High level conclusions

Fuzzers reach 63.26% code coverage.

Fuzzers reach 58.49% of cyclomatic complexity.

Fuzzers reach 48.92% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1702 / 3479

Cyclomatic complexity statically reachable by fuzzers

20950 / 35818

Runtime code coverage of functions

2201 / 3479

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: future_ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.2%
gold	[1:9]	5	10.2%
yellow	[10:29]	12	24.4%
greenyellow	[30:49]	2	4.08%
lawngreen	50+	23	46.9%
All colors	49	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	41	FuzzHelper::doChecks()	call site: 00041
1	47	FuzzHelper::run()	call site: 00047	__cxa_begin_catch

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

16

Reachable functions

47

Percentage of reachable functions covered

65.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: future_lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.75%
greenyellow	[30:49]	7	9.45%
lawngreen	50+	42	56.7%
All colors	74	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	20	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00020	__cxa_allocate_exception
5	8	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00008	__cxa_allocate_exception
5	35	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00035	__cxa_allocate_exception
1	41	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00041
1	72	FuzzHelper::run()	call site: 00072	__cxa_begin_catch

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

25

Reachable functions

82

Percentage of reachable functions covered

69.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	29.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	70.1%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00008	__cxa_allocate_exception
5	14	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00014	__cxa_allocate_exception
4	27	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00027
3	53	FuzzHelper::run()	call site: 00053	__cxa_end_catch

Runtime coverage analysis

Covered functions

30

Functions that are reachable but not covered

16

Reachable functions

71

Percentage of reachable functions covered

77.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: future_hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.4%
gold	[1:9]	1	2.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	15.7%
lawngreen	50+	24	63.1%
All colors	38	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	30	FuzzHelper::doChecks()	call site: 00030
1	36	FuzzHelper::run()	call site: 00036	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

15

Reachable functions

44

Percentage of reachable functions covered

65.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: future_runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	35.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.92%
greenyellow	[30:49]	5	8.92%
lawngreen	50+	26	46.4%
All colors	56	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	16	FuzzHelper::doChecks()	call site: 00016
5	9	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00009	__cxa_allocate_exception
2	36	FuzzHelper::doChecks()	call site: 00036
1	54	FuzzHelper::run()	call site: 00054	__cxa_begin_catch

Runtime coverage analysis

Covered functions

23

Functions that are reachable but not covered

24

Reachable functions

61

Percentage of reachable functions covered

60.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/libqpdf/qpdf/Util.hh	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.0%
gold	[1:9]	5	6.75%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	7	9.45%
lawngreen	50+	42	56.7%
All colors	74	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	20	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00020	__cxa_allocate_exception
5	8	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00008	__cxa_allocate_exception
5	35	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00035	__cxa_allocate_exception
1	41	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00041
1	72	FuzzHelper::run()	call site: 00072	__cxa_begin_catch

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

25

Reachable functions

82

Percentage of reachable functions covered

69.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	50.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	49.3%
All colors	83	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	32	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00032	__cxa_allocate_exception
10	47	BitStream::getBitsSigned(unsigned long)	call site: 00047	__cxa_allocate_exception
5	8	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00008	__cxa_allocate_exception
5	14	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00014	__cxa_allocate_exception
5	60	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00060	__cxa_allocate_exception
3	79	FuzzHelper::run()	call site: 00079	__cxa_end_catch
1	66	Pl_TIFFPredictor::processRow()	call site: 00066

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

30

Reachable functions

91

Percentage of reachable functions covered

67.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	29.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	70.1%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00008	__cxa_allocate_exception
5	14	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00014	__cxa_allocate_exception
4	27	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00027
3	53	FuzzHelper::run()	call site: 00053	__cxa_end_catch

Runtime coverage analysis

Covered functions

30

Functions that are reachable but not covered

16

Reachable functions

71

Percentage of reachable functions covered

77.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	35.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.92%
greenyellow	[30:49]	5	8.92%
lawngreen	50+	26	46.4%
All colors	56	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	16	FuzzHelper::doChecks()	call site: 00016
5	9	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00009	__cxa_allocate_exception
2	36	FuzzHelper::doChecks()	call site: 00036
1	54	FuzzHelper::run()	call site: 00054	__cxa_begin_catch

Runtime coverage analysis

Covered functions

23

Functions that are reachable but not covered

24

Reachable functions

61

Percentage of reachable functions covered

60.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/libqpdf/qpdf/Util.hh	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.2%
gold	[1:9]	5	10.2%
yellow	[10:29]	12	24.4%
greenyellow	[30:49]	2	4.08%
lawngreen	50+	23	46.9%
All colors	49	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	41	FuzzHelper::doChecks()	call site: 00041
1	47	FuzzHelper::run()	call site: 00047	__cxa_begin_catch

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

16

Reachable functions

47

Percentage of reachable functions covered

65.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: future_flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	62.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	37.8%
All colors	227	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	158	deflate	call site: 00158	inflate
15	87	deflate	call site: 00087	crc32
13	45	deflateResetKeep	call site: 00045	crc32_z
11	144	deflate	call site: 00144	_tr_flush_block
8	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
8	64	deflateReset	call site: 00064	inflateInit_
7	209	Pl_Flate::finish()	call site: 00209	__cxa_begin_catch
6	186	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00186	__cxa_allocate_exception
6	196	FuzzHelper::doChecks()	call site: 00196	__cxa_allocate_exception
5	18	Pl_Flate::Pl_Flate(char const*, Pipeline*, Pl_Flate::action_e, unsigned int)	call site: 00018	__cxa_allocate_exception
5	29	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00029	__cxa_allocate_exception
5	138	_tr_flush_block	call site: 00138	_tr_flush_block

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

57

Reachable functions

138

Percentage of reachable functions covered

58.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1

Fuzzer: hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.4%
gold	[1:9]	1	2.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	15.7%
lawngreen	50+	24	63.1%
All colors	38	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	30	FuzzHelper::doChecks()	call site: 00030
1	36	FuzzHelper::run()	call site: 00036	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

15

Reachable functions

44

Percentage of reachable functions covered

65.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	55.3%
gold	[1:9]	18	5.47%
yellow	[10:29]	6	1.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	37.3%
All colors	329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	99	init_simd	call site: 00099	jinit_forward_dct
32	50	std_huff_tables	call site: 00050	jpeg_start_compress
30	156	unsigned int QIntC::to_uint (int const&)	call site: 00156	jpeg_finish_compress
19	233	master_selection	call site: 00233	jinit_1pass_quantizer
11	34	jinit_memory_mgr	call site: 00034	jpeg_set_defaults
9	209	jpeg_core_output_dimensions	call site: 00209	jdiv_round_up
7	201	jpeg_calc_output_dimensions	call site: 00201	jdiv_round_up
5	12	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00012	__cxa_allocate_exception
3	25	Pl_DCT::finish()	call site: 00025	jpeg_CreateCompress
3	257	jinit_color_deconverter	call site: 00257	jsimd_can_ycc_rgb565
2	310	Pl_DCT::finish()	call site: 00310	jpeg_destroy_compress
1	20	FuzzHelper::doChecks()	call site: 00020

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

128

Reachable functions

237

Percentage of reachable functions covered

45.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	55.3%
gold	[1:9]	18	5.47%
yellow	[10:29]	6	1.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	37.3%
All colors	329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	99	init_simd	call site: 00099	jinit_forward_dct
32	50	std_huff_tables	call site: 00050	jpeg_start_compress
30	156	unsigned int QIntC::to_uint (int const&)	call site: 00156	jpeg_finish_compress
19	233	master_selection	call site: 00233	jinit_1pass_quantizer
11	34	jinit_memory_mgr	call site: 00034	jpeg_set_defaults
9	209	jpeg_core_output_dimensions	call site: 00209	jdiv_round_up
7	201	jpeg_calc_output_dimensions	call site: 00201	jdiv_round_up
5	12	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00012	__cxa_allocate_exception
3	25	Pl_DCT::finish()	call site: 00025	jpeg_CreateCompress
3	257	jinit_color_deconverter	call site: 00257	jsimd_can_ycc_rgb565
2	310	Pl_DCT::finish()	call site: 00310	jpeg_destroy_compress
1	20	FuzzHelper::doChecks()	call site: 00020

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

128

Reachable functions

237

Percentage of reachable functions covered

45.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2369	75.8%
gold	[1:9]	25	0.80%
yellow	[10:29]	51	1.63%
greenyellow	[30:49]	17	0.54%
lawngreen	50+	662	21.1%
All colors	3124	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
222	2667	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02667	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
200	2063	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02063	__cxa_allocate_exception
180	1654	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01654	__cxa_allocate_exception
162	1900	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01900	__cxa_allocate_exception
97	2429	QPDFObjectHandle::getObjectID() const	call site: 02429	__cxa_allocate_exception
91	1371	QPDFObjectHandle::getIntValueAsInt() const	call site: 01371	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
84	1471	QPDFObjectHandle::getName() const	call site: 01471	__cxa_allocate_exception
77	804	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00804	__cxa_allocate_exception
70	1252	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01252	__cxa_allocate_exception
64	1085	QPDFLogger::defaultLogger()	call site: 01085	__cxa_end_catch
60	2272	QPDF::Doc::Objects::readTrailer()	call site: 02272	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
44	703	QPDFParser::parseRemainder(bool)	call site: 00703	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

461

Functions that are reachable but not covered

786

Reachable functions

1495

Percentage of reachable functions covered

47.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	15
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	26
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	87
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	62
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: future_tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	50.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	49.3%
All colors	83	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	32	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00032	__cxa_allocate_exception
10	47	BitStream::getBitsSigned(unsigned long)	call site: 00047	__cxa_allocate_exception
5	8	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00008	__cxa_allocate_exception
5	14	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00014	__cxa_allocate_exception
5	60	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00060	__cxa_allocate_exception
3	79	FuzzHelper::run()	call site: 00079	__cxa_end_catch
1	66	Pl_TIFFPredictor::processRow()	call site: 00066

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

30

Reachable functions

91

Percentage of reachable functions covered

67.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2369	75.8%
gold	[1:9]	30	0.96%
yellow	[10:29]	51	1.63%
greenyellow	[30:49]	11	0.35%
lawngreen	50+	663	21.2%
All colors	3124	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
222	2667	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02667	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
200	2063	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02063	__cxa_allocate_exception
180	1654	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01654	__cxa_allocate_exception
162	1900	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01900	__cxa_allocate_exception
97	2429	QPDFObjectHandle::getObjectID() const	call site: 02429	__cxa_allocate_exception
91	1371	QPDFObjectHandle::getIntValueAsInt() const	call site: 01371	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
84	1471	QPDFObjectHandle::getName() const	call site: 01471	__cxa_allocate_exception
77	804	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00804	__cxa_allocate_exception
70	1252	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01252	__cxa_allocate_exception
64	1085	QPDFLogger::defaultLogger()	call site: 01085	__cxa_end_catch
60	2272	QPDF::Doc::Objects::readTrailer()	call site: 02272	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
44	703	QPDFParser::parseRemainder(bool)	call site: 00703	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

460

Functions that are reachable but not covered

786

Reachable functions

1495

Percentage of reachable functions covered

47.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	15
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	26
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	87
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	62
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	599	16.8%
gold	[1:9]	133	3.73%
yellow	[10:29]	69	1.93%
greenyellow	[30:49]	31	0.87%
lawngreen	50+	2726	76.6%
All colors	3558	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	2363	std::__1::shared_ptr QPDFObject::create , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)	call site: 02363	__cxa_allocate_exception
19	2342	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02342	__cxa_allocate_exception
15	1245	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01245	__cxa_allocate_exception
12	1225	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01225
11	175	qpdf::Tokenizer::inBeforeToken(char)	call site: 00175	__cxa_allocate_exception
10	911	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00911	__cxa_allocate_exception
9	2743	QPDF::Doc::Objects::parse(char const*)	call site: 02743	__cxa_begin_catch
8	22	long long QIntC::to_offset (unsigned long const&)	call site: 00022	__cxa_allocate_exception
8	1396	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01396
7	347	QPDF::warn(QPDFExc const&)	call site: 00347	__cxa_allocate_exception
7	1153	QPDFObjectHandle::getName() const	call site: 01153	__cxa_allocate_exception
7	1371	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01371

Runtime coverage analysis

Covered functions

1030

Functions that are reachable but not covered

233

Reachable functions

1665

Percentage of reachable functions covered

86.01%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	30
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	19
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	32
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	24
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	67
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: future_qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	615	17.2%
gold	[1:9]	113	3.17%
yellow	[10:29]	84	2.36%
greenyellow	[30:49]	48	1.34%
lawngreen	50+	2696	75.8%
All colors	3556	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
60	2361	std::__1::shared_ptr QPDFObject::create , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)	call site: 02361	__cxa_allocate_exception
25	1379	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01379
19	2340	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02340	__cxa_allocate_exception
15	1243	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01243	__cxa_allocate_exception
12	1223	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01223
11	166	qpdf::Tokenizer::inBeforeToken(char)	call site: 00166	__cxa_allocate_exception
10	909	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00909	__cxa_allocate_exception
10	1366	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01366
9	2741	QPDF::Doc::Objects::parse(char const*)	call site: 02741	__cxa_begin_catch
8	41	unsigned long QIntC::to_size (long const&)	call site: 00041	__cxa_allocate_exception
7	338	QPDF::warn(QPDFExc const&)	call site: 00338	__cxa_allocate_exception
7	1151	QPDFObjectHandle::getName() const	call site: 01151	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1033

Functions that are reachable but not covered

235

Reachable functions

1665

Percentage of reachable functions covered

85.89%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	30
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	19
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	32
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	24
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	67
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	62.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	37.8%
All colors	227	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	158	deflate	call site: 00158	inflate
15	87	deflate	call site: 00087	crc32
13	45	deflateResetKeep	call site: 00045	crc32_z
11	144	deflate	call site: 00144	_tr_flush_block
8	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
8	64	deflateReset	call site: 00064	inflateInit_
7	209	Pl_Flate::finish()	call site: 00209	__cxa_begin_catch
6	186	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00186	__cxa_allocate_exception
6	196	FuzzHelper::doChecks()	call site: 00196	__cxa_allocate_exception
5	18	Pl_Flate::Pl_Flate(char const*, Pipeline*, Pl_Flate::action_e, unsigned int)	call site: 00018	__cxa_allocate_exception
5	29	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00029	__cxa_allocate_exception
5	138	_tr_flush_block	call site: 00138	_tr_flush_block

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

57

Reachable functions

138

Percentage of reachable functions covered

58.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1

Fuzzer: qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1415	29.9%
gold	[1:9]	109	2.30%
yellow	[10:29]	89	1.88%
greenyellow	[30:49]	64	1.35%
lawngreen	50+	3052	64.5%
All colors	4729	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
225	3150	qpdf::impl::Writer::write()	call site: 03150	__assert_fail
120	4396	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04396	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3671	Pl_Flate::checkError(char const*, int)	call site: 03671	deflate
49	4628	qpdf::impl::Writer::writeStandard()	call site: 04628
41	2850	qpdf::impl::Writer::generateID(bool)	call site: 02850
39	4553	BitWriter::flush()	call site: 04553
30	4522	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04522	__cxa_allocate_exception
27	4593	qpdf::pl::Count::~Count()	call site: 04593	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
25	2392	qpdf::BaseHandle::copy(bool) const	call site: 02392	__cxa_allocate_exception
23	3427	(anonymous namespace)::Pl_stack::popper()	call site: 03427	fopen
23	3476	qpdf::impl::Writer::openObject(int)	call site: 03476	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
23	3630	unsigned int QIntC::to_uint (unsigned long const&)	call site: 03630	deflateInit_

Runtime coverage analysis

Covered functions

1318

Functions that are reachable but not covered

436

Reachable functions

2132

Percentage of reachable functions covered

79.55%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	82
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1634	34.1%
gold	[1:9]	90	1.88%
yellow	[10:29]	115	2.40%
greenyellow	[30:49]	49	1.02%
lawngreen	50+	2893	60.5%
All colors	4781	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
236	3202	qpdf::impl::Writer::write()	call site: 03202	__assert_fail
79	4489	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04489	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
76	3019	ObjTable ::large_element(unsigned long)	call site: 03019	__cxa_allocate_exception
57	4394	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04394	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
49	4680	qpdf::impl::Writer::writeStandard()	call site: 04680
46	2910	qpdf::impl::Writer::doWriteSetup()	call site: 02910
39	4605	BitWriter::flush()	call site: 04605
34	4332	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04332	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
30	4574	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04574	__cxa_allocate_exception
29	3479	(anonymous namespace)::Pl_stack::popper()	call site: 03479	fopen
27	4645	qpdf::pl::Count::~Count()	call site: 04645	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
26	2810	qpdf::impl::Writer::generateID(bool)	call site: 02810	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1286

Functions that are reachable but not covered

486

Reachable functions

2152

Percentage of reachable functions covered

77.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1425	30.1%
gold	[1:9]	110	2.32%
yellow	[10:29]	83	1.75%
greenyellow	[30:49]	64	1.35%
lawngreen	50+	3045	64.4%
All colors	4727	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
225	3148	qpdf::impl::Writer::write()	call site: 03148	__assert_fail
120	4394	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04394	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3669	Pl_Flate::checkError(char const*, int)	call site: 03669	deflate
49	4626	qpdf::impl::Writer::writeStandard()	call site: 04626
41	2848	qpdf::impl::Writer::generateID(bool)	call site: 02848
39	4551	BitWriter::flush()	call site: 04551
30	4520	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04520	__cxa_allocate_exception
27	4591	qpdf::pl::Count::~Count()	call site: 04591	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
25	2390	qpdf::BaseHandle::copy(bool) const	call site: 02390	__cxa_allocate_exception
23	3425	(anonymous namespace)::Pl_stack::popper()	call site: 03425	fopen
23	3474	qpdf::impl::Writer::openObject(int)	call site: 03474	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
23	3628	unsigned int QIntC::to_uint (unsigned long const&)	call site: 03628	deflateInit_

Runtime coverage analysis

Covered functions

1320

Functions that are reachable but not covered

440

Reachable functions

2132

Percentage of reachable functions covered

79.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	82
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	994	21.0%
gold	[1:9]	121	2.55%
yellow	[10:29]	122	2.57%
greenyellow	[30:49]	54	1.14%
lawngreen	50+	3441	72.7%
All colors	4732	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	4624	qpdf::impl::Writer::write()	call site: 04624	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
39	4401	qpdf::impl::Writer::writeLinearized()	call site: 04401	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
28	2970	ObjTable ::large_element(unsigned long)	call site: 02970	__cxa_allocate_exception
25	1381	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01381
25	2392	qpdf::BaseHandle::copy(bool) const	call site: 02392	__cxa_allocate_exception
22	4181	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04181
18	3432	qpdf::impl::Writer::writeLinearized()	call site: 03432	fopen
17	4111	qpdf::BaseHandle::unparse() const	call site: 04111	__cxa_allocate_exception
16	2743	QPDF::Doc::Objects::parse(char const*)	call site: 02743	__cxa_begin_catch
16	2908	qpdf::impl::Writer::doWriteSetup()	call site: 02908
15	1245	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01245	__cxa_allocate_exception
15	3684	deflate	call site: 03684	crc32

Runtime coverage analysis

Covered functions

1375

Functions that are reachable but not covered

327

Reachable functions

2136

Percentage of reachable functions covered

84.69%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	84
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	937	19.5%
gold	[1:9]	106	2.21%
yellow	[10:29]	114	2.38%
greenyellow	[30:49]	33	0.69%
lawngreen	50+	3591	75.1%
All colors	4781	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	4673	qpdf::impl::Writer::write()	call site: 04673	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
46	2910	qpdf::impl::Writer::doWriteSetup()	call site: 02910
26	2810	qpdf::impl::Writer::generateID(bool)	call site: 02810	__cxa_allocate_exception
25	2390	qpdf::BaseHandle::copy(bool) const	call site: 02390	__cxa_allocate_exception
18	3481	qpdf::impl::Writer::writeLinearized()	call site: 03481	fopen
17	4160	qpdf::BaseHandle::unparse() const	call site: 04160	__cxa_allocate_exception
16	2741	QPDF::Doc::Objects::parse(char const*)	call site: 02741	__cxa_begin_catch
16	2847	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02847	__cxa_allocate_exception
16	2957	qpdf::impl::Writer::doWriteSetup()	call site: 02957
15	1243	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01243	__cxa_allocate_exception
15	3733	deflate	call site: 03733	crc32
14	3076	qpdf::impl::Writer::preserveObjectStreams()	call site: 03076

Runtime coverage analysis

Covered functions

1379

Functions that are reachable but not covered

335

Reachable functions

2154

Percentage of reachable functions covered

84.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	974	20.5%
gold	[1:9]	114	2.41%
yellow	[10:29]	98	2.07%
greenyellow	[30:49]	83	1.75%
lawngreen	50+	3461	73.1%
All colors	4730	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	4622	qpdf::impl::Writer::write()	call site: 04622	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
39	4399	qpdf::impl::Writer::writeLinearized()	call site: 04399	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
28	2968	ObjTable ::large_element(unsigned long)	call site: 02968	__cxa_allocate_exception
25	2390	qpdf::BaseHandle::copy(bool) const	call site: 02390	__cxa_allocate_exception
22	4179	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04179
18	3430	qpdf::impl::Writer::writeLinearized()	call site: 03430	fopen
17	4109	qpdf::BaseHandle::unparse() const	call site: 04109	__cxa_allocate_exception
16	2741	QPDF::Doc::Objects::parse(char const*)	call site: 02741	__cxa_begin_catch
16	2906	qpdf::impl::Writer::doWriteSetup()	call site: 02906
15	1243	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01243	__cxa_allocate_exception
15	3682	deflate	call site: 03682	crc32
13	2999	qpdf::BaseDictionary::crbegin()	call site: 02999

Runtime coverage analysis

Covered functions

1380

Functions that are reachable but not covered

325

Reachable functions

2136

Percentage of reachable functions covered

84.78%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	84
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1018	18.4%
gold	[1:9]	100	1.80%
yellow	[10:29]	84	1.51%
greenyellow	[30:49]	65	1.17%
lawngreen	50+	4264	77.0%
All colors	5531	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
66	3310	NNTreeIterator::split(qpdf::Dictionary, std::__1::__list_iterator )	call site: 03310
57	5155	(anonymous namespace)::JSONParser::getToken()	call site: 05155	__cxa_allocate_exception
54	3237	NNTreeIterator::resetLimits(qpdf::Dictionary, std::__1::__list_iterator )	call site: 03237
19	2396	qpdf::BaseHandle::copy(bool) const	call site: 02396	__cxa_allocate_exception
19	4181	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04181	__cxa_allocate_exception
19	5286	(anonymous namespace)::JSONParser::handleToken()	call site: 05286	__cxa_allocate_exception
18	5366	(anonymous namespace)::JSONParser::handleToken()	call site: 05366	__cxa_allocate_exception
13	5000	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 05000
11	166	qpdf::Tokenizer::inBeforeToken(char)	call site: 00166	__cxa_allocate_exception
11	5239	(anonymous namespace)::JSONParser::getToken()	call site: 05239	__cxa_allocate_exception
11	5252	(anonymous namespace)::JSONParser::getToken()	call site: 05252	__cxa_allocate_exception
10	909	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00909	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1383

Functions that are reachable but not covered

240

Reachable functions

2278

Percentage of reachable functions covered

89.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	33
/src/qpdf/libqpdf/QPDF_objects.cc	51
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	48
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	27
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	113
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	117
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	19
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	11
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/libqpdf/qpdf/AcroForm.hh	17
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	919	16.6%
gold	[1:9]	113	2.04%
yellow	[10:29]	109	1.96%
greenyellow	[30:49]	59	1.06%
lawngreen	50+	4333	78.3%
All colors	5533	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
57	5157	(anonymous namespace)::JSONParser::getToken()	call site: 05157	__cxa_allocate_exception
19	2398	qpdf::BaseHandle::copy(bool) const	call site: 02398	__cxa_allocate_exception
19	4183	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04183	__cxa_allocate_exception
19	5288	(anonymous namespace)::JSONParser::handleToken()	call site: 05288	__cxa_allocate_exception
18	5368	(anonymous namespace)::JSONParser::handleToken()	call site: 05368	__cxa_allocate_exception
13	5002	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 05002
11	175	qpdf::Tokenizer::inBeforeToken(char)	call site: 00175	__cxa_allocate_exception
11	4798	void QIntC::range_check_error (long long const&, long long const&)	call site: 04798	__cxa_allocate_exception
11	5241	(anonymous namespace)::JSONParser::getToken()	call site: 05241	__cxa_allocate_exception
11	5254	(anonymous namespace)::JSONParser::getToken()	call site: 05254	__cxa_allocate_exception
10	911	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00911	__cxa_allocate_exception
10	1245	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01245	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1384

Functions that are reachable but not covered

234

Reachable functions

2278

Percentage of reachable functions covered

89.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/include/qpdf/QIntC.hh	48
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	33
/src/qpdf/libqpdf/QPDF_objects.cc	51
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	27
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	113
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	117
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	19
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	11
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/libqpdf/qpdf/AcroForm.hh	17
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: future_qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1637	34.2%
gold	[1:9]	134	2.80%
yellow	[10:29]	86	1.79%
greenyellow	[30:49]	51	1.06%
lawngreen	50+	2871	60.0%
All colors	4779	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
236	3200	qpdf::impl::Writer::write()	call site: 03200	__assert_fail
79	4487	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04487	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
76	3017	ObjTable ::large_element(unsigned long)	call site: 03017	__cxa_allocate_exception
57	4392	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04392	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
49	4678	qpdf::impl::Writer::writeStandard()	call site: 04678
46	2908	qpdf::impl::Writer::doWriteSetup()	call site: 02908
39	4603	BitWriter::flush()	call site: 04603
34	4330	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04330	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
30	4572	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04572	__cxa_allocate_exception
29	3477	(anonymous namespace)::Pl_stack::popper()	call site: 03477	fopen
27	4643	qpdf::pl::Count::~Count()	call site: 04643	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
26	2808	qpdf::impl::Writer::generateID(bool)	call site: 02808	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1290

Functions that are reachable but not covered

486

Reachable functions

2152

Percentage of reachable functions covered

77.42%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	937	19.5%
gold	[1:9]	112	2.34%
yellow	[10:29]	97	2.02%
greenyellow	[30:49]	61	1.27%
lawngreen	50+	3576	74.7%
All colors	4783	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
87	4675	qpdf::impl::Writer::write()	call site: 04675	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
46	2912	qpdf::impl::Writer::doWriteSetup()	call site: 02912
26	2812	qpdf::impl::Writer::generateID(bool)	call site: 02812	__cxa_allocate_exception
25	2392	qpdf::BaseHandle::copy(bool) const	call site: 02392	__cxa_allocate_exception
18	3483	qpdf::impl::Writer::writeLinearized()	call site: 03483	fopen
17	4162	qpdf::BaseHandle::unparse() const	call site: 04162	__cxa_allocate_exception
16	2743	QPDF::Doc::Objects::parse(char const*)	call site: 02743	__cxa_begin_catch
16	2849	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02849	__cxa_allocate_exception
16	2959	qpdf::impl::Writer::doWriteSetup()	call site: 02959
15	1245	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01245	__cxa_allocate_exception
15	3735	deflate	call site: 03735	crc32
14	3078	qpdf::impl::Writer::preserveObjectStreams()	call site: 03078

Runtime coverage analysis

Covered functions

1377

Functions that are reachable but not covered

335

Reachable functions

2154

Percentage of reachable functions covered

84.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	96
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	10
/src/zlib/inftrees.c	1
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1