High level conclusions

Fuzzers reach 54.49% of cyclomatic complexity.

Fuzzers reach 43.18% of all functions.

Fuzzer FuzzDevice is blocked:

The runtime code coverage of FuzzDevice covers 28.24% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

482 / 1116

Cyclomatic complexity statically reachable by fuzzers

3158 / 5795

Runtime code coverage of functions

447 / 1116

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: FuzzIxmlOps

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	86	19.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	362	80.8%
All colors	448	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
9	429	check_children	call site: 00429	die
7	306	ixmlPrintDomTreeRecursive	call site: 00306	copy_with_escape
7	329	ixmlPrintDomTreeRecursive	call site: 00329	IxmlPrintf
5	152	ixmlNode_cloneCDATASect	call site: 00152	ixmlNode_newDoc
3	424	LLVMFuzzerTestOneInput	call site: 00424	die
3	440	LLVMFuzzerTestOneInput	call site: 00440	die
2	12	ixmlDocument_createElementEx	call site: 00012	ixmlElement_free
2	30	ixmlDocument_createAttributeEx	call site: 00030	ixmlAttr_free
2	54	ixmlDocument_createCDATASectionEx	call site: 00054	ixmlCDATASection_free
2	284	copy_with_escape	call site: 00284	ixml_membuf_append_str
2	353	ixmlPrintDomTree	call site: 00353	IxmlPrintf
2	380	ixmlDomTreetoString	call site: 00380	IxmlPrintf

Runtime coverage analysis

Covered functions

107

Functions that are reachable but not covered

17

Reachable functions

124

Percentage of reachable functions covered

86.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzIxmlOps.c	11
ixml/src/document.c	9
ixml/src/node.c	38
ixml/src/ixmlparser.c	7
ixml/src/element.c	22
ixml/src/attr.c	2
ixml/src/ixml.c	8
ixml/src/ixmlmembuf.c	5
ixml/src/ixmldebug.c	1
ixml/src/nodeList.c	3
ixml/src/namedNodeMap.c	7

Fuzzer: FuzzIxml

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	68	16.0%
gold	[1:9]	3	0.70%
yellow	[10:29]	1	0.23%
greenyellow	[30:49]	5	1.17%
lawngreen	50+	348	81.8%
All colors	425	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	399	ixmlPrintDomTreeRecursive	call site: 00399	ixmlPrintDomTreeRecursive
7	376	ixmlPrintDomTreeRecursive	call site: 00376	copy_with_escape
5	273	ixmlNode_allowChildren	call site: 00273	ixmlNode_removeChild
5	347	ixmlPrintDomTree	call site: 00347	copy_with_escape
2	16	Parser_readFileOrBuffer	call site: 00016	fclose
2	248	ixmlDocument_createElementEx	call site: 00248	ixmlElement_free
2	298	ixmlDocument_createCDATASectionEx	call site: 00298	ixmlCDATASection_free
2	310	ixmlDocument_createAttributeEx	call site: 00310	ixmlAttr_free
2	359	copy_with_escape	call site: 00359	ixml_membuf_append_str
1	21	Parser_readFileOrBuffer	call site: 00021	safe_strdup
1	23	safe_strdup	call site: 00023	strdup
1	25	safe_strdup	call site: 00025	Parser_free

Runtime coverage analysis

Covered functions

99

Functions that are reachable but not covered

27

Reachable functions

126

Percentage of reachable functions covered

78.57%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzIxml.c	2
ixml/src/ixml.c	7
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	18
ixml/src/document.c	7
ixml/src/ixmldebug.c	1
ixml/src/element.c	6
ixml/src/attr.c	2

Fuzzer: FuzzIxmlDom

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	77	15.5%
gold	[1:9]	3	0.60%
yellow	[10:29]	1	0.20%
greenyellow	[30:49]	6	1.21%
lawngreen	50+	408	82.4%
All colors	495	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	7	Parser_LoadDocument	call site: 00007	fopen
7	403	ixmlNode_getElementsByTagNameNS	call site: 00403	ixmlNodeList_addToNodeList
5	267	ixmlNode_allowChildren	call site: 00267	ixmlNode_removeChild
5	479	ixmlNode_cloneCDATASect	call site: 00479	ixmlNode_newDoc
3	376	ixmlNode_getElementsByTagName	call site: 00376	ixmlNodeList_addToNodeList
3	422	query_document	call site: 00422	ixmlNode_cloneAttrDirect
3	487	ixmlNode_cloneNodeTreeRecursive	call site: 00487	ixmlNode_cloneNodeTreeRecursive
2	242	ixmlDocument_createElementEx	call site: 00242	ixmlElement_free
2	292	ixmlDocument_createCDATASectionEx	call site: 00292	ixmlCDATASection_free
2	304	ixmlDocument_createAttributeEx	call site: 00304	ixmlAttr_free
2	340	ixmlNode_getAttributes	call site: 00340	ixmlNamedNodeMap_init
1	17	safe_strdup	call site: 00017	strdup

Runtime coverage analysis

Covered functions

139

Functions that are reachable but not covered

25

Reachable functions

164

Percentage of reachable functions covered

84.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzIxmlDom.c	5
ixml/src/ixml.c	1
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	43
ixml/src/document.c	9
ixml/src/ixmldebug.c	1
ixml/src/element.c	12
ixml/src/attr.c	2
ixml/src/namedNodeMap.c	7
ixml/src/nodeList.c	5

Fuzzer: FuzzHttp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	28	11.2%
gold	[1:9]	2	0.80%
yellow	[10:29]	5	2.00%
greenyellow	[30:49]	4	1.60%
lawngreen	50+	210	84.3%
All colors	249	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
14	122	parser_parse_chunky_entity	call site: 00122	UpnpDisplayFileAndLine
2	75	match_non_ws_string	call site: 00075	parse_uri
2	114	vfmatch	call site: 00114	__assert_fail
2	176	parser_parse_headers	call site: 00176	membuffer_destroy
2	186	FreeListAlloc	call site: 00186	membuffer_destroy
1	33	membuffer_set_size	call site: 00033	realloc
1	109	read_until_crlf	call site: 00109	match_char
1	112	match_char	call site: 00112	scanner_get_token
1	173	membuffer_assign	call site: 00173	membuffer_destroy
1	208	raw_to_int	call site: 00208	__assert_fail
1	231	parser_parse_responseline	call site: 00231	__assert_fail

Runtime coverage analysis

Covered functions

79

Functions that are reachable but not covered

29

Reachable functions

108

Percentage of reachable functions covered

73.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzHttp.c	1
upnp/src/genlib/net/http/httpparser.c	41
upnp/src/threadutil/LinkedList.c	10
upnp/src/threadutil/FreeList.c	4
upnp/src/genlib/util/membuffer.c	12
upnp/src/genlib/net/uri/uri.c	9
upnp/src/api/upnpdebug.c	3
upnp/src/genlib/util/strintmap.c	1

Fuzzer: FuzzServiceTable

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	78	15.3%
gold	[1:9]	3	0.58%
yellow	[10:29]	1	0.19%
greenyellow	[30:49]	5	0.98%
lawngreen	50+	422	82.9%
All colors	509	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
23	380	freeServiceList	call site: 00380	freeSubscriptionList
14	478	getServiceList	call site: 00478	UpnpDisplayFileAndLine
8	7	Parser_LoadDocument	call site: 00007	fopen
5	267	ixmlNode_allowChildren	call site: 00267	ixmlNode_removeChild
2	242	ixmlDocument_createElementEx	call site: 00242	ixmlElement_free
2	292	ixmlDocument_createCDATASectionEx	call site: 00292	ixmlCDATASection_free
2	304	ixmlDocument_createAttributeEx	call site: 00304	ixmlAttr_free
1	17	safe_strdup	call site: 00017	strdup
1	19	safe_strdup	call site: 00019	Parser_free
1	33	ixmlDocument_createDocumentEx	call site: 00033	ixmlDocument_free
1	119	IxmlPrintf	call site: 00119	fprintf
1	142	ixml_membuf_set_size	call site: 00142	realloc

Runtime coverage analysis

Covered functions

123

Functions that are reachable but not covered

49

Reachable functions

172

Percentage of reachable functions covered

71.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzServiceTable.c	1
ixml/src/ixml.c	3
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	21
ixml/src/document.c	7
ixml/src/ixmldebug.c	1
ixml/src/element.c	7
ixml/src/attr.c	2
upnp/src/genlib/service_table/service_table.c	9
ixml/src/nodeList.c	5
upnp/src/genlib/net/uri/uri.c	13
upnp/src/gena/gena_device.c	2
upnp/src/threadutil/LinkedList.c	5
upnp/src/threadutil/FreeList.c	2
upnp/src/api/upnpdebug.c	3

Fuzzer: FuzzSsdp

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	383	57.9%
gold	[1:9]	2	0.30%
yellow	[10:29]	20	3.02%
greenyellow	[30:49]	12	1.81%
lawngreen	50+	244	36.9%
All colors	661	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
347	284	HandleUnlock	call site: 00284	advertiseAndReplyThread
15	121	vfmatch	call site: 00121	UpnpPrintf
2	75	match_non_ws_string	call site: 00075	parse_uri
2	114	vfmatch	call site: 00114	__assert_fail
2	176	parser_parse_headers	call site: 00176	membuffer_destroy
2	186	FreeListAlloc	call site: 00186	membuffer_destroy
2	193	parser_parse_chunky_headers	call site: 00193	parser_parse_entity_until_close
2	278	ssdp_handle_device_request	call site: 00278	GetHandleInfo
1	33	membuffer_set_size	call site: 00033	realloc
1	109	read_until_crlf	call site: 00109	match_char
1	112	match_char	call site: 00112	scanner_get_token
1	145	parser_parse_entity	call site: 00145	UpnpPrintf

Runtime coverage analysis

Covered functions

91

Functions that are reachable but not covered

102

Reachable functions

191

Percentage of reachable functions covered

46.6%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzSsdp.c	2
upnp/src/genlib/net/http/httpparser.c	43
upnp/src/threadutil/LinkedList.c	10
upnp/src/threadutil/FreeList.c	4
upnp/src/genlib/util/membuffer.c	14
upnp/src/genlib/net/uri/uri.c	10
upnp/src/api/upnpdebug.c	3
upnp/src/genlib/util/strintmap.c	2
upnp/src/ssdp/ssdp_device.c	15
upnp/src/ssdp/ssdp_server.c	4
upnp/src/inc/upnpapi.h	4
upnp/src/api/upnpapi.c	2
upnp/src/threadutil/ThreadPool.c	2
ixml/src/nodeList.c	5
ixml/src/node.c	7
ixml/src/element.c	1
upnp/src/genlib/net/http/httpreadwrite.c	3
upnp/src/genlib/util/list.c	3
upnp/src/api/UpnpExtraHeaders.c	1
upnp/src/genlib/net/http/statcodes.c	3
upnp/src/threadutil/TimerThread.c	4

Fuzzer: FuzzDevice

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1159	78.2%
gold	[1:9]	156	10.5%
yellow	[10:29]	116	7.82%
greenyellow	[30:49]	10	0.67%
lawngreen	50+	41	2.76%
All colors	1482	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
190	658	Parser_parseDocument	call site: 00658	handle_invoke_action
128	1297	ixmlCloneDOMString	call site: 01297	http_MakeMessage
123	997	HandleWriteLock	call site: 00997	gena_process_subscription_request
112	1146	upnp_uuid_unpack	call site: 01146	gena_process_notification_event
90	903	ixmlPrintDomTreeRecursive	call site: 00903	genaCallback
83	211	membuffer_append_str	call site: 00211	dispatch
60	145	UpnpPrintf	call site: 00145	parser_parse_chunky_headers
47	1434	glob_alias_init	call site: 01434	http_RecvPostMessage
44	53	membuffer_set_size	call site: 00053	parser_parse
32	16	membuffer_init	call site: 00016	http_RecvMessage
24	305	membuffer_attach	call site: 00305	ixmlParseBufferEx
21	1275	remove_dots	call site: 01275	membuffer_assign_str

Runtime coverage analysis

Covered functions

220

Functions that are reachable but not covered

310

Reachable functions

432

Percentage of reachable functions covered

28.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzDevice.c	3
upnp/src/genlib/net/http/httpparser.c	44
upnp/src/threadutil/LinkedList.c	11
upnp/src/threadutil/FreeList.c	4
upnp/src/genlib/util/membuffer.c	14
upnp/src/genlib/net/sock.c	6
upnp/src/genlib/net/http/httpreadwrite.c	7
upnp/src/genlib/net/uri/uri.c	16
upnp/src/api/upnpdebug.c	3
upnp/src/genlib/util/strintmap.c	2
upnp/src/soap/soap_device.c	10
upnp/src/inc/upnpapi.h	4
upnp/src/api/upnpapi.c	3
upnp/src/genlib/service_table/service_table.c	6
upnp/src/genlib/util/util.c	1
upnp/src/genlib/net/http/parsetools.c	1
ixml/src/ixml.c	8
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	20
ixml/src/document.c	7
ixml/src/ixmldebug.c	1
ixml/src/element.c	6
ixml/src/attr.c	2
upnp/src/api/UpnpStateVarRequest.c	11
upnp/src/api/UpnpString.c	6
upnp/src/genlib/util/list.c	6
upnp/src/api/UpnpExtraHeaders.c	6
upnp/src/genlib/net/http/statcodes.c	3
upnp/src/api/UpnpActionRequest.c	14
upnp/src/gena/gena_callback2.c	2
upnp/src/gena/gena_device.c	9
upnp/src/api/UpnpSubscriptionRequest.c	5
upnp/src/uuid/uuid.c	7
upnp/src/uuid/sysdep.c	3
upnp/src/uuid/md5.c	4
upnp/src/gena/gena_ctrlpt.c	1
upnp/src/api/UpnpEvent.c	5
upnp/src/genlib/client_table/client_table.c	1
upnp/src/genlib/client_table/GenlibClientSubscription.c	3
upnp/src/genlib/net/http/webserver.c	22
upnp/src/api/UpnpFileInfo.c	15
upnp/src/inc/sock.h	1

Fuzzer: FuzzWebServer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	643	43.5%
gold	[1:9]	78	5.28%
yellow	[10:29]	32	2.16%
greenyellow	[30:49]	11	0.74%
lawngreen	50+	713	48.2%
All colors	1477	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
150	822	http_SendMessage	call site: 00822	handle_invoke_action
87	1070	gena_process_subscription_request	call site: 01070	respond_ok
58	1311	FreeExtraHTTPHeaders	call site: 01311	get_file_info
33	1203	gena_process_notification_event	call site: 01203	error_respond
30	686	UpnpString_new	call site: 00686	send_var_query_response
25	1025	ListDestroy	call site: 01025	respond_ok
23	661	Parser_parseDocument	call site: 00661	handle_query_variable
22	307	matchstr	call site: 00307	ixmlParseBufferEx
19	274	get_dev_service	call site: 00274	FindServiceControlURLPath
14	142	parser_parse_chunky_entity	call site: 00142	UpnpDisplayFileAndLine
14	784	http_MakeMessage	call site: 00784	http_MakeMessage
14	1001	gena_process_subscription_renewal_request	call site: 01001	GetSubscriptionSID

Runtime coverage analysis

Covered functions

248

Functions that are reachable but not covered

188

Reachable functions

431

Percentage of reachable functions covered

56.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzzer/FuzzWebServer.c	2
upnp/src/genlib/net/http/httpparser.c	44
upnp/src/threadutil/LinkedList.c	11
upnp/src/threadutil/FreeList.c	4
upnp/src/genlib/util/membuffer.c	14
upnp/src/genlib/net/sock.c	6
upnp/src/genlib/net/http/httpreadwrite.c	7
upnp/src/genlib/net/uri/uri.c	16
upnp/src/api/upnpdebug.c	3
upnp/src/genlib/util/strintmap.c	2
upnp/src/soap/soap_device.c	10
upnp/src/inc/upnpapi.h	4
upnp/src/api/upnpapi.c	3
upnp/src/genlib/service_table/service_table.c	6
upnp/src/genlib/util/util.c	1
upnp/src/genlib/net/http/parsetools.c	1
ixml/src/ixml.c	8
ixml/src/ixmlparser.c	53
ixml/src/ixmlmembuf.c	8
ixml/src/node.c	20
ixml/src/document.c	7
ixml/src/ixmldebug.c	1
ixml/src/element.c	6
ixml/src/attr.c	2
upnp/src/api/UpnpStateVarRequest.c	11
upnp/src/api/UpnpString.c	6
upnp/src/genlib/util/list.c	6
upnp/src/api/UpnpExtraHeaders.c	6
upnp/src/genlib/net/http/statcodes.c	3
upnp/src/api/UpnpActionRequest.c	14
upnp/src/gena/gena_callback2.c	2
upnp/src/gena/gena_device.c	9
upnp/src/api/UpnpSubscriptionRequest.c	5
upnp/src/uuid/uuid.c	7
upnp/src/uuid/sysdep.c	3
upnp/src/uuid/md5.c	4
upnp/src/gena/gena_ctrlpt.c	1
upnp/src/api/UpnpEvent.c	5
upnp/src/genlib/client_table/client_table.c	1
upnp/src/genlib/client_table/GenlibClientSubscription.c	3
upnp/src/genlib/net/http/webserver.c	22
upnp/src/api/UpnpFileInfo.c	15
upnp/src/inc/sock.h	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
UpnpInit2	/src/pupnp/upnp/src/api/upnpapi.c	2	['N/A', 'short']	18	0	103	20	9	684	0	3657	931
UpnpSendActionExAsync	/src/pupnp/upnp/src/api/upnpapi.c	8	['int', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	15	0	262	35	14	411	0	2224	259
UpnpRegisterRootDevice2	/src/pupnp/upnp/src/api/upnpapi.c	7	['int', 'N/A', 'size_t', 'int', 'N/A', 'N/A', 'N/A']	16	0	263	25	11	323	0	2019	150
UpnpNotify	/src/pupnp/upnp/src/api/upnpapi.c	6	['int', 'N/A', 'N/A', 'N/A', 'N/A', 'int']	16	0	122	20	7	227	0	1207	111
UpnpOpenHttpGetProxy	/src/pupnp/upnp/src/api/upnpapi.c	7	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'int']	11	0	87	12	5	151	0	837	75
UpnpSearchAsync	/src/pupnp/upnp/src/api/upnpapi.c	4	['int', 'int', 'N/A', 'N/A']	7	0	95	16	5	59	0	245	54
UpnpActionRequest_dup	/src/pupnp/upnp/src/api/UpnpActionRequest.c	1	['N/A']	4	0	35	6	3	30	0	79	47
UpnpStateVarRequest_dup	/src/pupnp/upnp/src/api/UpnpStateVarRequest.c	1	['N/A']	4	0	35	6	3	26	0	71	37

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

789 / 1116

Cyclomatic complexity statically reachable by fuzzers

4744 / 5795

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzzer/FuzzIxmlOps.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['check_children', 'ixmlPrintDomTreeRecursive', 'ixmlNode_cloneCDATASect', 'LLVMFuzzerTestOneInput', 'ixmlDocument_createElementEx', 'ixmlDocument_createAttributeEx', 'ixmlDocument_createCDATASectionEx', 'copy_with_escape']

fuzzer/FuzzIxml.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['ixmlPrintDomTreeRecursive', 'ixmlNode_allowChildren', 'ixmlPrintDomTree', 'Parser_readFileOrBuffer', 'ixmlDocument_createElementEx', 'ixmlDocument_createCDATASectionEx', 'ixmlDocument_createAttributeEx', 'copy_with_escape']

fuzzer/FuzzIxmlDom.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['Parser_LoadDocument', 'ixmlNode_getElementsByTagNameNS', 'ixmlNode_allowChildren', 'ixmlNode_cloneCDATASect', 'ixmlNode_getElementsByTagName', 'query_document', 'ixmlNode_cloneNodeTreeRecursive', 'ixmlDocument_createElementEx', 'ixmlDocument_createCDATASectionEx', 'ixmlDocument_createAttributeEx']

fuzzer/FuzzHttp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['parser_parse_chunky_entity', 'match_non_ws_string', 'vfmatch', 'parser_parse_headers', 'FreeListAlloc', 'membuffer_set_size', 'read_until_crlf', 'match_char', 'membuffer_assign', 'raw_to_int']

fuzzer/FuzzServiceTable.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['freeServiceList', 'getServiceList', 'Parser_LoadDocument', 'ixmlNode_allowChildren', 'ixmlDocument_createElementEx', 'ixmlDocument_createCDATASectionEx', 'ixmlDocument_createAttributeEx', 'safe_strdup', 'ixmlDocument_createDocumentEx']

fuzzer/FuzzSsdp.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['HandleUnlock', 'vfmatch', 'match_non_ws_string', 'parser_parse_headers', 'FreeListAlloc', 'parser_parse_chunky_headers', 'ssdp_handle_device_request', 'membuffer_set_size', 'read_until_crlf']

fuzzer/FuzzDevice.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['Parser_parseDocument', 'ixmlCloneDOMString', 'HandleWriteLock', 'upnp_uuid_unpack', 'ixmlPrintDomTreeRecursive', 'membuffer_append_str', 'UpnpPrintf', 'glob_alias_init', 'membuffer_set_size', 'membuffer_init']

fuzzer/FuzzWebServer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['http_SendMessage', 'gena_process_subscription_request', 'FreeExtraHTTPHeaders', 'gena_process_notification_event', 'UpnpString_new', 'ListDestroy', 'Parser_parseDocument', 'matchstr', 'get_dev_service', 'parser_parse_chunky_entity']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
ixmlDocument_createElementEx	34	17	50.0%	['FuzzIxmlDom', 'FuzzWebServer', 'FuzzServiceTable', 'FuzzDevice', 'FuzzIxmlOps', 'FuzzIxml']
ixmlDocument_createCDATASectionEx	33	17	51.51%	['FuzzIxmlDom', 'FuzzWebServer', 'FuzzServiceTable', 'FuzzDevice', 'FuzzIxmlOps', 'FuzzIxml']
ixmlNode_setNodeProperties	35	13	37.14%	['FuzzIxmlDom', 'FuzzWebServer', 'FuzzServiceTable', 'FuzzDevice', 'FuzzIxml']
ssdp_handle_device_request	98	39	39.79%	['FuzzSsdp']
UpnpGetIfInfo	164	77	46.95%	['FuzzDevice']
UpnpAddVirtualDir	45	24	53.33%	['FuzzDevice']
GetDescDocumentAndURL	128	44	34.37%	['FuzzDevice']
UpnpInitLog	35	9	25.71%	['FuzzDevice']
StartMiniServer	90	43	47.77%	['FuzzDevice']
get_miniserver_sockets	103	51	49.51%	['FuzzDevice']
init_socket_stuff	96	46	47.91%	['FuzzDevice']
do_bind	43	21	48.83%	['FuzzDevice']
do_listen	32	11	34.37%	['FuzzDevice']
get_miniserver_stopsock	40	20	50.0%	['FuzzDevice']
get_ssdp_sockets	64	27	42.18%	['FuzzDevice']
create_ssdp_sock_v4	122	58	47.54%	['FuzzDevice']
BumpPriority	32	12	37.5%	['FuzzDevice']
TimerThreadWorker	66	22	33.33%	['FuzzDevice']
config_description_doc	109	43	39.44%	['FuzzDevice']
GetDeviceHandleInfoForPath	36	7	19.44%	['FuzzWebServer', 'FuzzDevice']
gena_process_notification_event	99	54	54.54%	['FuzzWebServer', 'FuzzDevice']
gena_process_subscription_request	173	54	31.21%	['FuzzWebServer', 'FuzzDevice']
gena_process_subscription_renewal_request	91	37	40.65%	['FuzzWebServer', 'FuzzDevice']
http_SendMessage	220	69	31.36%	['FuzzWebServer', 'FuzzDevice']
isFileInVirtualDir	34	7	20.58%	['FuzzWebServer', 'FuzzDevice']
http_RecvPostMessage	96	12	12.5%	['FuzzWebServer', 'FuzzDevice']
soap_device_callback	63	23	36.50%	['FuzzWebServer', 'FuzzDevice']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/pupnp/upnp/src/api/UpnpStateVarComplete.c	[]	[]
/src/pupnp/upnp/src/genlib/net/http/httpreadwrite.c	['FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/genlib/net/uri/uri.c	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/net/http/statcodes.c	['FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpEvent.c	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/ssdp/SSDPResultData.c	[]	[]
/src/pupnp/upnp/src/uuid/md5.c	['FuzzDevice', 'FuzzWebServer']	['FuzzDevice']
/src/pupnp/fuzzer/FuzzServiceTable.c	['FuzzServiceTable']	['FuzzServiceTable']
/src/pupnp/ixml/src/element.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/src/uuid/sysdep.c	['FuzzDevice', 'FuzzWebServer']	['FuzzDevice']
/src/pupnp/fuzzer/FuzzIxmlOps.c	['FuzzIxmlOps']	['FuzzIxmlOps']
/src/pupnp/upnp/src/inc/sock.h	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/genlib/net/http/httpparser.c	['FuzzHttp', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/util/membuffer.c	['FuzzHttp', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/service_table/service_table.c	['FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']	['FuzzServiceTable', 'FuzzDevice']
/src/pupnp/upnp/src/genlib/net/http/parsetools.c	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpActionRequest.c	['FuzzDevice', 'FuzzWebServer']	[]
/src/pupnp/upnp/src/ssdp/SSDPResultDataCallback.c	[]	[]
/src/pupnp/fuzzer/FuzzHttp.c	['FuzzHttp']	['FuzzHttp']
/src/pupnp/upnp/src/genlib/util/strintmap.c	['FuzzHttp', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/net/http/webserver.c	['FuzzDevice', 'FuzzWebServer']	['FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/util/list.c	['FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/genlib/miniserver/miniserver.c	[]	[]
/src/pupnp/ixml/src/nodeList.c	['FuzzIxmlOps', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzSsdp']	['FuzzIxmlOps', 'FuzzIxmlDom', 'FuzzServiceTable']
/src/pupnp/ixml/src/ixmldebug.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']	['FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzWebServer']
/src/pupnp/upnp/src/api/upnpapi.c	['FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/src/genlib/client_table/GenlibClientSubscription.c	['FuzzDevice', 'FuzzWebServer']	[]
/src/pupnp/upnp/src/api/UpnpString.c	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/threadutil/ThreadPool.c	['FuzzSsdp']	[]
/src/pupnp/upnp/src/gena/gena_callback2.c	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpActionComplete.c	[]	[]
/src/pupnp/upnp/src/api/UpnpExtraHeaders.c	['FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	[]
/src/pupnp/fuzzer/FuzzIxml.c	['FuzzIxml']	['FuzzIxml']
/src/pupnp/upnp/src/ssdp/ssdp_ctrlpt.c	[]	[]
/src/pupnp/ixml/src/node.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/src/gena/gena_device.c	['FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/fuzzer/FuzzDevice.c	['FuzzDevice']	['FuzzDevice']
/src/pupnp/upnp/src/genlib/net/sock.c	['FuzzDevice', 'FuzzWebServer']	['FuzzDevice', 'FuzzWebServer']
/src/pupnp/ixml/src/attr.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/inc/ithread.h	[]	[]
/src/pupnp/upnp/src/soap/soap_ctrlpt.c	[]	[]
/src/pupnp/upnp/src/soap/soap_device.c	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/uuid/uuid.c	['FuzzDevice', 'FuzzWebServer']	['FuzzDevice']
/src/pupnp/upnp/src/api/UpnpStateVarRequest.c	['FuzzDevice', 'FuzzWebServer']	[]
/src/pupnp/upnp/src/genlib/util/util.c	['FuzzDevice', 'FuzzWebServer']	[]
/src/pupnp/fuzzer/FuzzSsdp.c	['FuzzSsdp']	['FuzzSsdp']
/src/pupnp/upnp/src/genlib/client_table/client_table.c	['FuzzDevice', 'FuzzWebServer']	[]
/src/pupnp/upnp/src/api/UpnpDiscovery.c	[]	[]
/src/pupnp/upnp/src/threadutil/TimerThread.c	['FuzzSsdp']	[]
/src/pupnp/upnp/src/api/UpnpFileInfo.c	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/ssdp/ssdp_device.c	['FuzzSsdp']	['FuzzSsdp']
/src/pupnp/upnp/src/inc/upnpapi.h	['FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/fuzzer/FuzzIxmlDom.c	['FuzzIxmlDom']	['FuzzIxmlDom']
/src/pupnp/upnp/src/threadutil/FreeList.c	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/ixml/src/namedNodeMap.c	['FuzzIxmlOps', 'FuzzIxmlDom']	['FuzzIxmlOps', 'FuzzIxmlDom']
/src/pupnp/upnp/src/threadutil/LinkedList.c	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzHttp', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/ixml/src/ixmlparser.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/src/gena/gena_ctrlpt.c	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/UpnpSubscriptionRequest.c	['FuzzDevice', 'FuzzWebServer']	['FuzzWebServer']
/src/pupnp/upnp/src/api/upnpdebug.c	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']	['FuzzHttp', 'FuzzServiceTable', 'FuzzSsdp', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/fuzzer/FuzzWebServer.c	['FuzzWebServer']	['FuzzWebServer']
/src/pupnp/ixml/src/ixml.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/ixml/src/document.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']
/src/pupnp/upnp/src/urlconfig/urlconfig.c	[]	[]
/src/pupnp/upnp/src/api/UpnpEventSubscribe.c	[]	[]
/src/pupnp/upnp/src/ssdp/ssdp_server.c	['FuzzSsdp']	['FuzzSsdp']
/src/pupnp/ixml/src/ixmlmembuf.c	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']	['FuzzIxmlOps', 'FuzzIxml', 'FuzzIxmlDom', 'FuzzServiceTable', 'FuzzDevice', 'FuzzWebServer']

Directories in report

Directory
/src/pupnp/upnp/inc/
/src/pupnp/upnp/src/soap/
/src/pupnp/upnp/src/genlib/miniserver/
/src/pupnp/upnp/src/genlib/client_table/
/src/pupnp/upnp/src/gena/
/src/pupnp/upnp/src/ssdp/
/src/pupnp/upnp/src/genlib/net/http/
/src/pupnp/upnp/src/urlconfig/
/src/pupnp/ixml/src/
/src/pupnp/upnp/src/uuid/
/src/pupnp/upnp/src/genlib/service_table/
/src/pupnp/upnp/src/inc/
/src/pupnp/upnp/src/genlib/net/
/src/pupnp/fuzzer/
/src/pupnp/upnp/src/genlib/net/uri/
/src/pupnp/upnp/src/api/
/src/pupnp/upnp/src/threadutil/
/src/pupnp/upnp/src/genlib/util/