High level conclusions

Fuzzers reach 62.93% code coverage.

Fuzzers reach 58.36% of cyclomatic complexity.

Fuzzers reach 48.66% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1640 / 3370

Cyclomatic complexity statically reachable by fuzzers

20720 / 35500

Runtime code coverage of functions

2121 / 3370

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: future_ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	12.5%
gold	[1:9]	6	12.5%
yellow	[10:29]	10	20.8%
greenyellow	[30:49]	2	4.16%
lawngreen	50+	24	50.0%
All colors	48	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	7	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	40	FuzzHelper::doChecks()	call site: 00040
1	46	FuzzHelper::run()	call site: 00046	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

14

Reachable functions

41

Percentage of reachable functions covered

65.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	49	57.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	42.3%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
13	37	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00037	__cxa_allocate_exception
7	52	BitStream::getBitsSigned(unsigned long)	call site: 00052	__cxa_allocate_exception
5	62	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00062	__cxa_allocate_exception
3	81	FuzzHelper::run()	call site: 00081	__cxa_end_catch
1	68	Pl_TIFFPredictor::processRow()	call site: 00068

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

28

Reachable functions

79

Percentage of reachable functions covered

64.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	16.6%
gold	[1:9]	1	2.77%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	16.6%
lawngreen	50+	23	63.8%
All colors	36	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	7	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	28	FuzzHelper::doChecks()	call site: 00028
1	34	FuzzHelper::run()	call site: 00034	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

13

Reachable functions

40

Percentage of reachable functions covered

67.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	44.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.19%
greenyellow	[30:49]	5	8.19%
lawngreen	50+	24	39.3%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	14	FuzzHelper::doChecks()	call site: 00014	__cxa_allocate_exception
4	8	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00008	__cxa_allocate_exception
2	41	FuzzHelper::doChecks()	call site: 00041
1	59	FuzzHelper::run()	call site: 00059	__cxa_begin_catch

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

20

Reachable functions

53

Percentage of reachable functions covered

62.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: future_hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	16.6%
gold	[1:9]	1	2.77%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	16.6%
lawngreen	50+	23	63.8%
All colors	36	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	7	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	28	FuzzHelper::doChecks()	call site: 00028
1	34	FuzzHelper::run()	call site: 00034	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

13

Reachable functions

40

Percentage of reachable functions covered

67.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	6	12.5%
gold	[1:9]	6	12.5%
yellow	[10:29]	10	20.8%
greenyellow	[30:49]	2	4.16%
lawngreen	50+	24	50.0%
All colors	48	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4	7	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	40	FuzzHelper::doChecks()	call site: 00040
1	46	FuzzHelper::run()	call site: 00046	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

14

Reachable functions

41

Percentage of reachable functions covered

65.85%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: future_pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	43.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	35	56.4%
All colors	62	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
4	32	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00032
3	58	FuzzHelper::run()	call site: 00058	__cxa_end_catch

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

12

Reachable functions

57

Percentage of reachable functions covered

78.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	36.4%
gold	[1:9]	5	5.88%
yellow	[10:29]	5	5.88%
greenyellow	[30:49]	7	8.23%
lawngreen	50+	37	43.5%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00018	__cxa_allocate_exception
5	33	Pl_LZWDecoder::handleCode(unsigned int)	call site: 00033	__cxa_allocate_exception
5	50	Pl_LZWDecoder::handleCode(unsigned int)	call site: 00050	__cxa_allocate_exception
4	7	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00007	__cxa_allocate_exception
4	39	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00039	__cxa_allocate_exception
4	58	Pl_LZWDecoder::addToTable(unsigned char)	call site: 00058	__cxa_allocate_exception
1	83	FuzzHelper::run()	call site: 00083	__cxa_begin_catch

Runtime coverage analysis

Covered functions

29

Functions that are reachable but not covered

23

Reachable functions

70

Percentage of reachable functions covered

67.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	43.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	35	56.4%
All colors	62	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
4	32	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00032
3	58	FuzzHelper::run()	call site: 00058	__cxa_end_catch

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

12

Reachable functions

57

Percentage of reachable functions covered

78.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: future_lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	31	36.4%
gold	[1:9]	5	5.88%
yellow	[10:29]	5	5.88%
greenyellow	[30:49]	5	5.88%
lawngreen	50+	39	45.8%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	18	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00018	__cxa_allocate_exception
5	33	Pl_LZWDecoder::handleCode(unsigned int)	call site: 00033	__cxa_allocate_exception
5	50	Pl_LZWDecoder::handleCode(unsigned int)	call site: 00050	__cxa_allocate_exception
4	7	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00007	__cxa_allocate_exception
4	39	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00039	__cxa_allocate_exception
4	58	Pl_LZWDecoder::addToTable(unsigned char)	call site: 00058	__cxa_allocate_exception
1	83	FuzzHelper::run()	call site: 00083	__cxa_begin_catch

Runtime coverage analysis

Covered functions

29

Functions that are reachable but not covered

23

Reachable functions

70

Percentage of reachable functions covered

67.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: future_dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	179	55.0%
gold	[1:9]	18	5.53%
yellow	[10:29]	6	1.84%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	122	37.5%
All colors	325	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	97	init_simd	call site: 00097	jinit_forward_dct
32	48	std_huff_tables	call site: 00048	jpeg_start_compress
28	154	unsigned int QIntC::to_uint (int const&)	call site: 00154	jpeg_finish_compress
19	229	master_selection	call site: 00229	jinit_1pass_quantizer
11	32	jinit_memory_mgr	call site: 00032	jpeg_set_defaults
9	205	jpeg_core_output_dimensions	call site: 00205	jdiv_round_up
7	197	jpeg_calc_output_dimensions	call site: 00197	jdiv_round_up
4	11	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00011	__cxa_allocate_exception
3	23	Pl_DCT::finish()	call site: 00023	jpeg_CreateCompress
3	253	jinit_color_deconverter	call site: 00253	jsimd_can_ycc_rgb565
2	306	Pl_DCT::finish()	call site: 00306	jpeg_destroy_compress
1	18	FuzzHelper::doChecks()	call site: 00018

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

124

Reachable functions

231

Percentage of reachable functions covered

46.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2425	77.6%
gold	[1:9]	25	0.80%
yellow	[10:29]	46	1.47%
greenyellow	[30:49]	25	0.80%
lawngreen	50+	602	19.2%
All colors	3123	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
283	2629	QPDFObjectHandle::newArray(std::__1::vector > const&)	call site: 02629	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
221	1607	qpdf::BaseDictionary::dict() const	call site: 01607	__cxa_allocate_exception
221	2042	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02042	__cxa_allocate_exception
161	1880	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01880	__cxa_allocate_exception
103	2434	QPDFObjectHandle::getObjectID() const	call site: 02434	__cxa_allocate_exception
83	1373	QPDFObjectHandle::getIntValueAsInt() const	call site: 01373	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
81	805	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00805	__cxa_allocate_exception
75	1499	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01499	__dynamic_cast
70	1254	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01254	__cxa_allocate_exception
64	1087	QPDFLogger::defaultLogger()	call site: 01087	__cxa_end_catch
53	2284	QPDF::getObject(QPDFObjGen)	call site: 02284	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
44	704	QPDFParser::parseRemainder(bool)	call site: 00704	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

450

Functions that are reachable but not covered

762

Reachable functions

1463

Percentage of reachable functions covered

47.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	4
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	40
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	25
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	86
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	62
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	14
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: future_qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1182	21.5%
gold	[1:9]	109	1.98%
yellow	[10:29]	87	1.58%
greenyellow	[30:49]	55	1.00%
lawngreen	50+	4064	73.9%
All colors	5497	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
69	3310	NNTreeIterator::split(qpdf::Dictionary, std::__1::__list_iterator )	call site: 03310	__cxa_allocate_exception
59	5127	(anonymous namespace)::JSONParser::getToken()	call site: 05127	__cxa_allocate_exception
51	3237	NNTreeIterator::resetLimits(qpdf::Dictionary, std::__1::__list_iterator )	call site: 03237
21	4150	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04150	__cxa_allocate_exception
19	2405	qpdf::BaseHandle::copy(bool) const	call site: 02405	__cxa_allocate_exception
19	5260	(anonymous namespace)::JSONParser::handleToken()	call site: 05260	__cxa_allocate_exception
18	1235	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01235	__cxa_allocate_exception
16	5340	(anonymous namespace)::JSONParser::handleToken()	call site: 05340	__cxa_allocate_exception
15	2463	QPDF::Doc::Pages::pushInheritedAttributesToPageInternal(QPDFObjectHandle, std::__1::map , std::__1::allocator >, std::__1::vector >, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::vector > > > >&, bool, bool)	call site: 02463	__cxa_allocate_exception
14	1269	QPDFObjectHandle::getOwningQPDF() const	call site: 01269	__cxa_allocate_exception
13	4971	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 04971
11	165	qpdf::Tokenizer::inBeforeToken(char)	call site: 00165	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1320

Functions that are reachable but not covered

245

Reachable functions

2206

Percentage of reachable functions covered

88.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/QPDF.cc	22
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	31
/src/qpdf/libqpdf/QPDF_objects.cc	48
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	51
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	7
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	27
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	110
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	117
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	19
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	8
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	38
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/qpdf/FormField.hh	2
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	739	20.7%
gold	[1:9]	137	3.85%
yellow	[10:29]	61	1.71%
greenyellow	[30:49]	12	0.33%
lawngreen	50+	2606	73.3%
All colors	3555	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	2351	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02351	__cxa_allocate_exception
42	1222	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01222	__cxa_allocate_exception
15	2465	QPDF::Doc::Pages::pushInheritedAttributesToPageInternal(QPDFObjectHandle, std::__1::map , std::__1::allocator >, std::__1::vector >, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::vector > > > >&, bool, bool)	call site: 02465	__cxa_allocate_exception
14	1271	QPDFObjectHandle::getOwningQPDF() const	call site: 01271	__cxa_allocate_exception
11	174	qpdf::Tokenizer::inBeforeToken(char)	call site: 00174	__cxa_allocate_exception
10	913	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00913	__cxa_allocate_exception
9	1289	qpdf::BaseDictionary::dict() const	call site: 01289	__cxa_allocate_exception
9	1836	Pl_AES_PDF::flush(bool)	call site: 01836	__cxa_allocate_exception
8	22	long long QIntC::to_offset (unsigned long const&)	call site: 00022	__cxa_allocate_exception
8	1394	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01394
7	345	QPDF::warn(QPDFExc const&)	call site: 00345	__cxa_allocate_exception
7	654	QPDFObjectHandle::QPDFObjectHandle(QPDFObjectHandle const&)	call site: 00654

Runtime coverage analysis

Covered functions

987

Functions that are reachable but not covered

237

Reachable functions

1631

Percentage of reachable functions covered

85.47%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	46
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	28
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	32
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	24
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	67
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1080	19.6%
gold	[1:9]	125	2.27%
yellow	[10:29]	100	1.81%
greenyellow	[30:49]	55	1.00%
lawngreen	50+	4139	75.2%
All colors	5499	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
59	5129	(anonymous namespace)::JSONParser::getToken()	call site: 05129	__cxa_allocate_exception
21	4152	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04152	__cxa_allocate_exception
19	2407	qpdf::BaseHandle::copy(bool) const	call site: 02407	__cxa_allocate_exception
19	5262	(anonymous namespace)::JSONParser::handleToken()	call site: 05262	__cxa_allocate_exception
18	1237	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01237	__cxa_allocate_exception
16	5342	(anonymous namespace)::JSONParser::handleToken()	call site: 05342	__cxa_allocate_exception
15	2465	QPDF::Doc::Pages::pushInheritedAttributesToPageInternal(QPDFObjectHandle, std::__1::map , std::__1::allocator >, std::__1::vector >, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::vector > > > >&, bool, bool)	call site: 02465	__cxa_allocate_exception
15	4767	void QIntC::range_check_error (long long const&, long long const&)	call site: 04767	__cxa_allocate_exception
14	1271	QPDFObjectHandle::getOwningQPDF() const	call site: 01271	__cxa_allocate_exception
13	4973	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 04973
11	174	qpdf::Tokenizer::inBeforeToken(char)	call site: 00174	__cxa_allocate_exception
11	5215	(anonymous namespace)::JSONParser::getToken()	call site: 05215	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1320

Functions that are reachable but not covered

239

Reachable functions

2206

Percentage of reachable functions covered

89.17%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/include/qpdf/QIntC.hh	51
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	22
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	31
/src/qpdf/libqpdf/QPDF_objects.cc	48
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	7
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	27
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	110
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	117
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	19
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	8
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	38
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/qpdf/FormField.hh	2
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: future_qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	756	21.2%
gold	[1:9]	117	3.29%
yellow	[10:29]	75	2.11%
greenyellow	[30:49]	37	1.04%
lawngreen	50+	2568	72.2%
All colors	3553	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	2349	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02349	__cxa_allocate_exception
42	1220	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01220	__cxa_allocate_exception
25	1377	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01377
15	2463	QPDF::Doc::Pages::pushInheritedAttributesToPageInternal(QPDFObjectHandle, std::__1::map , std::__1::allocator >, std::__1::vector >, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::vector > > > >&, bool, bool)	call site: 02463	__cxa_allocate_exception
14	1269	QPDFObjectHandle::getOwningQPDF() const	call site: 01269	__cxa_allocate_exception
11	165	qpdf::Tokenizer::inBeforeToken(char)	call site: 00165	__cxa_allocate_exception
10	911	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00911	__cxa_allocate_exception
10	1364	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01364
9	1287	qpdf::BaseDictionary::dict() const	call site: 01287	__cxa_allocate_exception
9	1834	Pl_AES_PDF::flush(bool)	call site: 01834	__cxa_allocate_exception
8	40	unsigned long QIntC::to_size (long const&)	call site: 00040	__cxa_allocate_exception
7	336	QPDF::warn(QPDFExc const&)	call site: 00336	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

991

Functions that are reachable but not covered

239

Reachable functions

1631

Percentage of reachable functions covered

85.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	28
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	46
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	32
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	24
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	67
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1177	24.6%
gold	[1:9]	128	2.68%
yellow	[10:29]	104	2.17%
greenyellow	[30:49]	54	1.13%
lawngreen	50+	3310	69.3%
All colors	4773	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
92	4657	qpdf::impl::Writer::write()	call site: 04657	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
42	1222	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01222	__cxa_allocate_exception
39	4434	qpdf::impl::Writer::writeLinearized()	call site: 04434	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
27	2971	ObjTable ::large_element(unsigned long)	call site: 02971	__cxa_allocate_exception
25	1379	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01379
25	2401	qpdf::BaseHandle::copy(bool) const	call site: 02401	__cxa_allocate_exception
22	4207	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04207
18	3435	qpdf::impl::Writer::writeLinearized()	call site: 03435	fopen
17	4130	qpdf::BaseHandle::unparse() const	call site: 04130	__cxa_allocate_exception
16	2905	qpdf::impl::Writer::doWriteSetup()	call site: 02905
15	2465	QPDF::Doc::Pages::pushInheritedAttributesToPageInternal(QPDFObjectHandle, std::__1::map , std::__1::allocator >, std::__1::vector >, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::vector > > > >&, bool, bool)	call site: 02465	__cxa_allocate_exception
15	3698	deflate	call site: 03698	crc32

Runtime coverage analysis

Covered functions

1329

Functions that are reachable but not covered

328

Reachable functions

2078

Percentage of reachable functions covered

84.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	84
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	44.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.19%
greenyellow	[30:49]	5	8.19%
lawngreen	50+	24	39.3%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	14	FuzzHelper::doChecks()	call site: 00014	__cxa_allocate_exception
4	8	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00008	__cxa_allocate_exception
2	41	FuzzHelper::doChecks()	call site: 00041
1	59	FuzzHelper::run()	call site: 00059	__cxa_begin_catch

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

20

Reachable functions

53

Percentage of reachable functions covered

62.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	143	63.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	83	36.7%
All colors	226	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	157	deflate	call site: 00157	inflate
15	86	deflate	call site: 00086	crc32
13	44	deflateResetKeep	call site: 00044	crc32_z
12	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
11	143	deflate	call site: 00143	_tr_flush_block
8	63	deflateReset	call site: 00063	inflateInit_
7	208	Pl_Flate::finish()	call site: 00208	__cxa_begin_catch
6	185	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00185	__cxa_allocate_exception
6	195	FuzzHelper::doChecks()	call site: 00195	__cxa_allocate_exception
5	28	Pl_Flate::write(unsigned char const*, unsigned long)	call site: 00028	__cxa_allocate_exception
5	137	_tr_flush_block	call site: 00137	_tr_flush_block
4	23	FuzzHelper::doChecks()	call site: 00023	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

66

Functions that are reachable but not covered

55

Reachable functions

130

Percentage of reachable functions covered

57.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1

Fuzzer: future_tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	49	57.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	42.3%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
13	37	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00037	__cxa_allocate_exception
7	52	BitStream::getBitsSigned(unsigned long)	call site: 00052	__cxa_allocate_exception
5	62	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00062	__cxa_allocate_exception
3	81	FuzzHelper::run()	call site: 00081	__cxa_end_catch
1	68	Pl_TIFFPredictor::processRow()	call site: 00068

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

28

Reachable functions

79

Percentage of reachable functions covered

64.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	143	63.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	83	36.7%
All colors	226	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	157	deflate	call site: 00157	inflate
15	86	deflate	call site: 00086	crc32
13	44	deflateResetKeep	call site: 00044	crc32_z
12	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
11	143	deflate	call site: 00143	_tr_flush_block
8	63	deflateReset	call site: 00063	inflateInit_
7	208	Pl_Flate::finish()	call site: 00208	__cxa_begin_catch
6	185	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00185	__cxa_allocate_exception
6	195	FuzzHelper::doChecks()	call site: 00195	__cxa_allocate_exception
5	28	Pl_Flate::write(unsigned char const*, unsigned long)	call site: 00028	__cxa_allocate_exception
5	137	_tr_flush_block	call site: 00137	_tr_flush_block
4	23	FuzzHelper::doChecks()	call site: 00023	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

66

Functions that are reachable but not covered

55

Reachable functions

130

Percentage of reachable functions covered

57.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1

Fuzzer: future_qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1172	24.5%
gold	[1:9]	130	2.72%
yellow	[10:29]	88	1.84%
greenyellow	[30:49]	72	1.50%
lawngreen	50+	3309	69.3%
All colors	4771	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
92	4655	qpdf::impl::Writer::write()	call site: 04655	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
42	1220	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01220	__cxa_allocate_exception
39	4432	qpdf::impl::Writer::writeLinearized()	call site: 04432	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
27	2969	ObjTable ::large_element(unsigned long)	call site: 02969	__cxa_allocate_exception
25	1377	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01377
25	2399	qpdf::BaseHandle::copy(bool) const	call site: 02399	__cxa_allocate_exception
22	4205	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04205
18	3433	qpdf::impl::Writer::writeLinearized()	call site: 03433	fopen
17	4128	qpdf::BaseHandle::unparse() const	call site: 04128	__cxa_allocate_exception
16	2903	qpdf::impl::Writer::doWriteSetup()	call site: 02903
15	2463	QPDF::Doc::Pages::pushInheritedAttributesToPageInternal(QPDFObjectHandle, std::__1::map , std::__1::allocator >, std::__1::vector >, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::vector > > > >&, bool, bool)	call site: 02463	__cxa_allocate_exception
15	3696	deflate	call site: 03696	crc32

Runtime coverage analysis

Covered functions

1334

Functions that are reachable but not covered

328

Reachable functions

2078

Percentage of reachable functions covered

84.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	84
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1120	23.2%
gold	[1:9]	99	2.05%
yellow	[10:29]	126	2.61%
greenyellow	[30:49]	46	0.95%
lawngreen	50+	3431	71.1%
All colors	4822	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
92	4706	qpdf::impl::Writer::write()	call site: 04706	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
47	2906	qpdf::impl::Writer::doWriteSetup()	call site: 02906
42	1220	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01220	__cxa_allocate_exception
26	2806	qpdf::impl::Writer::generateID(bool)	call site: 02806	__cxa_allocate_exception
25	2399	qpdf::BaseHandle::copy(bool) const	call site: 02399	__cxa_allocate_exception
19	4298	qpdf::impl::Writer::writeTrailer(qpdf::impl::Writer::trailer_e, int, bool, long long, int)	call site: 04298	__cxa_allocate_exception
18	3484	qpdf::impl::Writer::writeLinearized()	call site: 03484	fopen
17	4179	qpdf::BaseHandle::unparse() const	call site: 04179	__cxa_allocate_exception
16	2843	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02843	__cxa_allocate_exception
16	2954	qpdf::impl::Writer::doWriteSetup()	call site: 02954
15	2463	QPDF::Doc::Pages::pushInheritedAttributesToPageInternal(QPDFObjectHandle, std::__1::map , std::__1::allocator >, std::__1::vector >, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::vector > > > >&, bool, bool)	call site: 02463	__cxa_allocate_exception
15	3747	deflate	call site: 03747	crc32

Runtime coverage analysis

Covered functions

1333

Functions that are reachable but not covered

338

Reachable functions

2096

Percentage of reachable functions covered

83.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1610	33.7%
gold	[1:9]	101	2.11%
yellow	[10:29]	61	1.27%
greenyellow	[30:49]	87	1.82%
lawngreen	50+	2911	61.0%
All colors	4770	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
222	3150	qpdf::impl::Writer::write()	call site: 03150	__assert_fail
120	4429	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04429	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3685	Pl_Flate::checkError(char const*, int)	call site: 03685	deflate
54	4661	qpdf::impl::Writer::writeStandard()	call site: 04661
42	1222	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01222	__cxa_allocate_exception
42	2846	qpdf::impl::Writer::generateID(bool)	call site: 02846
39	4586	BitWriter::flush()	call site: 04586
30	4555	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04555	__cxa_allocate_exception
27	4626	qpdf::pl::Count::~Count()	call site: 04626	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
25	2401	qpdf::BaseHandle::copy(bool) const	call site: 02401	__cxa_allocate_exception
23	3430	(anonymous namespace)::Pl_stack::popper()	call site: 03430	fopen
23	3479	qpdf::impl::Writer::openObject(int)	call site: 03479	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_

Runtime coverage analysis

Covered functions

1275

Functions that are reachable but not covered

431

Reachable functions

2074

Percentage of reachable functions covered

79.22%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	82
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1820	37.7%
gold	[1:9]	107	2.21%
yellow	[10:29]	104	2.15%
greenyellow	[30:49]	48	0.99%
lawngreen	50+	2743	56.8%
All colors	4822	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
233	3202	qpdf::impl::Writer::write()	call site: 03202	__assert_fail
79	4522	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04522	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
75	3020	ObjTable ::large_element(unsigned long)	call site: 03020	__cxa_allocate_exception
57	4427	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04427	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
54	4713	qpdf::impl::Writer::writeStandard()	call site: 04713
47	2906	qpdf::impl::Writer::doWriteSetup()	call site: 02906
42	1222	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01222	__cxa_allocate_exception
39	4638	BitWriter::flush()	call site: 04638
34	4365	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04365	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
30	3608	qpdf::pl::Count::write(unsigned char const*, unsigned long)	call site: 03608	__cxa_allocate_exception
30	4607	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04607	__cxa_allocate_exception
29	3482	(anonymous namespace)::Pl_stack::popper()	call site: 03482	fopen

Runtime coverage analysis

Covered functions

1244

Functions that are reachable but not covered

479

Reachable functions

2094

Percentage of reachable functions covered

77.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	179	55.0%
gold	[1:9]	18	5.53%
yellow	[10:29]	6	1.84%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	122	37.5%
All colors	325	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	97	init_simd	call site: 00097	jinit_forward_dct
32	48	std_huff_tables	call site: 00048	jpeg_start_compress
28	154	unsigned int QIntC::to_uint (int const&)	call site: 00154	jpeg_finish_compress
19	229	master_selection	call site: 00229	jinit_1pass_quantizer
11	32	jinit_memory_mgr	call site: 00032	jpeg_set_defaults
9	205	jpeg_core_output_dimensions	call site: 00205	jdiv_round_up
7	197	jpeg_calc_output_dimensions	call site: 00197	jdiv_round_up
4	11	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00011	__cxa_allocate_exception
3	23	Pl_DCT::finish()	call site: 00023	jpeg_CreateCompress
3	253	jinit_color_deconverter	call site: 00253	jsimd_can_ycc_rgb565
2	306	Pl_DCT::finish()	call site: 00306	jpeg_destroy_compress
1	18	FuzzHelper::doChecks()	call site: 00018

Runtime coverage analysis

Covered functions

206

Functions that are reachable but not covered

124

Reachable functions

231

Percentage of reachable functions covered

46.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1613	33.8%
gold	[1:9]	129	2.70%
yellow	[10:29]	88	1.84%
greenyellow	[30:49]	48	1.00%
lawngreen	50+	2890	60.6%
All colors	4768	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
222	3148	qpdf::impl::Writer::write()	call site: 03148	__assert_fail
120	4427	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04427	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3683	Pl_Flate::checkError(char const*, int)	call site: 03683	deflate
54	4659	qpdf::impl::Writer::writeStandard()	call site: 04659
42	1220	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01220	__cxa_allocate_exception
42	2844	qpdf::impl::Writer::generateID(bool)	call site: 02844
39	4584	BitWriter::flush()	call site: 04584
30	4553	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04553	__cxa_allocate_exception
27	4624	qpdf::pl::Count::~Count()	call site: 04624	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
25	2399	qpdf::BaseHandle::copy(bool) const	call site: 02399	__cxa_allocate_exception
23	3428	(anonymous namespace)::Pl_stack::popper()	call site: 03428	fopen
23	3477	qpdf::impl::Writer::openObject(int)	call site: 03477	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_

Runtime coverage analysis

Covered functions

1278

Functions that are reachable but not covered

435

Reachable functions

2074

Percentage of reachable functions covered

79.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	82
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2425	77.6%
gold	[1:9]	31	0.99%
yellow	[10:29]	49	1.56%
greenyellow	[30:49]	12	0.38%
lawngreen	50+	606	19.4%
All colors	3123	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
283	2629	QPDFObjectHandle::newArray(std::__1::vector > const&)	call site: 02629	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
221	1607	qpdf::BaseDictionary::dict() const	call site: 01607	__cxa_allocate_exception
221	2042	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02042	__cxa_allocate_exception
161	1880	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01880	__cxa_allocate_exception
103	2434	QPDFObjectHandle::getObjectID() const	call site: 02434	__cxa_allocate_exception
83	1373	QPDFObjectHandle::getIntValueAsInt() const	call site: 01373	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
81	805	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00805	__cxa_allocate_exception
75	1499	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01499	__dynamic_cast
70	1254	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01254	__cxa_allocate_exception
64	1087	QPDFLogger::defaultLogger()	call site: 01087	__cxa_end_catch
53	2284	QPDF::getObject(QPDFObjGen)	call site: 02284	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
44	704	QPDFParser::parseRemainder(bool)	call site: 00704	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

448

Functions that are reachable but not covered

762

Reachable functions

1463

Percentage of reachable functions covered

47.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	4
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	40
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	25
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	86
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	62
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	14
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1121	23.2%
gold	[1:9]	109	2.25%
yellow	[10:29]	97	2.01%
greenyellow	[30:49]	69	1.43%
lawngreen	50+	3428	71.0%
All colors	4824	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
92	4708	qpdf::impl::Writer::write()	call site: 04708	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
47	2908	qpdf::impl::Writer::doWriteSetup()	call site: 02908
42	1222	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01222	__cxa_allocate_exception
26	2808	qpdf::impl::Writer::generateID(bool)	call site: 02808	__cxa_allocate_exception
25	2401	qpdf::BaseHandle::copy(bool) const	call site: 02401	__cxa_allocate_exception
19	4300	qpdf::impl::Writer::writeTrailer(qpdf::impl::Writer::trailer_e, int, bool, long long, int)	call site: 04300	__cxa_allocate_exception
18	3486	qpdf::impl::Writer::writeLinearized()	call site: 03486	fopen
17	4181	qpdf::BaseHandle::unparse() const	call site: 04181	__cxa_allocate_exception
16	2845	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02845	__cxa_allocate_exception
16	2956	qpdf::impl::Writer::doWriteSetup()	call site: 02956
15	2465	QPDF::Doc::Pages::pushInheritedAttributesToPageInternal(QPDFObjectHandle, std::__1::map , std::__1::allocator >, std::__1::vector >, std::__1::less , std::__1::allocator > >, std::__1::allocator , std::__1::allocator > const, std::__1::vector > > > >&, bool, bool)	call site: 02465	__cxa_allocate_exception
15	3749	deflate	call site: 03749	crc32

Runtime coverage analysis

Covered functions

1330

Functions that are reachable but not covered

338

Reachable functions

2096

Percentage of reachable functions covered

83.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1821	37.7%
gold	[1:9]	121	2.51%
yellow	[10:29]	94	1.95%
greenyellow	[30:49]	56	1.16%
lawngreen	50+	2728	56.5%
All colors	4820	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
233	3200	qpdf::impl::Writer::write()	call site: 03200	__assert_fail
79	4520	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04520	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
75	3018	ObjTable ::large_element(unsigned long)	call site: 03018	__cxa_allocate_exception
57	4425	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04425	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
54	4711	qpdf::impl::Writer::writeStandard()	call site: 04711
47	2904	qpdf::impl::Writer::doWriteSetup()	call site: 02904
42	1220	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01220	__cxa_allocate_exception
39	4636	BitWriter::flush()	call site: 04636
34	4363	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04363	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
30	3606	qpdf::pl::Count::write(unsigned char const*, unsigned long)	call site: 03606	__cxa_allocate_exception
30	4605	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04605	__cxa_allocate_exception
29	3480	(anonymous namespace)::Pl_stack::popper()	call site: 03480	fopen

Runtime coverage analysis

Covered functions

1249

Functions that are reachable but not covered

479

Reachable functions

2094

Percentage of reachable functions covered

77.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	6
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1