Report generation date: 2026-06-30

Project overview: postgis

High level conclusions

Fuzzers reach 21.08% of cyclomatic complexity.

"No files with coverage data was found. This is either because an error occurred when compiling and running coverage runs, or because the introspector run was intentionally done without coverage collection. In order to get optimal results coverage data is needed.

Reachability and coverage overview

Functions statically reachable by fuzzers

308 / 1483

Cyclomatic complexity statically reachable by fuzzers

1964 / 9314

Runtime code coverage of functions

0 / 1483

Fuzzers overview

Fuzzer	Fuzzer filename	Functions Reached	Functions unreached	Fuzzer depth	Files reached	Basic blocks reached	Cyclomatic complexity	Details
geojson_import_fuzzer	fuzzers/geojson_import_fuzzer.cpp	140	909	9	22	1582	714	geojson_import_fuzzer.cpp
twkb_import_fuzzer	fuzzers/twkb_import_fuzzer.cpp	77	994	8	22	909	399	twkb_import_fuzzer.cpp
wkt_import_fuzzer	fuzzers/wkt_import_fuzzer.cpp	188	936	12	26	3220	1227	wkt_import_fuzzer.cpp
wkb_import_fuzzer	fuzzers/wkb_import_fuzzer.cpp	73	981	9	21	1108	457	wkb_import_fuzzer.cpp
raster_deserialize_fuzzer	fuzzers/raster_deserialize_fuzzer.c	26	1431	3	7	241	121	raster_deserialize_fuzzer.c

Project functions overview

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer details

Fuzzer: geojson_import_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: twkb_import_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: wkt_import_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: wkb_import_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Fuzzer: raster_deserialize_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Full calltree

Call tree overview bitmap:

The project has no code coverage. Will not display blockers as blockers depend on code coverage.

Analyses and suggestions

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
`rt_raster_fully_within_distance`	/src/postgis/raster/rt_core/rt_spatial_relationship.c	6	['N/A', 'int', 'N/A', 'int', 'double', 'N/A']	13	216	42	17	452	0	2590	1685
`lwgeom_mindistance3d`	/src/postgis/liblwgeom/measures3d.c	2	['N/A', 'N/A']	19	18	3	2	335	0	2166	554
`gserialized_cmp`	/src/postgis/liblwgeom/gserialized.c	2	['N/A', 'N/A']	11	359	50	22	146	0	819	371
`lwgeom_to_ewkt`	/src/postgis/liblwgeom/lwgeom.c	1	['N/A']	13	34	6	3	77	0	370	324
`rt_raster_gdal_rasterize`	/src/postgis/raster/rt_core/rt_raster.c	20	['N/A', 'int', 'N/A', 'int', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	9	2429	379	147	137	0	822	308
`lwgeom_distance_spheroid`	/src/postgis/liblwgeom/lwgeodetic.c	4	['N/A', 'N/A', 'N/A', 'double']	10	833	135	49	75	1	509	293
`rt_raster_gdal_contour`	/src/postgis/raster/rt_core/rt_gdal.c	11	['N/A', 'int', 'int', 'N/A', 'double', 'double', 'int', 'N/A', 'int', 'N/A', 'N/A']	10	412	44	18	307	0	1590	205
`lwgeom_subdivide_recursive`	/src/postgis/liblwgeom/lwgeom.c	6	['N/A', 'char', 'int', 'int', 'N/A', 'double']	12	716	105	39	197	3	1222	167
`rt_raster_intersects`	/src/postgis/raster/rt_core/rt_spatial_relationship.c	5	['N/A', 'int', 'N/A', 'int', 'N/A']	10	933	162	61	225	0	1370	157
`lwgeom_covers_lwgeom_sphere`	/src/postgis/liblwgeom/lwgeodetic.c	2	['N/A', 'N/A']	12	393	77	28	87	1	518	127

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

828 / 1483

Cyclomatic complexity statically reachable by fuzzers

5843 / 9314

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzz engine guidance

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.