High level conclusions

Fuzzers reach 63.21% code coverage.

Fuzzers reach 58.49% of cyclomatic complexity.

Fuzzers reach 48.97% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1675 / 3420

Cyclomatic complexity statically reachable by fuzzers

20881 / 35697

Runtime code coverage of functions

2162 / 3420

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: future_runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	44.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.19%
greenyellow	[30:49]	5	8.19%
lawngreen	50+	24	39.3%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	14	FuzzHelper::doChecks()	call site: 00014	__cxa_allocate_exception
4	8	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00008	__cxa_allocate_exception
2	41	FuzzHelper::doChecks()	call site: 00041
1	59	FuzzHelper::run()	call site: 00059	__cxa_begin_catch

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

20

Reachable functions

53

Percentage of reachable functions covered

62.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: future_pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	43.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	35	56.4%
All colors	62	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
4	32	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00032
3	58	FuzzHelper::run()	call site: 00058	__cxa_end_catch

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

12

Reachable functions

57

Percentage of reachable functions covered

78.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: future_tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	49	57.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	42.3%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
13	37	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00037	__cxa_allocate_exception
7	52	BitStream::getBitsSigned(unsigned long)	call site: 00052	__cxa_allocate_exception
5	62	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00062	__cxa_allocate_exception
3	81	FuzzHelper::run()	call site: 00081	__cxa_end_catch
1	68	Pl_TIFFPredictor::processRow()	call site: 00068

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

28

Reachable functions

79

Percentage of reachable functions covered

64.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.4%
gold	[1:9]	1	2.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	15.7%
lawngreen	50+	24	63.1%
All colors	38	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	30	FuzzHelper::doChecks()	call site: 00030
1	36	FuzzHelper::run()	call site: 00036	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

15

Reachable functions

44

Percentage of reachable functions covered

65.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: future_lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.75%
greenyellow	[30:49]	5	6.75%
lawngreen	50+	44	59.4%
All colors	74	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	20	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00020	__cxa_allocate_exception
5	8	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00008	__cxa_allocate_exception
5	35	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00035	__cxa_allocate_exception
1	41	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00041
1	72	FuzzHelper::run()	call site: 00072	__cxa_begin_catch

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

25

Reachable functions

82

Percentage of reachable functions covered

69.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	43.5%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	35	56.4%
All colors	62	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
4	32	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00032
3	58	FuzzHelper::run()	call site: 00058	__cxa_end_catch

Runtime coverage analysis

Covered functions

25

Functions that are reachable but not covered

12

Reachable functions

57

Percentage of reachable functions covered

78.95%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.75%
greenyellow	[30:49]	5	6.75%
lawngreen	50+	44	59.4%
All colors	74	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	20	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00020	__cxa_allocate_exception
5	8	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00008	__cxa_allocate_exception
5	35	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00035	__cxa_allocate_exception
1	41	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00041
1	72	FuzzHelper::run()	call site: 00072	__cxa_begin_catch

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

25

Reachable functions

82

Percentage of reachable functions covered

69.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.4%
gold	[1:9]	1	2.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	15.7%
lawngreen	50+	24	63.1%
All colors	38	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	30	FuzzHelper::doChecks()	call site: 00030
1	36	FuzzHelper::run()	call site: 00036	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

15

Reachable functions

44

Percentage of reachable functions covered

65.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	49	57.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	36	42.3%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
13	37	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00037	__cxa_allocate_exception
7	52	BitStream::getBitsSigned(unsigned long)	call site: 00052	__cxa_allocate_exception
5	62	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00062	__cxa_allocate_exception
3	81	FuzzHelper::run()	call site: 00081	__cxa_end_catch
1	68	Pl_TIFFPredictor::processRow()	call site: 00068

Runtime coverage analysis

Covered functions

28

Functions that are reachable but not covered

28

Reachable functions

79

Percentage of reachable functions covered

64.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	27	44.2%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.19%
greenyellow	[30:49]	5	8.19%
lawngreen	50+	24	39.3%
All colors	61	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	14	FuzzHelper::doChecks()	call site: 00014	__cxa_allocate_exception
4	8	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00008	__cxa_allocate_exception
2	41	FuzzHelper::doChecks()	call site: 00041
1	59	FuzzHelper::run()	call site: 00059	__cxa_begin_catch

Runtime coverage analysis

Covered functions

21

Functions that are reachable but not covered

20

Reachable functions

53

Percentage of reachable functions covered

62.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.2%
gold	[1:9]	5	10.2%
yellow	[10:29]	12	24.4%
greenyellow	[30:49]	2	4.08%
lawngreen	50+	23	46.9%
All colors	49	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	41	FuzzHelper::doChecks()	call site: 00041
1	47	FuzzHelper::run()	call site: 00047	__cxa_begin_catch

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

16

Reachable functions

47

Percentage of reachable functions covered

65.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	62.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	37.8%
All colors	227	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	158	deflate	call site: 00158	inflate
15	87	deflate	call site: 00087	crc32
13	45	deflateResetKeep	call site: 00045	crc32_z
11	144	deflate	call site: 00144	_tr_flush_block
8	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
8	64	deflateReset	call site: 00064	inflateInit_
7	209	Pl_Flate::finish()	call site: 00209	__cxa_begin_catch
6	186	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00186	__cxa_allocate_exception
6	196	FuzzHelper::doChecks()	call site: 00196	__cxa_allocate_exception
5	18	Pl_Flate::Pl_Flate(char const*, Pipeline*, Pl_Flate::action_e, unsigned int)	call site: 00018	__cxa_allocate_exception
5	29	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00029	__cxa_allocate_exception
5	138	_tr_flush_block	call site: 00138	_tr_flush_block

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

57

Reachable functions

138

Percentage of reachable functions covered

58.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1

Fuzzer: future_flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	62.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	37.8%
All colors	227	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	158	deflate	call site: 00158	inflate
15	87	deflate	call site: 00087	crc32
13	45	deflateResetKeep	call site: 00045	crc32_z
11	144	deflate	call site: 00144	_tr_flush_block
8	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
8	64	deflateReset	call site: 00064	inflateInit_
7	209	Pl_Flate::finish()	call site: 00209	__cxa_begin_catch
6	186	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00186	__cxa_allocate_exception
6	196	FuzzHelper::doChecks()	call site: 00196	__cxa_allocate_exception
5	18	Pl_Flate::Pl_Flate(char const*, Pipeline*, Pl_Flate::action_e, unsigned int)	call site: 00018	__cxa_allocate_exception
5	29	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00029	__cxa_allocate_exception
5	138	_tr_flush_block	call site: 00138	_tr_flush_block

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

57

Reachable functions

138

Percentage of reachable functions covered

58.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1

Fuzzer: future_ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.2%
gold	[1:9]	5	10.2%
yellow	[10:29]	12	24.4%
greenyellow	[30:49]	2	4.08%
lawngreen	50+	23	46.9%
All colors	49	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	41	FuzzHelper::doChecks()	call site: 00041
1	47	FuzzHelper::run()	call site: 00047	__cxa_begin_catch

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

16

Reachable functions

47

Percentage of reachable functions covered

65.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: future_dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	55.3%
gold	[1:9]	18	5.47%
yellow	[10:29]	6	1.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	37.3%
All colors	329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	99	init_simd	call site: 00099	jinit_forward_dct
32	50	std_huff_tables	call site: 00050	jpeg_start_compress
30	156	unsigned int QIntC::to_uint (int const&)	call site: 00156	jpeg_finish_compress
19	233	master_selection	call site: 00233	jinit_1pass_quantizer
11	34	jinit_memory_mgr	call site: 00034	jpeg_set_defaults
9	209	jpeg_core_output_dimensions	call site: 00209	jdiv_round_up
7	201	jpeg_calc_output_dimensions	call site: 00201	jdiv_round_up
5	12	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00012	__cxa_allocate_exception
3	25	Pl_DCT::finish()	call site: 00025	jpeg_CreateCompress
3	257	jinit_color_deconverter	call site: 00257	jsimd_can_ycc_rgb565
2	310	Pl_DCT::finish()	call site: 00310	jpeg_destroy_compress
1	20	FuzzHelper::doChecks()	call site: 00020

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

128

Reachable functions

237

Percentage of reachable functions covered

45.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	55.3%
gold	[1:9]	18	5.47%
yellow	[10:29]	6	1.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	37.3%
All colors	329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	99	init_simd	call site: 00099	jinit_forward_dct
32	50	std_huff_tables	call site: 00050	jpeg_start_compress
30	156	unsigned int QIntC::to_uint (int const&)	call site: 00156	jpeg_finish_compress
19	233	master_selection	call site: 00233	jinit_1pass_quantizer
11	34	jinit_memory_mgr	call site: 00034	jpeg_set_defaults
9	209	jpeg_core_output_dimensions	call site: 00209	jdiv_round_up
7	201	jpeg_calc_output_dimensions	call site: 00201	jdiv_round_up
5	12	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00012	__cxa_allocate_exception
3	25	Pl_DCT::finish()	call site: 00025	jpeg_CreateCompress
3	257	jinit_color_deconverter	call site: 00257	jsimd_can_ycc_rgb565
2	310	Pl_DCT::finish()	call site: 00310	jpeg_destroy_compress
1	20	FuzzHelper::doChecks()	call site: 00020

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

128

Reachable functions

237

Percentage of reachable functions covered

45.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2358	75.7%
gold	[1:9]	30	0.96%
yellow	[10:29]	46	1.47%
greenyellow	[30:49]	16	0.51%
lawngreen	50+	664	21.3%
All colors	3114	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
220	2673	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02673	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
201	2066	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02066	__cxa_allocate_exception
180	1657	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01657	__cxa_guard_acquire
162	1903	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01903	__cxa_allocate_exception
101	2433	QPDFObjectHandle::getObjectID() const	call site: 02433	__cxa_allocate_exception
86	1377	QPDFObjectHandle::getIntValueAsInt() const	call site: 01377	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
81	806	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00806	__cxa_allocate_exception
70	1258	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01258	__cxa_allocate_exception
64	1091	QPDFLogger::defaultLogger()	call site: 01091	__cxa_end_catch
60	2276	QPDF::Doc::Objects::readTrailer()	call site: 02276	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
54	1506	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01506	__dynamic_cast
44	705	QPDFParser::parseRemainder(bool)	call site: 00705	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

459

Functions that are reachable but not covered

777

Reachable functions

1481

Percentage of reachable functions covered

47.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	13
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	40
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	25
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	86
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	62
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	14
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: future_qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	618	17.4%
gold	[1:9]	117	3.31%
yellow	[10:29]	86	2.43%
greenyellow	[30:49]	43	1.21%
lawngreen	50+	2669	75.5%
All colors	3533	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	2364	std::__1::shared_ptr QPDFObject::create , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)	call site: 02364	__cxa_allocate_exception
25	1383	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01383
19	2343	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02343	__cxa_allocate_exception
17	1224	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01224	__cxa_allocate_exception
14	1249	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01249	__cxa_allocate_exception
11	165	qpdf::Tokenizer::inBeforeToken(char)	call site: 00165	__cxa_allocate_exception
10	912	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00912	__cxa_allocate_exception
10	1370	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01370
8	40	unsigned long QIntC::to_size (long const&)	call site: 00040	__cxa_allocate_exception
7	337	QPDF::warn(QPDFExc const&)	call site: 00337	__cxa_allocate_exception
7	1144	QPDFObjectHandle::getName() const	call site: 01144	__cxa_allocate_exception
7	2465	QPDFObjectHandle::getKeys() const	call site: 02465	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1016

Functions that are reachable but not covered

236

Reachable functions

1653

Percentage of reachable functions covered

85.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	28
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	46
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	32
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/libqpdf/qpdf/Util.hh	17
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	24
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	67
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	930	16.9%
gold	[1:9]	110	2.00%
yellow	[10:29]	122	2.21%
greenyellow	[30:49]	52	0.94%
lawngreen	50+	4285	77.9%
All colors	5499	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
59	5125	(anonymous namespace)::JSONParser::getToken()	call site: 05125	__cxa_allocate_exception
21	4142	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04142	__cxa_allocate_exception
19	2401	qpdf::BaseHandle::copy(bool) const	call site: 02401	__cxa_allocate_exception
19	5258	(anonymous namespace)::JSONParser::handleToken()	call site: 05258	__cxa_allocate_exception
19	5338	(anonymous namespace)::JSONParser::handleToken()	call site: 05338	__cxa_allocate_exception
13	4970	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 04970
11	174	qpdf::Tokenizer::inBeforeToken(char)	call site: 00174	__cxa_allocate_exception
11	4764	void QIntC::range_check_error (long long const&, long long const&)	call site: 04764	__cxa_allocate_exception
11	5211	(anonymous namespace)::JSONParser::getToken()	call site: 05211	__cxa_allocate_exception
11	5224	(anonymous namespace)::JSONParser::getToken()	call site: 05224	__cxa_allocate_exception
10	914	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00914	__cxa_allocate_exception
10	1251	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01251	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1355

Functions that are reachable but not covered

236

Reachable functions

2250

Percentage of reachable functions covered

89.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/include/qpdf/QIntC.hh	51
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	22
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	31
/src/qpdf/libqpdf/QPDF_objects.cc	48
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	20
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	27
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	112
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	117
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	19
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	8
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/qpdf/FormField.hh	13
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: future_qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1029	18.7%
gold	[1:9]	115	2.09%
yellow	[10:29]	80	1.45%
greenyellow	[30:49]	67	1.21%
lawngreen	50+	4206	76.5%
All colors	5497	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
65	3294	NNTreeIterator::split(qpdf::Dictionary, std::__1::__list_iterator )	call site: 03294
59	5123	(anonymous namespace)::JSONParser::getToken()	call site: 05123	__cxa_allocate_exception
54	3221	NNTreeIterator::resetLimits(qpdf::Dictionary, std::__1::__list_iterator )	call site: 03221
21	4140	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04140	__cxa_allocate_exception
19	2399	qpdf::BaseHandle::copy(bool) const	call site: 02399	__cxa_allocate_exception
19	5256	(anonymous namespace)::JSONParser::handleToken()	call site: 05256	__cxa_allocate_exception
19	5336	(anonymous namespace)::JSONParser::handleToken()	call site: 05336	__cxa_allocate_exception
13	4968	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 04968
11	165	qpdf::Tokenizer::inBeforeToken(char)	call site: 00165	__cxa_allocate_exception
11	5209	(anonymous namespace)::JSONParser::getToken()	call site: 05209	__cxa_allocate_exception
11	5222	(anonymous namespace)::JSONParser::getToken()	call site: 05222	__cxa_allocate_exception
10	912	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00912	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1354

Functions that are reachable but not covered

242

Reachable functions

2250

Percentage of reachable functions covered

89.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/QPDF.cc	22
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	31
/src/qpdf/libqpdf/QPDF_objects.cc	48
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	51
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	20
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	27
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	112
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	117
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	19
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	8
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/qpdf/FormField.hh	13
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: future_qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1671	34.8%
gold	[1:9]	134	2.79%
yellow	[10:29]	95	1.98%
greenyellow	[30:49]	52	1.08%
lawngreen	50+	2838	59.2%
All colors	4790	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
234	3184	qpdf::impl::Writer::write()	call site: 03184	__assert_fail
79	4493	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04493	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
75	3002	ObjTable ::large_element(unsigned long)	call site: 03002	__cxa_allocate_exception
57	4398	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04398	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
54	4684	qpdf::impl::Writer::writeStandard()	call site: 04684
47	2892	qpdf::impl::Writer::doWriteSetup()	call site: 02892
39	4609	BitWriter::flush()	call site: 04609
34	4336	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04336	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
30	3591	qpdf::pl::Count::write(unsigned char const*, unsigned long)	call site: 03591	__cxa_allocate_exception
30	4578	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04578	__cxa_allocate_exception
29	3465	(anonymous namespace)::Pl_stack::popper()	call site: 03465	fopen
27	4649	qpdf::pl::Count::~Count()	call site: 04649	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_

Runtime coverage analysis

Covered functions

1274

Functions that are reachable but not covered

484

Reachable functions

2126

Percentage of reachable functions covered

77.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1458	30.7%
gold	[1:9]	117	2.46%
yellow	[10:29]	55	1.16%
greenyellow	[30:49]	77	1.62%
lawngreen	50+	3033	63.9%
All colors	4740	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	3134	qpdf::impl::Writer::write()	call site: 03134	__assert_fail
120	4402	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04402	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3667	Pl_Flate::checkError(char const*, int)	call site: 03667	deflate
54	4634	qpdf::impl::Writer::writeStandard()	call site: 04634
42	2834	qpdf::impl::Writer::generateID(bool)	call site: 02834
39	4559	BitWriter::flush()	call site: 04559
30	4528	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04528	__cxa_allocate_exception
27	4599	qpdf::pl::Count::~Count()	call site: 04599	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
25	2395	qpdf::BaseHandle::copy(bool) const	call site: 02395	__cxa_allocate_exception
23	3415	(anonymous namespace)::Pl_stack::popper()	call site: 03415	fopen
23	3464	qpdf::impl::Writer::openObject(int)	call site: 03464	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
23	3626	unsigned int QIntC::to_uint (unsigned long const&)	call site: 03626	deflateInit_

Runtime coverage analysis

Covered functions

1302

Functions that are reachable but not covered

434

Reachable functions

2106

Percentage of reachable functions covered

79.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	82
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	600	16.9%
gold	[1:9]	147	4.15%
yellow	[10:29]	65	1.83%
greenyellow	[30:49]	9	0.25%
lawngreen	50+	2714	76.7%
All colors	3535	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	2366	std::__1::shared_ptr QPDFObject::create , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)	call site: 02366	__cxa_allocate_exception
19	2345	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02345	__cxa_allocate_exception
17	1226	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01226	__cxa_allocate_exception
14	1251	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01251	__cxa_allocate_exception
11	174	qpdf::Tokenizer::inBeforeToken(char)	call site: 00174	__cxa_allocate_exception
10	914	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00914	__cxa_allocate_exception
8	22	long long QIntC::to_offset (unsigned long const&)	call site: 00022	__cxa_allocate_exception
8	1400	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01400
7	346	QPDF::warn(QPDFExc const&)	call site: 00346	__cxa_allocate_exception
7	1146	QPDFObjectHandle::getName() const	call site: 01146	__cxa_allocate_exception
7	1375	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01375
7	2467	QPDFObjectHandle::getKeys() const	call site: 02467	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1013

Functions that are reachable but not covered

234

Reachable functions

1653

Percentage of reachable functions covered

85.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	46
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	28
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	32
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/libqpdf/qpdf/Util.hh	17
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	24
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	67
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: future_qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1025	21.6%
gold	[1:9]	130	2.74%
yellow	[10:29]	108	2.27%
greenyellow	[30:49]	68	1.43%
lawngreen	50+	3410	71.9%
All colors	4741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
92	4628	qpdf::impl::Writer::write()	call site: 04628	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
39	4405	qpdf::impl::Writer::writeLinearized()	call site: 04405	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
27	2953	ObjTable ::large_element(unsigned long)	call site: 02953	__cxa_allocate_exception
25	1383	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01383
25	2393	qpdf::BaseHandle::copy(bool) const	call site: 02393	__cxa_allocate_exception
22	4178	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04178
18	3418	qpdf::impl::Writer::writeLinearized()	call site: 03418	fopen
17	1224	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01224	__cxa_allocate_exception
17	4108	qpdf::BaseHandle::unparse() const	call site: 04108	__cxa_allocate_exception
16	2891	qpdf::impl::Writer::doWriteSetup()	call site: 02891
15	3678	deflate	call site: 03678	crc32
14	1249	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01249	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1362

Functions that are reachable but not covered

327

Reachable functions

2110

Percentage of reachable functions covered

84.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	84
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	970	20.2%
gold	[1:9]	113	2.35%
yellow	[10:29]	123	2.56%
greenyellow	[30:49]	48	1.00%
lawngreen	50+	3538	73.8%
All colors	4792	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
92	4679	qpdf::impl::Writer::write()	call site: 04679	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
47	2894	qpdf::impl::Writer::doWriteSetup()	call site: 02894
26	2794	qpdf::impl::Writer::generateID(bool)	call site: 02794	__cxa_allocate_exception
25	2393	qpdf::BaseHandle::copy(bool) const	call site: 02393	__cxa_allocate_exception
19	4271	qpdf::impl::Writer::writeTrailer(qpdf::impl::Writer::trailer_e, int, bool, long long, int)	call site: 04271	__cxa_allocate_exception
18	3469	qpdf::impl::Writer::writeLinearized()	call site: 03469	fopen
17	1224	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01224	__cxa_allocate_exception
17	4159	qpdf::BaseHandle::unparse() const	call site: 04159	__cxa_allocate_exception
16	2831	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02831	__cxa_allocate_exception
16	2942	qpdf::impl::Writer::doWriteSetup()	call site: 02942
15	3729	deflate	call site: 03729	crc32
14	1249	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01249	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1362

Functions that are reachable but not covered

335

Reachable functions

2128

Percentage of reachable functions covered

84.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1460	30.8%
gold	[1:9]	112	2.36%
yellow	[10:29]	109	2.30%
greenyellow	[30:49]	43	0.90%
lawngreen	50+	3014	63.6%
All colors	4738	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	3132	qpdf::impl::Writer::write()	call site: 03132	__assert_fail
120	4400	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04400	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3665	Pl_Flate::checkError(char const*, int)	call site: 03665	deflate
54	4632	qpdf::impl::Writer::writeStandard()	call site: 04632
42	2832	qpdf::impl::Writer::generateID(bool)	call site: 02832
39	4557	BitWriter::flush()	call site: 04557
30	4526	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04526	__cxa_allocate_exception
27	4597	qpdf::pl::Count::~Count()	call site: 04597	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
25	2393	qpdf::BaseHandle::copy(bool) const	call site: 02393	__cxa_allocate_exception
23	3413	(anonymous namespace)::Pl_stack::popper()	call site: 03413	fopen
23	3462	qpdf::impl::Writer::openObject(int)	call site: 03462	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
23	3624	unsigned int QIntC::to_uint (unsigned long const&)	call site: 03624	deflateInit_

Runtime coverage analysis

Covered functions

1304

Functions that are reachable but not covered

438

Reachable functions

2106

Percentage of reachable functions covered

79.2%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	82
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2358	75.7%
gold	[1:9]	25	0.80%
yellow	[10:29]	51	1.63%
greenyellow	[30:49]	20	0.64%
lawngreen	50+	660	21.1%
All colors	3114	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
220	2673	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02673	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
201	2066	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02066	__cxa_allocate_exception
180	1657	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01657	__cxa_guard_acquire
162	1903	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01903	__cxa_allocate_exception
101	2433	QPDFObjectHandle::getObjectID() const	call site: 02433	__cxa_allocate_exception
86	1377	QPDFObjectHandle::getIntValueAsInt() const	call site: 01377	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
81	806	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00806	__cxa_allocate_exception
70	1258	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01258	__cxa_allocate_exception
64	1091	QPDFLogger::defaultLogger()	call site: 01091	__cxa_end_catch
60	2276	QPDF::Doc::Objects::readTrailer()	call site: 02276	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
54	1506	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01506	__dynamic_cast
44	705	QPDFParser::parseRemainder(bool)	call site: 00705	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

460

Functions that are reachable but not covered

777

Reachable functions

1481

Percentage of reachable functions covered

47.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	13
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	40
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	25
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	47
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	33
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	86
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	62
/src/qpdf/libqpdf/QPDFXRefEntry.cc	3
/src/qpdf/libqpdf/QPDF_Dictionary.cc	14
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1030	21.7%
gold	[1:9]	126	2.65%
yellow	[10:29]	114	2.40%
greenyellow	[30:49]	44	0.92%
lawngreen	50+	3429	72.2%
All colors	4743	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
92	4630	qpdf::impl::Writer::write()	call site: 04630	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
39	4407	qpdf::impl::Writer::writeLinearized()	call site: 04407	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
27	2955	ObjTable ::large_element(unsigned long)	call site: 02955	__cxa_allocate_exception
25	1385	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01385
25	2395	qpdf::BaseHandle::copy(bool) const	call site: 02395	__cxa_allocate_exception
22	4180	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04180
18	3420	qpdf::impl::Writer::writeLinearized()	call site: 03420	fopen
17	1226	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01226	__cxa_allocate_exception
17	4110	qpdf::BaseHandle::unparse() const	call site: 04110	__cxa_allocate_exception
16	2893	qpdf::impl::Writer::doWriteSetup()	call site: 02893
15	3680	deflate	call site: 03680	crc32
14	1251	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01251	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1358

Functions that are reachable but not covered

327

Reachable functions

2110

Percentage of reachable functions covered

84.5%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	84
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	974	20.3%
gold	[1:9]	109	2.27%
yellow	[10:29]	114	2.37%
greenyellow	[30:49]	46	0.95%
lawngreen	50+	3551	74.0%
All colors	4794	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
92	4681	qpdf::impl::Writer::write()	call site: 04681	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
47	2896	qpdf::impl::Writer::doWriteSetup()	call site: 02896
26	2796	qpdf::impl::Writer::generateID(bool)	call site: 02796	__cxa_allocate_exception
25	2395	qpdf::BaseHandle::copy(bool) const	call site: 02395	__cxa_allocate_exception
19	4273	qpdf::impl::Writer::writeTrailer(qpdf::impl::Writer::trailer_e, int, bool, long long, int)	call site: 04273	__cxa_allocate_exception
18	3471	qpdf::impl::Writer::writeLinearized()	call site: 03471	fopen
17	1226	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01226	__cxa_allocate_exception
17	4161	qpdf::BaseHandle::unparse() const	call site: 04161	__cxa_allocate_exception
16	2833	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02833	__cxa_allocate_exception
16	2944	qpdf::impl::Writer::doWriteSetup()	call site: 02944
15	3731	deflate	call site: 03731	crc32
14	1251	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01251	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1360

Functions that are reachable but not covered

335

Reachable functions

2128

Percentage of reachable functions covered

84.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1674	34.9%
gold	[1:9]	112	2.33%
yellow	[10:29]	95	1.98%
greenyellow	[30:49]	47	0.98%
lawngreen	50+	2864	59.7%
All colors	4792	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
234	3186	qpdf::impl::Writer::write()	call site: 03186	__assert_fail
79	4495	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04495	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
75	3004	ObjTable ::large_element(unsigned long)	call site: 03004	__cxa_allocate_exception
57	4400	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04400	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
54	4686	qpdf::impl::Writer::writeStandard()	call site: 04686
47	2894	qpdf::impl::Writer::doWriteSetup()	call site: 02894
39	4611	BitWriter::flush()	call site: 04611
34	4338	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04338	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
30	3593	qpdf::pl::Count::write(unsigned char const*, unsigned long)	call site: 03593	__cxa_allocate_exception
30	4580	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04580	__cxa_allocate_exception
29	3467	(anonymous namespace)::Pl_stack::popper()	call site: 03467	fopen
27	4651	qpdf::pl::Count::~Count()	call site: 04651	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_

Runtime coverage analysis

Covered functions

1270

Functions that are reachable but not covered

484

Reachable functions

2126

Percentage of reachable functions covered

77.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	42
/src/qpdf/libqpdf/QPDF_objects.cc	53
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	2
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDFXRefEntry.cc	4
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1