High level conclusions

Fuzzers reach 54.96% of cyclomatic complexity.

Fuzzers reach 43.56% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

481 / 1104

Cyclomatic complexity statically reachable by fuzzers

3150 / 5731

Runtime code coverage of functions

357 / 1104

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: FuzzIxmlOps

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	86	19.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	362	80.8%
All colors	448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
9	429	check_children	call site: 00429	die
7	306	ixmlPrintDomTreeRecursive	call site: 00306	copy_with_escape
7	329	ixmlPrintDomTreeRecursive	call site: 00329	IxmlPrintf
5	152	ixmlNode_cloneCDATASect	call site: 00152	ixmlNode_newDoc
3	424	LLVMFuzzerTestOneInput	call site: 00424	die
3	440	LLVMFuzzerTestOneInput	call site: 00440	die
2	12	ixmlDocument_createElementEx	call site: 00012	ixmlElement_free
2	30	ixmlDocument_createAttributeEx	call site: 00030	ixmlAttr_free
2	54	ixmlDocument_createCDATASectionEx	call site: 00054	ixmlCDATASection_free
2	284	copy_with_escape	call site: 00284	ixml_membuf_append_str
2	353	ixmlPrintDomTree	call site: 00353	IxmlPrintf
2	380	ixmlDomTreetoString	call site: 00380	IxmlPrintf

Runtime coverage analysis

Covered functions

107

Functions that are reachable but not covered

17

Reachable functions

124

Percentage of reachable functions covered

86.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzIxmlOps.c	11
ixml/src/document.c	9
ixml/src/node.c	38
ixml/src/ixmlparser.c	7
ixml/src/element.c	22
ixml/src/attr.c	2
ixml/src/ixml.c	8
ixml/src/ixmlmembuf.c	5
ixml/src/ixmldebug.c	1
ixml/src/nodeList.c	3
ixml/src/namedNodeMap.c	7

Fuzzer: FuzzIxml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	16.0%
gold	[1:9]	3	0.70%
yellow	[10:29]	1	0.23%
greenyellow	[30:49]	5	1.17%
lawngreen	50+	348	81.8%
All colors	425	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	399	ixmlPrintDomTreeRecursive	call site: 00399	ixmlPrintDomTreeRecursive
7	376	ixmlPrintDomTreeRecursive	call site: 00376	copy_with_escape
5	273	ixmlNode_allowChildren	call site: 00273	ixmlNode_removeChild
5	347	ixmlPrintDomTree	call site: 00347	copy_with_escape
2	16	Parser_readFileOrBuffer	call site: 00016	fclose
2	248	ixmlDocument_createElementEx	call site: 00248	ixmlElement_free
2	298	ixmlDocument_createCDATASectionEx	call site: 00298	ixmlCDATASection_free
2	310	ixmlDocument_createAttributeEx	call site: 00310	ixmlAttr_free
2	359	copy_with_escape	call site: 00359	ixml_membuf_append_str
1	21	Parser_readFileOrBuffer	call site: 00021	safe_strdup
1	23	safe_strdup	call site: 00023	strdup
1	25	safe_strdup	call site: 00025	Parser_free

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

27

Reachable functions

126

Percentage of reachable functions covered

78.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzIxml.c	2
ixml/src/ixml.c	7
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	18
ixml/src/document.c	7
ixml/src/ixmldebug.c	1
ixml/src/element.c	6
ixml/src/attr.c	2

Fuzzer: FuzzIxmlDom

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	77	15.5%
gold	[1:9]	3	0.60%
yellow	[10:29]	1	0.20%
greenyellow	[30:49]	6	1.21%
lawngreen	50+	408	82.4%
All colors	495	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	7	Parser_LoadDocument	call site: 00007	fopen
7	403	ixmlNode_getElementsByTagNameNS	call site: 00403	ixmlNodeList_addToNodeList
5	267	ixmlNode_allowChildren	call site: 00267	ixmlNode_removeChild
5	479	ixmlNode_cloneCDATASect	call site: 00479	ixmlNode_newDoc
3	376	ixmlNode_getElementsByTagName	call site: 00376	ixmlNodeList_addToNodeList
3	422	query_document	call site: 00422	ixmlNode_cloneAttrDirect
3	487	ixmlNode_cloneNodeTreeRecursive	call site: 00487	ixmlNode_cloneNodeTreeRecursive
2	242	ixmlDocument_createElementEx	call site: 00242	ixmlElement_free
2	292	ixmlDocument_createCDATASectionEx	call site: 00292	ixmlCDATASection_free
2	304	ixmlDocument_createAttributeEx	call site: 00304	ixmlAttr_free
2	340	ixmlNode_getAttributes	call site: 00340	ixmlNamedNodeMap_init
1	17	safe_strdup	call site: 00017	strdup

Runtime coverage analysis

Covered functions

139

Functions that are reachable but not covered

25

Reachable functions

164

Percentage of reachable functions covered

84.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzIxmlDom.c	5
ixml/src/ixml.c	1
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	43
ixml/src/document.c	9
ixml/src/ixmldebug.c	1
ixml/src/element.c	12
ixml/src/attr.c	2
ixml/src/namedNodeMap.c	7
ixml/src/nodeList.c	5

Fuzzer: FuzzHttp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	11.3%
gold	[1:9]	4	1.61%
yellow	[10:29]	4	1.61%
greenyellow	[30:49]	3	1.21%
lawngreen	50+	208	84.2%
All colors	247	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	120	parser_parse_chunky_entity	call site: 00120	UpnpDisplayFileAndLine
2	75	match_non_ws_string	call site: 00075	parse_uri
2	112	vfmatch	call site: 00112	__assert_fail
2	174	parser_parse_headers	call site: 00174	membuffer_destroy
2	184	FreeListAlloc	call site: 00184	membuffer_destroy
1	33	membuffer_set_size	call site: 00033	realloc
1	108	read_until_crlf	call site: 00108	match_char
1	110	match_char	call site: 00110	scanner_get_token
1	171	membuffer_assign	call site: 00171	membuffer_destroy
1	206	raw_to_int	call site: 00206	__assert_fail
1	229	parser_parse_responseline	call site: 00229	__assert_fail

Runtime coverage analysis

Covered functions

79

Functions that are reachable but not covered

29

Reachable functions

108

Percentage of reachable functions covered

73.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzHttp.c	1
upnp/src/genlib/net/http/httpparser.c	41
upnp/src/threadutil/LinkedList.c	10
upnp/src/threadutil/FreeList.c	4
upnp/src/genlib/util/membuffer.c	12
upnp/src/genlib/net/uri/uri.c	9
upnp/src/api/upnpdebug.c	3
upnp/src/genlib/util/strintmap.c	1

Fuzzer: FuzzServiceTable

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	78	15.3%
gold	[1:9]	3	0.58%
yellow	[10:29]	1	0.19%
greenyellow	[30:49]	1	0.19%
lawngreen	50+	426	83.6%
All colors	509	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	380	freeServiceList	call site: 00380	freeSubscriptionList
14	478	getServiceList	call site: 00478	UpnpDisplayFileAndLine
8	7	Parser_LoadDocument	call site: 00007	fopen
5	267	ixmlNode_allowChildren	call site: 00267	ixmlNode_removeChild
2	242	ixmlDocument_createElementEx	call site: 00242	ixmlElement_free
2	292	ixmlDocument_createCDATASectionEx	call site: 00292	ixmlCDATASection_free
2	304	ixmlDocument_createAttributeEx	call site: 00304	ixmlAttr_free
1	17	safe_strdup	call site: 00017	strdup
1	19	safe_strdup	call site: 00019	Parser_free
1	33	ixmlDocument_createDocumentEx	call site: 00033	ixmlDocument_free
1	119	IxmlPrintf	call site: 00119	fprintf
1	142	ixml_membuf_set_size	call site: 00142	realloc

Runtime coverage analysis

Covered functions

123

Functions that are reachable but not covered

49

Reachable functions

172

Percentage of reachable functions covered

71.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzServiceTable.c	1
ixml/src/ixml.c	3
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	21
ixml/src/document.c	7
ixml/src/ixmldebug.c	1
ixml/src/element.c	7
ixml/src/attr.c	2
upnp/src/genlib/service_table/service_table.c	9
ixml/src/nodeList.c	5
upnp/src/genlib/net/uri/uri.c	13
upnp/src/gena/gena_device.c	2
upnp/src/threadutil/LinkedList.c	5
upnp/src/threadutil/FreeList.c	2
upnp/src/api/upnpdebug.c	3

Fuzzer: FuzzSsdp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	382	58.0%
gold	[1:9]	2	0.30%
yellow	[10:29]	21	3.19%
greenyellow	[30:49]	10	1.51%
lawngreen	50+	243	36.9%
All colors	658	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
346	282	HandleUnlock	call site: 00282	advertiseAndReplyThread
15	119	vfmatch	call site: 00119	UpnpPrintf
2	75	match_non_ws_string	call site: 00075	parse_uri
2	112	vfmatch	call site: 00112	__assert_fail
2	174	parser_parse_headers	call site: 00174	membuffer_destroy
2	184	FreeListAlloc	call site: 00184	membuffer_destroy
2	191	parser_parse_chunky_headers	call site: 00191	parser_parse_entity_until_close
2	276	ssdp_handle_device_request	call site: 00276	GetHandleInfo
1	33	membuffer_set_size	call site: 00033	realloc
1	108	read_until_crlf	call site: 00108	match_char
1	110	match_char	call site: 00110	scanner_get_token
1	143	parser_parse_entity	call site: 00143	UpnpPrintf

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

102

Reachable functions

191

Percentage of reachable functions covered

46.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzSsdp.c	2
upnp/src/genlib/net/http/httpparser.c	43
upnp/src/threadutil/LinkedList.c	10
upnp/src/threadutil/FreeList.c	4
upnp/src/genlib/util/membuffer.c	14
upnp/src/genlib/net/uri/uri.c	10
upnp/src/api/upnpdebug.c	3
upnp/src/genlib/util/strintmap.c	2
upnp/src/ssdp/ssdp_device.c	15
upnp/src/ssdp/ssdp_server.c	4
upnp/src/inc/upnpapi.h	4
upnp/src/api/upnpapi.c	2
upnp/src/threadutil/ThreadPool.c	2
ixml/src/nodeList.c	5
ixml/src/node.c	7
ixml/src/element.c	1
upnp/src/genlib/net/http/httpreadwrite.c	3
upnp/src/genlib/util/list.c	3
upnp/src/api/UpnpExtraHeaders.c	1
upnp/src/genlib/net/http/statcodes.c	3
upnp/src/threadutil/TimerThread.c	4

Fuzzer: FuzzWebServer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	641	43.4%
gold	[1:9]	45	3.04%
yellow	[10:29]	48	3.25%
greenyellow	[30:49]	27	1.82%
lawngreen	50+	715	48.4%
All colors	1476	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
150	819	http_SendMessage	call site: 00819	handle_invoke_action
86	1067	gena_process_subscription_request	call site: 01067	respond_ok
57	1308	FreeExtraHTTPHeaders	call site: 01308	get_file_info
33	1200	gena_process_notification_event	call site: 01200	error_respond
30	684	UpnpString_new	call site: 00684	send_var_query_response
25	1022	ListDestroy	call site: 01022	respond_ok
23	659	Parser_parseDocument	call site: 00659	handle_query_variable
22	305	matchstr	call site: 00305	ixmlParseBufferEx
19	272	get_dev_service	call site: 00272	FindServiceControlURLPath
14	140	parser_parse_chunky_entity	call site: 00140	UpnpDisplayFileAndLine
14	781	http_MakeMessage	call site: 00781	http_MakeMessage
14	998	gena_process_subscription_renewal_request	call site: 00998	GetSubscriptionSID

Runtime coverage analysis

Covered functions

248

Functions that are reachable but not covered

187

Reachable functions

430

Percentage of reachable functions covered

56.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzWebServer.c	2
upnp/src/genlib/net/http/httpparser.c	44
upnp/src/threadutil/LinkedList.c	11
upnp/src/threadutil/FreeList.c	4
upnp/src/genlib/util/membuffer.c	14
upnp/src/genlib/net/sock.c	6
upnp/src/genlib/net/http/httpreadwrite.c	7
upnp/src/genlib/net/uri/uri.c	16
upnp/src/api/upnpdebug.c	3
upnp/src/genlib/util/strintmap.c	2
upnp/src/soap/soap_device.c	10
upnp/src/inc/upnpapi.h	4
upnp/src/api/upnpapi.c	3
upnp/src/genlib/service_table/service_table.c	6
upnp/src/genlib/util/util.c	1
upnp/src/genlib/net/http/parsetools.c	1
ixml/src/ixml.c	8
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	20
ixml/src/document.c	7
ixml/src/ixmldebug.c	1
ixml/src/element.c	6
ixml/src/attr.c	2
upnp/src/api/UpnpStateVarRequest.c	11
upnp/src/api/UpnpString.c	6
upnp/src/genlib/util/list.c	6
upnp/src/api/UpnpExtraHeaders.c	6
upnp/src/genlib/net/http/statcodes.c	3
upnp/src/api/UpnpActionRequest.c	14
upnp/src/gena/gena_callback2.c	2
upnp/src/gena/gena_device.c	9
upnp/src/api/UpnpSubscriptionRequest.c	5
upnp/src/uuid/uuid.c	7
upnp/src/uuid/sysdep.c	3
upnp/src/uuid/md5.c	4
upnp/src/gena/gena_ctrlpt.c	1
upnp/src/api/UpnpEvent.c	5
upnp/src/genlib/client_table/client_table.c	1
upnp/src/genlib/client_table/GenlibClientSubscription.c	3
upnp/src/genlib/net/http/webserver.c	22
upnp/src/api/UpnpFileInfo.c	15
upnp/src/inc/sock.h	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
UpnpInit2	/src/pupnp/upnp/src/api/upnpapi.c	2	['N/A', 'short']	18	0	103	20	9	678	0	3626	906
UpnpSendActionExAsync	/src/pupnp/upnp/src/api/upnpapi.c	8	['int', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	15	0	262	35	14	410	0	2212	255
UpnpRegisterRootDevice2	/src/pupnp/upnp/src/api/upnpapi.c	7	['int', 'N/A', 'size_t', 'int', 'N/A', 'N/A', 'N/A']	16	0	263	25	11	324	0	2015	155
UpnpNotify	/src/pupnp/upnp/src/api/upnpapi.c	6	['int', 'N/A', 'N/A', 'N/A', 'N/A', 'int']	16	0	122	20	7	227	0	1199	110
UpnpOpenHttpGetProxy	/src/pupnp/upnp/src/api/upnpapi.c	7	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'int']	11	0	87	12	5	152	0	835	76
UpnpSearchAsync	/src/pupnp/upnp/src/api/upnpapi.c	4	['int', 'int', 'N/A', 'N/A']	7	0	95	16	5	56	0	233	54
UpnpActionRequest_dup	/src/pupnp/upnp/src/api/UpnpActionRequest.c	1	['N/A']	4	0	35	6	3	30	0	79	47
UpnpStateVarRequest_dup	/src/pupnp/upnp/src/api/UpnpStateVarRequest.c	1	['N/A']	4	0	35	6	3	26	0	71	37

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

785 / 1104

Cyclomatic complexity statically reachable by fuzzers

4716 / 5731

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzzer/FuzzIxmlOps.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['check_children', 'ixmlPrintDomTreeRecursive', 'ixmlNode_cloneCDATASect', 'LLVMFuzzerTestOneInput', 'ixmlDocument_createElementEx', 'ixmlDocument_createAttributeEx', 'ixmlDocument_createCDATASectionEx', 'copy_with_escape']

fuzzer/FuzzIxml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ixmlPrintDomTreeRecursive', 'ixmlNode_allowChildren', 'ixmlPrintDomTree', 'Parser_readFileOrBuffer', 'ixmlDocument_createElementEx', 'ixmlDocument_createCDATASectionEx', 'ixmlDocument_createAttributeEx', 'copy_with_escape']

fuzzer/FuzzIxmlDom.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['Parser_LoadDocument', 'ixmlNode_getElementsByTagNameNS', 'ixmlNode_allowChildren', 'ixmlNode_cloneCDATASect', 'ixmlNode_getElementsByTagName', 'query_document', 'ixmlNode_cloneNodeTreeRecursive', 'ixmlDocument_createElementEx', 'ixmlDocument_createCDATASectionEx', 'ixmlDocument_createAttributeEx']

fuzzer/FuzzHttp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parser_parse_chunky_entity', 'match_non_ws_string', 'vfmatch', 'parser_parse_headers', 'FreeListAlloc', 'membuffer_set_size', 'read_until_crlf', 'match_char', 'membuffer_assign', 'raw_to_int']

fuzzer/FuzzServiceTable.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['freeServiceList', 'getServiceList', 'Parser_LoadDocument', 'ixmlNode_allowChildren', 'ixmlDocument_createElementEx', 'ixmlDocument_createCDATASectionEx', 'ixmlDocument_createAttributeEx', 'safe_strdup', 'ixmlDocument_createDocumentEx']

fuzzer/FuzzSsdp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['HandleUnlock', 'vfmatch', 'match_non_ws_string', 'parser_parse_headers', 'FreeListAlloc', 'parser_parse_chunky_headers', 'ssdp_handle_device_request', 'membuffer_set_size', 'read_until_crlf']

fuzzer/FuzzWebServer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['http_SendMessage', 'gena_process_subscription_request', 'FreeExtraHTTPHeaders', 'gena_process_notification_event', 'UpnpString_new', 'ListDestroy', 'Parser_parseDocument', 'matchstr', 'get_dev_service', 'parser_parse_chunky_entity']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ixmlDocument_createElementEx	34	17	50.0%	['FuzzServiceTable', 'FuzzIxmlDom', 'FuzzWebServer', 'FuzzIxml', 'FuzzIxmlOps']
ixmlDocument_createCDATASectionEx	33	17	51.51%	['FuzzServiceTable', 'FuzzIxmlDom', 'FuzzWebServer', 'FuzzIxml', 'FuzzIxmlOps']
ixmlNode_setNodeProperties	35	13	37.14%	['FuzzServiceTable', 'FuzzIxmlDom', 'FuzzWebServer', 'FuzzIxml']
ssdp_handle_device_request	98	39	39.79%	['FuzzSsdp']
GetDeviceHandleInfoForPath	36	7	19.44%	['FuzzWebServer']
gena_process_notification_event	99	54	54.54%	['FuzzWebServer']
gena_process_subscription_request	173	54	31.21%	['FuzzWebServer']
gena_process_subscription_renewal_request	91	37	40.65%	['FuzzWebServer']
http_SendMessage	220	69	31.36%	['FuzzWebServer']
isFileInVirtualDir	34	7	20.58%	['FuzzWebServer']
http_RecvPostMessage	115	15	13.04%	['FuzzWebServer']
soap_device_callback	63	23	36.50%	['FuzzWebServer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/pupnp/ixml/src/attr.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/ixml/src/ixmldebug.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']	['FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/upnp/src/urlconfig/urlconfig.c	[]	[]
/src/pupnp/ixml/src/nodeList.c	['FuzzIxmlOps', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzSsdp']	['FuzzIxmlOps', 'FuzzIxmlDom', 'FuzzServiceTable']
/src/pupnp/upnp/src/genlib/net/http/httpreadwrite.c	['FuzzSsdp', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpDiscovery.c	[]	[]
/src/pupnp/fuzzer/FuzzServiceTable.c	['FuzzServiceTable']	['FuzzServiceTable']
/src/pupnp/upnp/src/ssdp/ssdp_ctrlpt.c	[]	[]
/src/pupnp/upnp/src/ssdp/SSDPResultDataCallback.c	[]	[]
/src/pupnp/upnp/src/api/upnpapi.c	['FuzzSsdp', 'FuzzWebServer']	['FuzzSsdp', 'FuzzWebServer']
/src/pupnp/upnp/src/gena/gena_device.c	['FuzzServiceTable', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpExtraHeaders.c	['FuzzSsdp', 'FuzzWebServer']	[]
/src/pupnp/upnp/src/uuid/sysdep.c	['FuzzWebServer']	[]
/src/pupnp/upnp/src/genlib/net/http/statcodes.c	['FuzzSsdp', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/gena/gena_ctrlpt.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/ixml/src/element.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/net/http/webserver.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/fuzzer/FuzzIxmlDom.c	['FuzzIxmlDom']	['FuzzIxmlDom']
/src/pupnp/upnp/src/genlib/util/util.c	['FuzzWebServer']	[]
/src/pupnp/upnp/src/api/UpnpSubscriptionRequest.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/genlib/net/http/parsetools.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/soap/soap_device.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpEvent.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/uuid/md5.c	['FuzzWebServer']	[]
/src/pupnp/fuzzer/FuzzSsdp.c	['FuzzSsdp']	['FuzzSsdp']
/src/pupnp/upnp/src/api/UpnpActionRequest.c	['FuzzWebServer']	[]
/src/pupnp/upnp/src/threadutil/LinkedList.c	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/ixml/src/ixmlparser.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/ixml/src/ixmlmembuf.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/fuzzer/FuzzWebServer.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/genlib/client_table/client_table.c	['FuzzWebServer']	[]
/src/pupnp/upnp/src/ssdp/ssdp_device.c	['FuzzSsdp']	['FuzzSsdp']
/src/pupnp/upnp/src/threadutil/ThreadPool.c	['FuzzSsdp']	[]
/src/pupnp/upnp/src/genlib/util/strintmap.c	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/miniserver/miniserver.c	[]	[]
/src/pupnp/upnp/src/gena/gena_callback2.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpString.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/inc/ithread.h	[]	[]
/src/pupnp/ixml/src/document.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/net/http/httpparser.c	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/fuzzer/FuzzHttp.c	['FuzzHttp']	['FuzzHttp']
/src/pupnp/ixml/src/namedNodeMap.c	['FuzzIxmlOps', 'FuzzIxmlDom']	['FuzzIxmlOps', 'FuzzIxmlDom']
/src/pupnp/upnp/src/genlib/util/list.c	['FuzzSsdp', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/inc/upnpapi.h	['FuzzSsdp', 'FuzzWebServer']	['FuzzSsdp', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/net/sock.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpEventSubscribe.c	[]	[]
/src/pupnp/upnp/src/ssdp/ssdp_server.c	['FuzzSsdp']	['FuzzSsdp']
/src/pupnp/upnp/src/api/UpnpActionComplete.c	[]	[]
/src/pupnp/upnp/src/api/UpnpFileInfo.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/ssdp/SSDPResultData.c	[]	[]
/src/pupnp/upnp/src/inc/sock.h	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/uuid/uuid.c	['FuzzWebServer']	[]
/src/pupnp/upnp/src/genlib/net/uri/uri.c	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzWebServer']	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/service_table/service_table.c	['FuzzServiceTable', 'FuzzWebServer']	['FuzzServiceTable']
/src/pupnp/upnp/src/soap/soap_ctrlpt.c	[]	[]
/src/pupnp/upnp/src/threadutil/TimerThread.c	['FuzzSsdp']	[]
/src/pupnp/upnp/src/genlib/util/membuffer.c	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/ixml/src/ixml.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/ixml/src/node.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/fuzzer/FuzzIxml.c	['FuzzIxml']	['FuzzIxml']
/src/pupnp/upnp/src/api/upnpdebug.c	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzWebServer']	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/upnp/src/threadutil/FreeList.c	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpStateVarComplete.c	[]	[]
/src/pupnp/fuzzer/FuzzIxmlOps.c	['FuzzIxmlOps']	['FuzzIxmlOps']
/src/pupnp/upnp/src/genlib/client_table/GenlibClientSubscription.c	['FuzzWebServer']	[]
/src/pupnp/upnp/src/api/UpnpStateVarRequest.c	['FuzzWebServer']	[]

Directories in report

Directory
/src/pupnp/fuzzer/
/src/pupnp/upnp/src/genlib/client_table/
/src/pupnp/upnp/src/urlconfig/
/src/pupnp/upnp/src/genlib/net/uri/
/src/pupnp/ixml/src/
/src/pupnp/upnp/src/genlib/util/
/src/pupnp/upnp/src/genlib/service_table/
/src/pupnp/upnp/src/api/
/src/pupnp/upnp/src/genlib/miniserver/
/src/pupnp/upnp/src/genlib/net/
/src/pupnp/upnp/src/genlib/net/http/
/src/pupnp/upnp/src/threadutil/
/src/pupnp/upnp/inc/
/src/pupnp/upnp/src/soap/
/src/pupnp/upnp/src/ssdp/
/src/pupnp/upnp/src/uuid/
/src/pupnp/upnp/src/gena/
/src/pupnp/upnp/src/inc/