjlib-util/build/../src/pjlib-util/md5.c	4
pjsip/build/..sip_dialog.c	9
pjsip/build/../include/pjsip/sip_util.h	1
pjsip/include/pjsip/sip_uri.h	1

Fuzzer: fuzz-xml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	47	15.7%
gold	[1:9]	72	24.1%
yellow	[10:29]	3	1.00%
greenyellow	[30:49]	1	0.33%
lawngreen	50+	175	58.7%
All colors	298	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	164	pj_throw_exception_	call site: 00164	pj_log_1
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
4	288	reset_pool	call site: 00288	pj_log_4
3	264	xml_parse_node	call site: 00264	pj_log_4
2	7	pj_log_init	call site: 00007	pj_thread_local_free
2	11	pj_log_init	call site: 00011	pj_thread_local_free
2	22	pj_thread_local_get	call site: 00022	pj_log_4
1	32	pj_gettimeofday	call site: 00032	__errno_location
1	35	pj_time_decode	call site: 00035	pj_ansi_strxcpy
1	47	pj_log	call site: 00047	pj_thread_this
1	57	log_get_raw_indent	call site: 00057	pj_memset

Runtime coverage analysis

Covered functions

103

Functions that are reachable but not covered

38

Reachable functions

130

Percentage of reachable functions covered

70.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-xml.c	2
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	2
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjlib-util/build/../src/pjlib-util/xml.c	7
pjlib-util/build/../src/pjlib-util/scanner.c	10
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjlib-util/build/../../pjlib/include/pj/string.h	2
pjlib-util/build/../../pjlib/include/pj/pool.h	1
pjlib-util/build/../../pjlib/include/pj/list.h	2
pjlib/include/pj/pool.h	1

Fuzzer: fuzz-presence

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	54	13.9%
gold	[1:9]	71	18.3%
yellow	[10:29]	2	0.51%
greenyellow	[30:49]	22	5.69%
lawngreen	50+	237	61.3%
All colors	386	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
7	182	pj_throw_exception_	call site: 00182	pj_log_1
5	36	pj_ansi_strxcpy	call site: 00036	pj_ansi_strxcpy
4	48	pj_thread_this	call site: 00048	pj_thread_get_name
4	163	reset_pool	call site: 00163	pj_log_4
3	282	xml_parse_node	call site: 00282	pj_log_4
2	6	pj_log_init	call site: 00006	pj_thread_local_free
2	10	pj_log_init	call site: 00010	pj_thread_local_free
2	21	pj_thread_local_get	call site: 00021	pj_log_4
2	156	pj_pool_create	call site: 00156	pj_caching_pool_destroy
2	173	LLVMFuzzerTestOneInput	call site: 00173	pj_caching_pool_destroy
1	31	pj_gettimeofday	call site: 00031	__errno_location
1	34	pj_time_decode	call site: 00034	pj_ansi_strxcpy

Runtime coverage analysis

Covered functions

128

Functions that are reachable but not covered

38

Reachable functions

155

Percentage of reachable functions covered

75.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-presence.c	1
pjlib/build/../src/pj/os_core_unix.c	16
pjlib/build/../src/pj/log.c	14
pjlib/build/../include/pj/string_i.h	5
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	4
pjlib/build/../include/pj/string.h	4
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	1
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	1
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	4
pjlib/build/../include/pj/pool_i.h	7
pjsip/build/../src/pjsip-simple/pidf.c	8
pjlib-util/build/../src/pjlib-util/xml.c	10
pjlib-util/build/../src/pjlib-util/scanner.c	10
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjlib-util/build/../../pjlib/include/pj/string.h	2
pjlib-util/build/../../pjlib/include/pj/pool.h	1
pjlib-util/build/../../pjlib/include/pj/list.h	2
pjsip/build/../src/pjsip-simple/rpid.c	4
pjsip/build/../../pjlib/include/pj/string.h	1
pjsip/build/../src/pjsip-simple/xpidf.c	4
pjsip/build/../src/pjsip-simple/dialog_info.c	1
pjsip/build/../src/pjsip-simple/iscomposing.c	1
pjlib/build/../include/pj/ctype.h	1

Fuzzer: fuzz-sdes

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	375	34.0%
gold	[1:9]	84	7.63%
yellow	[10:29]	12	1.09%
greenyellow	[30:49]	5	0.45%
lawngreen	50+	624	56.7%
All colors	1100	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
68	411	grp_lock_acquire	call site: 00411	ioqueue_dispatch_write_event
46	360	grp_lock_dec_ref	call site: 00360	ioqueue_dispatch_read_event_no_lock
26	296	pj_get_os_error	call site: 00296	increment_counter
11	326	pj_atomic_inc	call site: 00326	ioqueue_dispatch_read_event
10	627	srtp_auth_type_test	call site: 00627	srtp_crypto_kernel_list_debug_modules
8	534	srtp_cipher_type_test	call site: 00534	srtp_err_report
8	558	srtp_cipher_type_test	call site: 00558	srtp_err_report
7	168	pj_strncpy_with_null	call site: 00168	pjmedia_aud_driver_init
7	338	grp_lock_set_owner_thread	call site: 00338	pj_ioqueue_unlock_key
7	521	srtp_cipher_type_test	call site: 00521	srtp_err_report
7	817	pj_throw_exception_	call site: 00817	pj_log_1
6	609	srtp_cipher_type_test	call site: 00609	srtp_auth_type_self_test

Runtime coverage analysis

Covered functions

357

Functions that are reachable but not covered

106

Reachable functions

353

Percentage of reachable functions covered

69.97%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-sdes.c	2
pjlib/build/../src/pj/os_core_unix.c	32
pjlib/build/../src/pj/log.c	15
pjlib/build/../include/pj/string_i.h	7
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	7
pjlib/build/../include/pj/string.h	6
pjlib/build/../src/pj/except.c	6
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	3
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	6
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	24
pjlib/build/../include/pj/pool_i.h	8
pjmedia/include/pjmedia/endpoint.h	2
pjmedia/build/../src/pjmedia-audiodev/audiodev.c	2
pjmedia/build/../src/pjmedia/audiodev.c	3
pjlib/build/../src/pj/errno.c	7
pjmedia/build/../src/pjmedia-audiodev/errno.c	1
pjmedia/build/../../pjlib/include/pj/string.h	3
pjmedia/build/../src/pjmedia/endpoint.c	6
pjmedia/build/../src/pjmedia/errno.c	1
pjmedia/build/../src/pjmedia/transport_srtp.c	9
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../src/pjmedia/codec.c	2
pjmedia/build/../../pjlib/include/pj/list.h	2
pjlib/build/../src/pj/ioqueue_select.c	10
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_common_abs.c	16
pjlib/build/../src/pj/sock_select.c	5
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/os_error_unix.c	4
pjlib/build/../src/pj/sock_bsd.c	7
pjlib/build/../src/pj/types.c	1
third_party/build/srtp/../../srtp/srtp/srtp.c	2
third_party/build/srtp/../../srtp/crypto/kernel/crypto_kernel.c	9
third_party/build/srtp/../../srtp/pjlib/srtp_err.c	2
third_party/build/srtp/../../srtp/crypto/cipher/cipher.c	12
third_party/build/srtp/../../srtp/crypto/math/datatypes.c	4
third_party/build/srtp/../../srtp/crypto/hash/auth.c	2
third_party/build/srtp/../../srtp/crypto/kernel/alloc.c	2
pjmedia/build/../src/pjmedia/transport_loop.c	4
pjmedia/build/../src/pjmedia/transport_srtp_sdes.c	1
pjlib/include/pj/string.h	1
pjmedia/build/../src/pjmedia/sdp.c	21
pjlib-util/build/../src/pjlib-util/scanner_cis_bitwise.c	2
pjlib-util/build/../../pjlib/include/pj/string.h	3
pjlib-util/build/../src/pjlib-util/scanner.c	15
pjmedia/build/../../pjlib-util/include/pjlib-util/scanner.h	2
pjlib-util/build/../include/pjlib-util/scanner.h	2
pjlib/build/../include/pj/ctype.h	3
pjlib/build/../src/pj/array.c	1
pjmedia/build/../../pjlib/include/pj/ctype.h	1
pjlib/include/pj/pool.h	1
pjmedia/include/pjmedia/transport.h	4

Fuzzer: fuzz-audio

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	297	46.6%
gold	[1:9]	235	36.8%
yellow	[10:29]	22	3.45%
greenyellow	[30:49]	34	5.33%
lawngreen	50+	49	7.69%
All colors	637	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
205	297	pj_get_os_error	call site: 00297	ioqueue_dispatch_read_event
12	165	pjmedia_aud_subsys_init	call site: 00165	pjmedia_aud_driver_init
7	180	pjmedia_endpt_create2	call site: 00180	pj_strncpy_with_null
6	222	pj_lock_create_recursive_mutex	call site: 00222	pj_mutex_destroy
5	37	pj_ansi_strxcpy	call site: 00037	pj_ansi_strxcpy
5	283	pj_elapsed_time	call site: 00283	pj_list_erase
4	49	pj_thread_this	call site: 00049	pj_thread_get_name
4	542	pjmedia_codec_mgr_register_factory	call site: 00542	swap_codec
3	256	thread_main	call site: 00256	pj_mutex_lock
3	520	pjmedia_codec_mgr_register_factory	call site: 00520	pj_log_3
3	572	pjmedia_codec_speex_init	call site: 00572	pj_log_5
3	617	pjmedia_codec_mgr_get_default_param	call site: 00617	pj_mutex_unlock

Runtime coverage analysis

Covered functions

420

Functions that are reachable but not covered

111

Reachable functions

244

Percentage of reachable functions covered

54.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-audio.c	4
pjlib/build/../src/pj/os_core_unix.c	30
pjlib/build/../src/pj/log.c	15
pjlib/build/../include/pj/string_i.h	6
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	3
pjlib/build/../include/pj/string.h	5
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../src/pj/pool_caching.c	1
pjlib/build/../include/pj/list.h	3
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	4
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	20
pjlib/build/../include/pj/pool_i.h	7
pjmedia/include/pjmedia/endpoint.h	1
pjmedia/build/../src/pjmedia-audiodev/audiodev.c	2
pjmedia/build/../src/pjmedia/audiodev.c	3
pjlib/build/../src/pj/errno.c	1
pjmedia/build/../src/pjmedia-audiodev/errno.c	1
pjmedia/build/../../pjlib/include/pj/string.h	3
pjmedia/build/../src/pjmedia/endpoint.c	4
pjmedia/build/../src/pjmedia/errno.c	1
pjmedia/build/../src/pjmedia/transport_srtp.c	1
pjmedia/build/../../pjlib/include/pj/pool.h	1
pjmedia/build/../src/pjmedia/codec.c	12
pjmedia/build/../../pjlib/include/pj/list.h	2
pjlib/build/../src/pj/ioqueue_select.c	10
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_common_abs.c	16
pjlib/build/../src/pj/sock_select.c	5
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/os_error_unix.c	3
pjlib/build/../src/pj/sock_bsd.c	7
pjlib/build/../src/pj/types.c	1
pjmedia/build/../src/pjmedia/g711.c	1
pjlib/build/../src/pj/array.c	1
pjmedia/build/../src/pjmedia-codec/g722.c	1
pjmedia/build/../src/pjmedia-codec/gsm.c	1
pjmedia/build/../src/pjmedia-codec/speex_codec.c	2
third_party/build/speex/../../speex/libspeex/modes_wb.c	1
third_party/build/speex/../../speex/libspeex/speex.c	3
pjmedia/build/../src/pjmedia-codec/ilbc.c	1
pjmedia/build/../src/pjmedia-codec/l16.c	1
pjmedia/include/pjmedia/codec.h	5
pjlib/include/pj/string.h	1

Fuzzer: fuzz-stun

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1212	52.4%
gold	[1:9]	73	3.16%
yellow	[10:29]	11	0.47%
greenyellow	[30:49]	7	0.30%
lawngreen	50+	1007	43.5%
All colors	2310	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
130	2020	pj_ice_strans_create	call site: 02020	pj_ice_sess_update_check_list
103	1177	pj_sockaddr_init	call site: 01177	dns_srv_resolver_cb
102	986	pj_inet_pton	call site: 00986	pj_dns_srv_resolve
74	1911	add_stun_and_host	call site: 01911	add_update_turn
53	874	pj_sockaddr_set_port	call site: 00874	refresh_permissions
42	1314	pj_turn_session_sendto	call site: 01314	pj_turn_session_set_perm
40	1715	pj_stun_sock_destroy	call site: 01715	pj_stun_sock_start
35	793	pj_log_pop_indent	call site: 00793	sess_shutdown
32	1104	ioqueue_add_to_set2	call site: 01104	dns_callback
27	765	dump_tx_msg	call site: 00765	pj_stun_client_tsx_send_msg
24	740	dump_tx_msg	call site: 00740	pj_sockaddr_print
24	846	pj_hash_get	call site: 00846	lookup_perm

Runtime coverage analysis

Covered functions

358

Functions that are reachable but not covered

211

Reachable functions

539

Percentage of reachable functions covered

60.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
tests/fuzz/fuzz-stun.c	2
pjlib/build/../src/pj/os_core_unix.c	26
pjlib/build/../src/pj/log.c	19
pjlib/build/../include/pj/string_i.h	10
pjlib/build/../src/pj/os_time_unix.c	1
pjlib/build/../src/pj/os_time_common.c	1
pjlib/build/../src/pj/string.c	4
pjlib/build/../include/pj/string.h	7
pjlib/build/../src/pj/except.c	1
pjlib/build/../src/pj/guid_simple.c	2
pjlib/build/../src/pj/rand.c	1
pjlib/build/../src/pj/os_timestamp_posix.c	2
pjlib/build/../src/pj/pool_caching.c	2
pjlib/build/../include/pj/list.h	3
pjlib/build/../src/pj/pool_buf.c	3
pjlib/build/../src/pj/pool.c	7
pjlib/build/../include/pj/list_i.h	4
pjlib/build/../src/pj/lock.c	24
pjlib/build/../include/pj/pool_i.h	8
pjnath/build/../src/pjnath/stun_msg.c	37
pjlib-util/build/../src/pjlib-util/crc32.c	4
pjnath/build/../../pjlib/include/pj/pool.h	1
pjnath/build/../../pjlib/include/pj/string.h	5
pjlib/build/../src/pj/sock_bsd.c	17
pjlib/build/../src/pj/errno.c	9
pjlib/build/../src/pj/os_error_unix.c	4
pjlib/include/pj/string.h	2
pjnath/build/../src/pjnath/stun_auth.c	8
pjlib-util/build/../src/pjlib-util/md5.c	4
pjlib-util/build/../../pjlib/include/pj/string.h	3
pjlib-util/build/../src/pjlib-util/hmac_sha1.c	3
pjlib-util/build/../src/pjlib-util/sha1.c	4
pjlib/build/../src/pj/sock_common.c	21
pjnath/include/pjnath/stun_config.h	1
pjlib/build/../src/pj/ioqueue_select.c	10
pjlib/build/../include/pj/pool.h	1
pjlib/build/../src/pj/ioqueue_common_abs.c	12
pjlib/build/../src/pj/sock_select.c	4
pjlib/build/../src/pj/timer.c	21
pjnath/build/../src/pjnath/turn_session.c	27
pjlib/build/../src/pj/hash.c	10
pjnath/build/../src/pjnath/stun_session.c	29
pjnath/build/../../pjlib/include/pj/list.h	4
pjnath/build/../src/pjnath/stun_transaction.c	7
pjlib/build/../src/pj/os_timestamp_common.c	4
pjlib/build/../include/pj/os.h	1
pjlib/build/../src/pj/types.c	1
pjnath/build/../src/pjnath/stun_msg_dump.c	3
pjlib/build/../include/pj/ctype.h	2
pjlib-util/build/../src/pjlib-util/srv_resolver.c	5
pjlib-util/build/../../pjlib/include/pj/pool.h	1
pjlib-util/build/../src/pjlib-util/dns.c	3
pjlib-util/build/../src/pjlib-util/resolver.c	9
pjlib-util/build/../../pjlib/include/pj/ctype.h	1
pjlib-util/build/../../pjlib/include/pj/list.h	3
pjlib/build/../src/pj/addr_resolv_sock.c	1
pjnath/build/../src/pjnath/ice_strans.c	24
pjnath/build/../include/pjnath/stun_config.h	2
pjnath/build/../src/pjnath/stun_sock.c	11
pjnath/build/../src/pjnath/turn_sock.c	12
pjnath/build/../src/pjnath/ice_session.c	32
pjlib/build/../src/pj/sock_qos_common.c	3
pjlib/build/../src/pj/sock_qos_bsd.c	2
pjlib/build/../src/pj/activesock.c	5
pjlib/build/../src/pj/ip_helper_generic.c	4
pjnath/build/../../pjlib/include/pj/ip_helper.h	1
pjlib/build/../include/pj/ip_helper.h	1
pjlib/build/../src/pj/array.c	1
pjnath/build/../../pjlib/include/pj/os.h	1