High level conclusions

Fuzzers reach 62.76% code coverage.

Fuzzers reach 57.93% of cyclomatic complexity.

Fuzzers reach 48.45% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1564 / 3228

Cyclomatic complexity statically reachable by fuzzers

20035 / 34581

Runtime code coverage of functions

2026 / 3228

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: future_ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	12.5%
gold	[1:9]	6	12.5%
yellow	[10:29]	10	20.8%
greenyellow	[30:49]	2	4.16%
lawngreen	50+	24	50.0%
All colors	48	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	7	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	40	FuzzHelper::doChecks()	call site: 00040
1	46	FuzzHelper::run()	call site: 00046	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

14

Reachable functions

41

Percentage of reachable functions covered

65.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: future_pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	43.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	35	56.4%
All colors	62	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
4	32	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00032
3	58	FuzzHelper::run()	call site: 00058	__cxa_end_catch

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

12

Reachable functions

57

Percentage of reachable functions covered

78.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	49	57.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	42.3%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
13	37	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00037	__cxa_allocate_exception
7	52	BitStream::getBitsSigned(unsigned long)	call site: 00052	__cxa_allocate_exception
5	62	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00062	__cxa_allocate_exception
3	81	FuzzHelper::run()	call site: 00081	__cxa_end_catch
1	68	Pl_TIFFPredictor::processRow()	call site: 00068

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

28

Reachable functions

79

Percentage of reachable functions covered

64.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	49	57.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	42.3%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
13	37	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00037	__cxa_allocate_exception
7	52	BitStream::getBitsSigned(unsigned long)	call site: 00052	__cxa_allocate_exception
5	62	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00062	__cxa_allocate_exception
3	81	FuzzHelper::run()	call site: 00081	__cxa_end_catch
1	68	Pl_TIFFPredictor::processRow()	call site: 00068

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

28

Reachable functions

79

Percentage of reachable functions covered

64.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	44.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.19%
greenyellow	[30:49]	5	8.19%
lawngreen	50+	24	39.3%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	14	FuzzHelper::doChecks()	call site: 00014	__cxa_allocate_exception
4	8	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00008	__cxa_allocate_exception
2	41	FuzzHelper::doChecks()	call site: 00041
1	59	FuzzHelper::run()	call site: 00059	__cxa_begin_catch

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

20

Reachable functions

53

Percentage of reachable functions covered

62.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	143	63.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	83	36.7%
All colors	226	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	157	deflate	call site: 00157	inflate
15	86	deflate	call site: 00086	crc32
13	44	deflateResetKeep	call site: 00044	crc32_z
12	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
11	143	deflate	call site: 00143	_tr_flush_block
8	63	deflateReset	call site: 00063	inflateInit_
7	208	Pl_Flate::finish()	call site: 00208	__cxa_begin_catch
6	185	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00185	__cxa_allocate_exception
6	195	FuzzHelper::doChecks()	call site: 00195	__cxa_allocate_exception
5	28	Pl_Flate::write(unsigned char const*, unsigned long)	call site: 00028	__cxa_allocate_exception
5	137	_tr_flush_block	call site: 00137	_tr_flush_block
4	23	FuzzHelper::doChecks()	call site: 00023	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

66

Functions that are reachable but not covered

55

Reachable functions

130

Percentage of reachable functions covered

57.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1

Fuzzer: future_flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	143	63.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	83	36.7%
All colors	226	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	157	deflate	call site: 00157	inflate
15	86	deflate	call site: 00086	crc32
13	44	deflateResetKeep	call site: 00044	crc32_z
12	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
11	143	deflate	call site: 00143	_tr_flush_block
8	63	deflateReset	call site: 00063	inflateInit_
7	208	Pl_Flate::finish()	call site: 00208	__cxa_begin_catch
6	185	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00185	__cxa_allocate_exception
6	195	FuzzHelper::doChecks()	call site: 00195	__cxa_allocate_exception
5	28	Pl_Flate::write(unsigned char const*, unsigned long)	call site: 00028	__cxa_allocate_exception
5	137	_tr_flush_block	call site: 00137	_tr_flush_block
4	23	FuzzHelper::doChecks()	call site: 00023	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

66

Functions that are reachable but not covered

55

Reachable functions

130

Percentage of reachable functions covered

57.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1

Fuzzer: lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	36.4%
gold	[1:9]	5	5.88%
yellow	[10:29]	5	5.88%
greenyellow	[30:49]	5	5.88%
lawngreen	50+	39	45.8%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00018	__cxa_allocate_exception
5	33	Pl_LZWDecoder::handleCode(unsigned int)	call site: 00033	__cxa_allocate_exception
5	50	Pl_LZWDecoder::handleCode(unsigned int)	call site: 00050	__cxa_allocate_exception
4	7	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00007	__cxa_allocate_exception
4	39	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00039	__cxa_allocate_exception
4	58	Pl_LZWDecoder::addToTable(unsigned char)	call site: 00058	__cxa_allocate_exception
1	83	FuzzHelper::run()	call site: 00083	__cxa_begin_catch

Runtime coverage analysis

Covered functions

29

Functions that are reachable but not covered

23

Reachable functions

70

Percentage of reachable functions covered

67.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: future_lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	36.4%
gold	[1:9]	10	11.7%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	5	5.88%
lawngreen	50+	39	45.8%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00018	__cxa_allocate_exception
5	33	Pl_LZWDecoder::handleCode(unsigned int)	call site: 00033	__cxa_allocate_exception
5	50	Pl_LZWDecoder::handleCode(unsigned int)	call site: 00050	__cxa_allocate_exception
4	7	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00007	__cxa_allocate_exception
4	39	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00039	__cxa_allocate_exception
4	58	Pl_LZWDecoder::addToTable(unsigned char)	call site: 00058	__cxa_allocate_exception
1	83	FuzzHelper::run()	call site: 00083	__cxa_begin_catch

Runtime coverage analysis

Covered functions

29

Functions that are reachable but not covered

23

Reachable functions

70

Percentage of reachable functions covered

67.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: future_hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	16.6%
gold	[1:9]	1	2.77%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	16.6%
lawngreen	50+	23	63.8%
All colors	36	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	7	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	28	FuzzHelper::doChecks()	call site: 00028
1	34	FuzzHelper::run()	call site: 00034	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

13

Reachable functions

40

Percentage of reachable functions covered

67.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	12.5%
gold	[1:9]	6	12.5%
yellow	[10:29]	10	20.8%
greenyellow	[30:49]	2	4.16%
lawngreen	50+	24	50.0%
All colors	48	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	7	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	40	FuzzHelper::doChecks()	call site: 00040
1	46	FuzzHelper::run()	call site: 00046	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

14

Reachable functions

41

Percentage of reachable functions covered

65.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	16.6%
gold	[1:9]	1	2.77%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	16.6%
lawngreen	50+	23	63.8%
All colors	36	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	7	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	28	FuzzHelper::doChecks()	call site: 00028
1	34	FuzzHelper::run()	call site: 00034	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

13

Reachable functions

40

Percentage of reachable functions covered

67.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	179	55.0%
gold	[1:9]	18	5.53%
yellow	[10:29]	6	1.84%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	122	37.5%
All colors	325	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	97	init_simd	call site: 00097	jinit_forward_dct
32	48	std_huff_tables	call site: 00048	jpeg_start_compress
28	154	unsigned int QIntC::to_uint (int const&)	call site: 00154	jpeg_finish_compress
19	229	master_selection	call site: 00229	jinit_1pass_quantizer
11	32	jinit_memory_mgr	call site: 00032	jpeg_set_defaults
9	205	jpeg_core_output_dimensions	call site: 00205	jdiv_round_up
7	197	jpeg_calc_output_dimensions	call site: 00197	jdiv_round_up
4	11	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00011	__cxa_allocate_exception
3	23	Pl_DCT::finish()	call site: 00023	jpeg_CreateCompress
3	253	jinit_color_deconverter	call site: 00253	jsimd_can_ycc_rgb565
2	306	Pl_DCT::finish()	call site: 00306	jpeg_destroy_compress
1	18	FuzzHelper::doChecks()	call site: 00018

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

124

Reachable functions

231

Percentage of reachable functions covered

46.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	179	55.0%
gold	[1:9]	18	5.53%
yellow	[10:29]	6	1.84%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	122	37.5%
All colors	325	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	97	init_simd	call site: 00097	jinit_forward_dct
32	48	std_huff_tables	call site: 00048	jpeg_start_compress
28	154	unsigned int QIntC::to_uint (int const&)	call site: 00154	jpeg_finish_compress
19	229	master_selection	call site: 00229	jinit_1pass_quantizer
11	32	jinit_memory_mgr	call site: 00032	jpeg_set_defaults
9	205	jpeg_core_output_dimensions	call site: 00205	jdiv_round_up
7	197	jpeg_calc_output_dimensions	call site: 00197	jdiv_round_up
4	11	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00011	__cxa_allocate_exception
3	23	Pl_DCT::finish()	call site: 00023	jpeg_CreateCompress
3	253	jinit_color_deconverter	call site: 00253	jsimd_can_ycc_rgb565
2	306	Pl_DCT::finish()	call site: 00306	jpeg_destroy_compress
1	18	FuzzHelper::doChecks()	call site: 00018

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

124

Reachable functions

231

Percentage of reachable functions covered

46.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	43.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	35	56.4%
All colors	62	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
4	32	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00032
3	58	FuzzHelper::run()	call site: 00058	__cxa_end_catch

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

12

Reachable functions

57

Percentage of reachable functions covered

78.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	44.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.19%
greenyellow	[30:49]	5	8.19%
lawngreen	50+	24	39.3%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	14	FuzzHelper::doChecks()	call site: 00014	__cxa_allocate_exception
4	8	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00008	__cxa_allocate_exception
2	41	FuzzHelper::doChecks()	call site: 00041
1	59	FuzzHelper::run()	call site: 00059	__cxa_begin_catch

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

20

Reachable functions

53

Percentage of reachable functions covered

62.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: future_json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2366	75.5%
gold	[1:9]	25	0.79%
yellow	[10:29]	40	1.27%
greenyellow	[30:49]	26	0.83%
lawngreen	50+	673	21.5%
All colors	3130	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	2086	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02086	__cxa_allocate_exception
185	2744	std::__1::shared_ptr QPDFObject::create , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)	call site: 02744	__cxa_allocate_exception
170	1726	QPDFObjectHandle::parse(QPDF*, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 01726	__cxa_allocate_exception
146	2472	QPDFObjectHandle::getObjectID() const	call site: 02472	__cxa_allocate_exception
134	1951	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01951	__cxa_allocate_exception
86	1385	QPDFObjectHandle::getIntValueAsInt() const	call site: 01385	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
80	819	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00819	__cxa_allocate_exception
71	2671	QPDFObjectHandle::removeKey(std::__1::basic_string , std::__1::allocator > const&)	call site: 02671	__cxa_allocate_exception
70	1263	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01263	__cxa_allocate_exception
57	1514	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01514	__dynamic_cast
56	2330	QPDF::getObject(QPDFObjGen)	call site: 02330	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
55	1107	QPDFLogger::defaultLogger()	call site: 01107	__cxa_end_catch

Runtime coverage analysis

Covered functions

437

Functions that are reachable but not covered

745

Reachable functions

1435

Percentage of reachable functions covered

48.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	9
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDF.hh	7
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	75
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/src/qpdf/libqpdf/QPDF_Array.cc	18
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	13
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	43
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	2

Fuzzer: json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2366	75.5%
gold	[1:9]	30	0.95%
yellow	[10:29]	60	1.91%
greenyellow	[30:49]	8	0.25%
lawngreen	50+	666	21.2%
All colors	3130	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	2086	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02086	__cxa_allocate_exception
185	2744	std::__1::shared_ptr QPDFObject::create , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)	call site: 02744	__cxa_allocate_exception
170	1726	QPDFObjectHandle::parse(QPDF*, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 01726	__cxa_allocate_exception
146	2472	QPDFObjectHandle::getObjectID() const	call site: 02472	__cxa_allocate_exception
134	1951	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01951	__cxa_allocate_exception
86	1385	QPDFObjectHandle::getIntValueAsInt() const	call site: 01385	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
80	819	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00819	__cxa_allocate_exception
71	2671	QPDFObjectHandle::removeKey(std::__1::basic_string , std::__1::allocator > const&)	call site: 02671	__cxa_allocate_exception
70	1263	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01263	__cxa_allocate_exception
57	1514	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01514	__dynamic_cast
56	2330	QPDF::getObject(QPDFObjGen)	call site: 02330	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
55	1107	QPDFLogger::defaultLogger()	call site: 01107	__cxa_end_catch

Runtime coverage analysis

Covered functions

435

Functions that are reachable but not covered

745

Reachable functions

1435

Percentage of reachable functions covered

48.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	9
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDF.hh	7
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	75
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/src/qpdf/libqpdf/QPDF_Array.cc	18
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	13
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	43
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	2

Fuzzer: qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	632	17.8%
gold	[1:9]	138	3.89%
yellow	[10:29]	54	1.52%
greenyellow	[30:49]	33	0.93%
lawngreen	50+	2684	75.7%
All colors	3541	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
77	2374	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02374	__cxa_allocate_exception
15	1236	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01236	__cxa_allocate_exception
12	1259	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01259	__cxa_allocate_exception
11	170	qpdf::Tokenizer::inBeforeToken(char)	call site: 00170	__cxa_allocate_exception
10	920	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00920	__cxa_allocate_exception
9	1885	Pl_AES_PDF::flush(bool)	call site: 01885	__cxa_allocate_exception
8	22	long long QIntC::to_offset (unsigned long const&)	call site: 00022	__cxa_allocate_exception
8	1466	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01466
7	337	QPDFParser::warn(QPDFExc const&) const	call site: 00337	__cxa_allocate_exception
7	1155	QPDFObjectHandle::getName() const	call site: 01155	__cxa_allocate_exception
7	1404	QPDFObjectHandle::parse(QPDF*, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 01404	isspace
7	1441	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01441

Runtime coverage analysis

Covered functions

969

Functions that are reachable but not covered

224

Reachable functions

1593

Percentage of reachable functions covered

85.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	18
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	12
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	25
/src/qpdf/include/qpdf/QPDF.hh	7
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	94
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	15
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	43
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	2
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDF_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: future_qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	655	18.5%
gold	[1:9]	121	3.41%
yellow	[10:29]	63	1.78%
greenyellow	[30:49]	46	1.29%
lawngreen	50+	2654	74.9%
All colors	3539	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
77	2372	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02372	__cxa_allocate_exception
25	1449	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01449
15	1234	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01234	__cxa_allocate_exception
12	1257	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01257	__cxa_allocate_exception
11	161	qpdf::Tokenizer::inBeforeToken(char)	call site: 00161	__cxa_allocate_exception
10	918	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00918	__cxa_allocate_exception
10	1436	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01436
9	1883	Pl_AES_PDF::flush(bool)	call site: 01883	__cxa_allocate_exception
8	39	unsigned long QIntC::to_size (long const&)	call site: 00039	__cxa_allocate_exception
7	328	QPDFParser::warn(QPDFExc const&) const	call site: 00328	__cxa_allocate_exception
7	1153	QPDFObjectHandle::getName() const	call site: 01153	__cxa_allocate_exception
7	1402	QPDFObjectHandle::parse(QPDF*, std::__1::basic_string , std::__1::allocator > const&, std::__1::basic_string , std::__1::allocator > const&)	call site: 01402	isspace

Runtime coverage analysis

Covered functions

972

Functions that are reachable but not covered

226

Reachable functions

1593

Percentage of reachable functions covered

85.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	18
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	12
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	25
/src/qpdf/include/qpdf/QPDF.hh	7
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	94
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	15
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	43
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	2
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDF_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: future_qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1026	21.5%
gold	[1:9]	104	2.18%
yellow	[10:29]	112	2.35%
greenyellow	[30:49]	52	1.09%
lawngreen	50+	3469	72.8%
All colors	4763	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
108	4631	QPDFWriter::Members::write()	call site: 04631	_ZN10QPDFWriter7Members5writeITkNSt3__18integralExEERS0_T_
69	2882	QPDFWriter::Members::write()	call site: 02882
25	2797	QPDF::getTrailer()	call site: 02797	__cxa_allocate_exception
23	2421	qpdf::BaseHandle::copy(bool) const	call site: 02421	__cxa_allocate_exception
19	4235	QPDFWriter::Members::writeTrailer(QPDFWriter::Members::trailer_e, int, bool, long long, int)	call site: 04235	__cxa_allocate_exception
17	3423	QPDFWriter::Members::enqueueObject(QPDFObjectHandle)	call site: 03423
17	3460	QPDFWriter::Members::writeLinearized()	call site: 03460	fopen
17	4122	qpdf::BaseHandle::unparse() const	call site: 04122	__cxa_allocate_exception
16	2833	QPDFWriter::Members::setEncryptionParameters(char const*, char const*)	call site: 02833	__cxa_allocate_exception
15	1234	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01234	__cxa_allocate_exception
15	3722	deflate	call site: 03722	crc32
14	3042	QPDFWriter::Members::preserveObjectStreams()	call site: 03042

Runtime coverage analysis

Covered functions

1291

Functions that are reachable but not covered

316

Reachable functions

2008

Percentage of reachable functions covered

84.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	21
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDF.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	85
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	82
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	51
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	9
/src/qpdf/libqpdf/QPDFWriter.cc	90
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	1
/src/qpdf/libqpdf/QPDF_linearization.cc	17
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/Pl_MD5.cc	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1078	22.8%
gold	[1:9]	124	2.62%
yellow	[10:29]	129	2.73%
greenyellow	[30:49]	42	0.89%
lawngreen	50+	3342	70.8%
All colors	4715	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
108	4583	QPDFWriter::Members::write()	call site: 04583	_ZN10QPDFWriter7Members5writeITkNSt3__18integralExEERS0_T_
38	4362	QPDFWriter::Members::writeLinearized()	call site: 04362	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_
29	2935	ObjTable ::large_element(unsigned long)	call site: 02935	__cxa_allocate_exception
25	1451	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01451
25	2877	QPDFWriter::Members::copyEncryptionParameters(QPDF&)	call site: 02877
23	2423	qpdf::BaseHandle::copy(bool) const	call site: 02423	__cxa_allocate_exception
21	4147	QPDFWriter::Members::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04147
17	3374	QPDFWriter::Members::enqueueObject(QPDFObjectHandle)	call site: 03374
17	3411	QPDFWriter::Members::writeLinearized()	call site: 03411	fopen
17	4074	qpdf::BaseHandle::unparse() const	call site: 04074	__cxa_allocate_exception
15	1236	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01236	__cxa_allocate_exception
15	3674	deflate	call site: 03674	crc32

Runtime coverage analysis

Covered functions

1288

Functions that are reachable but not covered

304

Reachable functions

1990

Percentage of reachable functions covered

84.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	21
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDF.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	85
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	82
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	45
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	9
/src/qpdf/libqpdf/QPDFWriter.cc	88
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	1
/src/qpdf/libqpdf/QPDF_linearization.cc	17
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/Pl_MD5.cc	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	962	17.8%
gold	[1:9]	143	2.64%
yellow	[10:29]	103	1.90%
greenyellow	[30:49]	72	1.33%
lawngreen	50+	4124	76.3%
All colors	5404	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
59	5032	(anonymous namespace)::JSONParser::getToken()	call site: 05032	__cxa_allocate_exception
21	4114	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04114	__cxa_allocate_exception
19	5164	(anonymous namespace)::JSONParser::handleToken()	call site: 05164	__cxa_allocate_exception
19	5246	(anonymous namespace)::JSONParser::handleToken()	call site: 05246	__cxa_allocate_exception
17	2429	qpdf::BaseHandle::copy(bool) const	call site: 02429	__cxa_allocate_exception
15	4691	void QIntC::range_check_error (long long const&, long long const&)	call site: 04691	__cxa_allocate_exception
11	170	qpdf::Tokenizer::inBeforeToken(char)	call site: 00170	__cxa_allocate_exception
11	5130	(anonymous namespace)::JSONParser::getToken()	call site: 05130	__cxa_allocate_exception
10	920	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00920	__cxa_allocate_exception
10	1259	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01259	__cxa_allocate_exception
10	4088	qpdf::BaseHandle::unparse() const	call site: 04088	__cxa_allocate_exception
10	5118	(anonymous namespace)::JSONParser::getToken()	call site: 05118	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1275

Functions that are reachable but not covered

220

Reachable functions

2104

Percentage of reachable functions covered

89.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/include/qpdf/QIntC.hh	48
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/QPDF_objects.cc	48
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	12
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	4
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	28
/src/qpdf/include/qpdf/QPDF.hh	7
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	99
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	34
/src/qpdf/libqpdf/QPDFObjectHandle.cc	115
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	19
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	43
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	2
/src/qpdf/libqpdf/QPDFPageDocumentHelper.cc	4
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDF_String.cc	6
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	8
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	30
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	2
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	9
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1022	21.4%
gold	[1:9]	126	2.64%
yellow	[10:29]	97	2.03%
greenyellow	[30:49]	49	1.02%
lawngreen	50+	3471	72.8%
All colors	4765	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
108	4633	QPDFWriter::Members::write()	call site: 04633	_ZN10QPDFWriter7Members5writeITkNSt3__18integralExEERS0_T_
69	2884	QPDFWriter::Members::write()	call site: 02884
25	2799	QPDF::getTrailer()	call site: 02799	__cxa_allocate_exception
23	2423	qpdf::BaseHandle::copy(bool) const	call site: 02423	__cxa_allocate_exception
19	4237	QPDFWriter::Members::writeTrailer(QPDFWriter::Members::trailer_e, int, bool, long long, int)	call site: 04237	__cxa_allocate_exception
17	3425	QPDFWriter::Members::enqueueObject(QPDFObjectHandle)	call site: 03425
17	3462	QPDFWriter::Members::writeLinearized()	call site: 03462	fopen
17	4124	qpdf::BaseHandle::unparse() const	call site: 04124	__cxa_allocate_exception
16	2835	QPDFWriter::Members::setEncryptionParameters(char const*, char const*)	call site: 02835	__cxa_allocate_exception
15	1236	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01236	__cxa_allocate_exception
15	3724	deflate	call site: 03724	crc32
14	3044	QPDFWriter::Members::preserveObjectStreams()	call site: 03044

Runtime coverage analysis

Covered functions

1288

Functions that are reachable but not covered

316

Reachable functions

2008

Percentage of reachable functions covered

84.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	21
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDF.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	85
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	82
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	51
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	9
/src/qpdf/libqpdf/QPDFWriter.cc	90
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	1
/src/qpdf/libqpdf/QPDF_linearization.cc	17
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/Pl_MD5.cc	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1701	35.7%
gold	[1:9]	129	2.70%
yellow	[10:29]	97	2.03%
greenyellow	[30:49]	54	1.13%
lawngreen	50+	2782	58.4%
All colors	4763	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
235	3171	QPDFWriter::Members::prepareFileForWrite()	call site: 03171	__assert_fail
78	4448	QPDFWriter::Members::writeEncryptionDictionary()	call site: 04448	_ZN10QPDFWriter7Members5writeITkNSt3__18integralExEERS0_T_
75	2984	ObjTable ::large_element(unsigned long)	call site: 02984	__cxa_allocate_exception
69	4635	QPDFWriter::Members::writeStandard()	call site: 04635	__cxa_allocate_exception
68	2882	QPDFWriter::Members::write()	call site: 02882
56	4355	QPDFWriter::Members::writeObject(QPDFObjectHandle, int)	call site: 04355	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEmEERS0_T_
39	4563	BitWriter::flush()	call site: 04563
30	3575	qpdf::pl::Count::write(unsigned char const*, unsigned long)	call site: 03575	__cxa_allocate_exception
30	4302	QPDFWriter::Members::writeObject(QPDFObjectHandle, int)	call site: 04302	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_
30	4532	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04532	__cxa_allocate_exception
27	4227	QPDFWriter::Members::writeTrailer(QPDFWriter::Members::trailer_e, int, bool, long long, int)	call site: 04227	__cxa_allocate_exception
27	4603	qpdf::pl::Count::~Count()	call site: 04603	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_

Runtime coverage analysis

Covered functions

1208

Functions that are reachable but not covered

459

Reachable functions

2008

Percentage of reachable functions covered

77.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	21
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDF.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	85
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	82
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	51
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	9
/src/qpdf/libqpdf/QPDFWriter.cc	90
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	1
/src/qpdf/libqpdf/QPDF_linearization.cc	17
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/Pl_MD5.cc	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1503	31.8%
gold	[1:9]	110	2.33%
yellow	[10:29]	69	1.46%
greenyellow	[30:49]	76	1.61%
lawngreen	50+	2956	62.7%
All colors	4714	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	3121	QPDFWriter::Members::prepareFileForWrite()	call site: 03121	__assert_fail
118	4359	QPDFWriter::Members::writeObjectStream(QPDFObjectHandle)	call site: 04359	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_
81	3663	Pl_Flate::checkError(char const*, int)	call site: 03663	deflate
69	4586	QPDFWriter::Members::writeStandard()	call site: 04586	__cxa_allocate_exception
40	2823	QPDFWriter::Members::generateID(bool)	call site: 02823
39	4514	BitWriter::flush()	call site: 04514
30	4483	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04483	__cxa_allocate_exception
27	4554	qpdf::pl::Count::~Count()	call site: 04554	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_
23	2423	qpdf::BaseHandle::copy(bool) const	call site: 02423	__cxa_allocate_exception
23	3622	unsigned int QIntC::to_uint (unsigned long const&)	call site: 03622	deflateInit_
22	3453	QPDFWriter::Members::openObject(int)	call site: 03453	_ZN10QPDFWriter7Members5writeITkNSt3__18integralExEERS0_T_
21	4146	QPDFWriter::Members::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04146

Runtime coverage analysis

Covered functions

1232

Functions that are reachable but not covered

412

Reachable functions

1988

Percentage of reachable functions covered

79.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	21
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDF.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	85
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	82
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	45
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	9
/src/qpdf/libqpdf/QPDFWriter.cc	87
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	1
/src/qpdf/libqpdf/QPDF_linearization.cc	17
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/Pl_MD5.cc	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1065	19.7%
gold	[1:9]	126	2.33%
yellow	[10:29]	86	1.59%
greenyellow	[30:49]	53	0.98%
lawngreen	50+	4072	75.3%
All colors	5402	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
70	3304	NNTreeIterator::split(qpdf::Dictionary, std::__1::__list_iterator )	call site: 03304	__cxa_allocate_exception
59	5030	(anonymous namespace)::JSONParser::getToken()	call site: 05030	__cxa_allocate_exception
52	3230	NNTreeIterator::resetLimits(qpdf::Dictionary, std::__1::__list_iterator )	call site: 03230
21	4112	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04112	__cxa_allocate_exception
19	5162	(anonymous namespace)::JSONParser::handleToken()	call site: 05162	__cxa_allocate_exception
19	5244	(anonymous namespace)::JSONParser::handleToken()	call site: 05244	__cxa_allocate_exception
17	2427	qpdf::BaseHandle::copy(bool) const	call site: 02427	__cxa_allocate_exception
11	161	qpdf::Tokenizer::inBeforeToken(char)	call site: 00161	__cxa_allocate_exception
11	5128	(anonymous namespace)::JSONParser::getToken()	call site: 05128	__cxa_allocate_exception
10	918	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00918	__cxa_allocate_exception
10	1257	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01257	__cxa_allocate_exception
10	4086	qpdf::BaseHandle::unparse() const	call site: 04086	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1274

Functions that are reachable but not covered

228

Reachable functions

2104

Percentage of reachable functions covered

89.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/QPDF_objects.cc	48
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	12
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	48
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	4
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	28
/src/qpdf/include/qpdf/QPDF.hh	7
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	99
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	34
/src/qpdf/libqpdf/QPDFObjectHandle.cc	115
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	19
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	43
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	2
/src/qpdf/libqpdf/QPDFPageDocumentHelper.cc	4
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDF_String.cc	6
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	8
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	30
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	2
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	9
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1704	35.7%
gold	[1:9]	105	2.20%
yellow	[10:29]	97	2.03%
greenyellow	[30:49]	47	0.98%
lawngreen	50+	2812	59.0%
All colors	4765	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
235	3173	QPDFWriter::Members::prepareFileForWrite()	call site: 03173	__assert_fail
78	4450	QPDFWriter::Members::writeEncryptionDictionary()	call site: 04450	_ZN10QPDFWriter7Members5writeITkNSt3__18integralExEERS0_T_
75	2986	ObjTable ::large_element(unsigned long)	call site: 02986	__cxa_allocate_exception
69	4637	QPDFWriter::Members::writeStandard()	call site: 04637	__cxa_allocate_exception
68	2884	QPDFWriter::Members::write()	call site: 02884
56	4357	QPDFWriter::Members::writeObject(QPDFObjectHandle, int)	call site: 04357	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEmEERS0_T_
39	4565	BitWriter::flush()	call site: 04565
30	3577	qpdf::pl::Count::write(unsigned char const*, unsigned long)	call site: 03577	__cxa_allocate_exception
30	4304	QPDFWriter::Members::writeObject(QPDFObjectHandle, int)	call site: 04304	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_
30	4534	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04534	__cxa_allocate_exception
27	4229	QPDFWriter::Members::writeTrailer(QPDFWriter::Members::trailer_e, int, bool, long long, int)	call site: 04229	__cxa_allocate_exception
27	4605	qpdf::pl::Count::~Count()	call site: 04605	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_

Runtime coverage analysis

Covered functions

1203

Functions that are reachable but not covered

459

Reachable functions

2008

Percentage of reachable functions covered

77.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	21
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDF.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	85
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	82
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	51
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	9
/src/qpdf/libqpdf/QPDFWriter.cc	90
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	1
/src/qpdf/libqpdf/QPDF_linearization.cc	17
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/Pl_MD5.cc	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1080	22.9%
gold	[1:9]	129	2.73%
yellow	[10:29]	83	1.76%
greenyellow	[30:49]	57	1.20%
lawngreen	50+	3364	71.3%
All colors	4713	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
108	4581	QPDFWriter::Members::write()	call site: 04581	_ZN10QPDFWriter7Members5writeITkNSt3__18integralExEERS0_T_
38	4360	QPDFWriter::Members::writeLinearized()	call site: 04360	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_
29	2933	ObjTable ::large_element(unsigned long)	call site: 02933	__cxa_allocate_exception
25	1449	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01449
25	2875	QPDFWriter::Members::copyEncryptionParameters(QPDF&)	call site: 02875
23	2421	qpdf::BaseHandle::copy(bool) const	call site: 02421	__cxa_allocate_exception
21	4145	QPDFWriter::Members::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04145
17	3372	QPDFWriter::Members::enqueueObject(QPDFObjectHandle)	call site: 03372
17	3409	QPDFWriter::Members::writeLinearized()	call site: 03409	fopen
17	4072	qpdf::BaseHandle::unparse() const	call site: 04072	__cxa_allocate_exception
15	1234	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01234	__cxa_allocate_exception
15	3672	deflate	call site: 03672	crc32

Runtime coverage analysis

Covered functions

1292

Functions that are reachable but not covered

304

Reachable functions

1990

Percentage of reachable functions covered

84.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	21
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDF.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	85
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	82
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	45
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	9
/src/qpdf/libqpdf/QPDFWriter.cc	88
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	1
/src/qpdf/libqpdf/QPDF_linearization.cc	17
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/Pl_MD5.cc	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1510	32.0%
gold	[1:9]	112	2.37%
yellow	[10:29]	99	2.10%
greenyellow	[30:49]	53	1.12%
lawngreen	50+	2938	62.3%
All colors	4712	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	3119	QPDFWriter::Members::prepareFileForWrite()	call site: 03119	__assert_fail
118	4357	QPDFWriter::Members::writeObjectStream(QPDFObjectHandle)	call site: 04357	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_
81	3661	Pl_Flate::checkError(char const*, int)	call site: 03661	deflate
69	4584	QPDFWriter::Members::writeStandard()	call site: 04584	__cxa_allocate_exception
40	2821	QPDFWriter::Members::generateID(bool)	call site: 02821
39	4512	BitWriter::flush()	call site: 04512
30	4481	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04481	__cxa_allocate_exception
27	4552	qpdf::pl::Count::~Count()	call site: 04552	_ZN10QPDFWriter7Members5writeITkNSt3__18integralEiEERS0_T_
23	2421	qpdf::BaseHandle::copy(bool) const	call site: 02421	__cxa_allocate_exception
23	3620	unsigned int QIntC::to_uint (unsigned long const&)	call site: 03620	deflateInit_
22	3451	QPDFWriter::Members::openObject(int)	call site: 03451	_ZN10QPDFWriter7Members5writeITkNSt3__18integralExEERS0_T_
21	4144	QPDFWriter::Members::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04144

Runtime coverage analysis

Covered functions

1235

Functions that are reachable but not covered

416

Reachable functions

1988

Percentage of reachable functions covered

79.07%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	21
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDF.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	32
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	3
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	17
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	85
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	46
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	82
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	45
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	4
/src/qpdf/libqpdf/QPDF_optimization.cc	9
/src/qpdf/libqpdf/QPDFWriter.cc	87
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	1
/src/qpdf/libqpdf/QPDF_linearization.cc	17
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/Pl_MD5.cc	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1