High level conclusions

Fuzzers reach 63.49% code coverage.

Fuzzers reach 58.75% of cyclomatic complexity.

Fuzzers reach 49.28% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1717 / 3484

Cyclomatic complexity statically reachable by fuzzers

21083 / 35880

Runtime code coverage of functions

2212 / 3484

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.2%
gold	[1:9]	5	10.2%
yellow	[10:29]	12	24.4%
greenyellow	[30:49]	2	4.08%
lawngreen	50+	23	46.9%
All colors	49	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	41	FuzzHelper::doChecks()	call site: 00041
1	47	FuzzHelper::run()	call site: 00047	__cxa_begin_catch

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

16

Reachable functions

47

Percentage of reachable functions covered

65.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	35.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.92%
greenyellow	[30:49]	5	8.92%
lawngreen	50+	26	46.4%
All colors	56	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	16	FuzzHelper::doChecks()	call site: 00016
5	9	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00009	__cxa_allocate_exception
2	36	FuzzHelper::doChecks()	call site: 00036
1	54	FuzzHelper::run()	call site: 00054	__cxa_begin_catch

Runtime coverage analysis

Covered functions

23

Functions that are reachable but not covered

24

Reachable functions

61

Percentage of reachable functions covered

60.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/libqpdf/qpdf/Util.hh	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: future_lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.75%
greenyellow	[30:49]	7	9.45%
lawngreen	50+	42	56.7%
All colors	74	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	20	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00020	__cxa_allocate_exception
5	8	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00008	__cxa_allocate_exception
5	35	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00035	__cxa_allocate_exception
1	41	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00041
1	72	FuzzHelper::run()	call site: 00072	__cxa_begin_catch

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

25

Reachable functions

82

Percentage of reachable functions covered

69.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.75%
greenyellow	[30:49]	7	9.45%
lawngreen	50+	42	56.7%
All colors	74	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	20	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00020	__cxa_allocate_exception
5	8	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00008	__cxa_allocate_exception
5	35	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00035	__cxa_allocate_exception
1	41	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00041
1	72	FuzzHelper::run()	call site: 00072	__cxa_begin_catch

Runtime coverage analysis

Covered functions

34

Functions that are reachable but not covered

25

Reachable functions

82

Percentage of reachable functions covered

69.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	50.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	49.3%
All colors	83	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	32	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00032	__cxa_allocate_exception
10	47	BitStream::getBitsSigned(unsigned long)	call site: 00047	__cxa_allocate_exception
5	8	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00008	__cxa_allocate_exception
5	14	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00014	__cxa_allocate_exception
5	60	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00060	__cxa_allocate_exception
3	79	FuzzHelper::run()	call site: 00079	__cxa_end_catch
1	66	Pl_TIFFPredictor::processRow()	call site: 00066

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

30

Reachable functions

91

Percentage of reachable functions covered

67.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	29.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	70.1%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00008	__cxa_allocate_exception
5	14	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00014	__cxa_allocate_exception
4	27	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00027
3	53	FuzzHelper::run()	call site: 00053	__cxa_end_catch

Runtime coverage analysis

Covered functions

30

Functions that are reachable but not covered

16

Reachable functions

71

Percentage of reachable functions covered

77.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	62.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	37.8%
All colors	227	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	158	deflate	call site: 00158	inflate
15	87	deflate	call site: 00087	crc32
13	45	deflateResetKeep	call site: 00045	crc32_z
11	144	deflate	call site: 00144	_tr_flush_block
8	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
8	64	deflateReset	call site: 00064	inflateInit_
7	209	Pl_Flate::finish()	call site: 00209	__cxa_begin_catch
6	186	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00186	__cxa_allocate_exception
6	196	FuzzHelper::doChecks()	call site: 00196	__cxa_allocate_exception
5	18	Pl_Flate::Pl_Flate(char const*, Pipeline*, Pl_Flate::action_e, unsigned int)	call site: 00018	__cxa_allocate_exception
5	29	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00029	__cxa_allocate_exception
5	138	_tr_flush_block	call site: 00138	_tr_flush_block

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

57

Reachable functions

138

Percentage of reachable functions covered

58.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1

Fuzzer: future_hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.4%
gold	[1:9]	1	2.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	15.7%
lawngreen	50+	24	63.1%
All colors	38	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	30	FuzzHelper::doChecks()	call site: 00030
1	36	FuzzHelper::run()	call site: 00036	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

15

Reachable functions

44

Percentage of reachable functions covered

65.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: future_ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.2%
gold	[1:9]	5	10.2%
yellow	[10:29]	12	24.4%
greenyellow	[30:49]	2	4.08%
lawngreen	50+	23	46.9%
All colors	49	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	41	FuzzHelper::doChecks()	call site: 00041
1	47	FuzzHelper::run()	call site: 00047	__cxa_begin_catch

Runtime coverage analysis

Covered functions

18

Functions that are reachable but not covered

16

Reachable functions

47

Percentage of reachable functions covered

65.96%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: future_pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	29.8%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	40	70.1%
All colors	57	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00008	__cxa_allocate_exception
5	14	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00014	__cxa_allocate_exception
4	27	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00027
3	53	FuzzHelper::run()	call site: 00053	__cxa_end_catch

Runtime coverage analysis

Covered functions

30

Functions that are reachable but not covered

16

Reachable functions

71

Percentage of reachable functions covered

77.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.4%
gold	[1:9]	1	2.63%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	15.7%
lawngreen	50+	24	63.1%
All colors	38	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	8	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00008	__cxa_allocate_exception
1	30	FuzzHelper::doChecks()	call site: 00030
1	36	FuzzHelper::run()	call site: 00036	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

15

Reachable functions

44

Percentage of reachable functions covered

65.91%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: future_tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	50.6%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	41	49.3%
All colors	83	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	32	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00032	__cxa_allocate_exception
10	47	BitStream::getBitsSigned(unsigned long)	call site: 00047	__cxa_allocate_exception
5	8	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00008	__cxa_allocate_exception
5	14	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00014	__cxa_allocate_exception
5	60	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00060	__cxa_allocate_exception
3	79	FuzzHelper::run()	call site: 00079	__cxa_end_catch
1	66	Pl_TIFFPredictor::processRow()	call site: 00066

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

30

Reachable functions

91

Percentage of reachable functions covered

67.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	141	62.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	86	37.8%
All colors	227	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	158	deflate	call site: 00158	inflate
15	87	deflate	call site: 00087	crc32
13	45	deflateResetKeep	call site: 00045	crc32_z
11	144	deflate	call site: 00144	_tr_flush_block
8	9	unsigned long QIntC::to_size (unsigned int const&)	call site: 00009	__cxa_allocate_exception
8	64	deflateReset	call site: 00064	inflateInit_
7	209	Pl_Flate::finish()	call site: 00209	__cxa_begin_catch
6	186	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00186	__cxa_allocate_exception
6	196	FuzzHelper::doChecks()	call site: 00196	__cxa_allocate_exception
5	18	Pl_Flate::Pl_Flate(char const*, Pipeline*, Pl_Flate::action_e, unsigned int)	call site: 00018	__cxa_allocate_exception
5	29	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00029	__cxa_allocate_exception
5	138	_tr_flush_block	call site: 00138	_tr_flush_block

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

57

Reachable functions

138

Percentage of reachable functions covered

58.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/qpdf/Util.hh	3
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1

Fuzzer: dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	55.3%
gold	[1:9]	18	5.47%
yellow	[10:29]	6	1.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	37.3%
All colors	329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	99	init_simd	call site: 00099	jinit_forward_dct
32	50	std_huff_tables	call site: 00050	jpeg_start_compress
30	156	unsigned int QIntC::to_uint (int const&)	call site: 00156	jpeg_finish_compress
19	233	master_selection	call site: 00233	jinit_1pass_quantizer
11	34	jinit_memory_mgr	call site: 00034	jpeg_set_defaults
9	209	jpeg_core_output_dimensions	call site: 00209	jdiv_round_up
7	201	jpeg_calc_output_dimensions	call site: 00201	jdiv_round_up
5	12	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00012	__cxa_allocate_exception
3	25	Pl_DCT::finish()	call site: 00025	jpeg_CreateCompress
3	257	jinit_color_deconverter	call site: 00257	jsimd_can_ycc_rgb565
2	310	Pl_DCT::finish()	call site: 00310	jpeg_destroy_compress
1	20	FuzzHelper::doChecks()	call site: 00020

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

128

Reachable functions

237

Percentage of reachable functions covered

45.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2372	75.8%
gold	[1:9]	25	0.79%
yellow	[10:29]	45	1.43%
greenyellow	[30:49]	31	0.99%
lawngreen	50+	654	20.9%
All colors	3127	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
227	2664	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02664	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
201	2055	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02055	__cxa_allocate_exception
180	1650	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01650	__cxa_allocate_exception
158	1896	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01896	__cxa_allocate_exception
97	2422	QPDFObjectHandle::getObjectID() const	call site: 02422	__cxa_allocate_exception
86	1371	QPDFObjectHandle::getIntValueAsInt() const	call site: 01371	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
85	1466	QPDFObjectHandle::getName() const	call site: 01466	__cxa_allocate_exception
77	804	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00804	__cxa_allocate_exception
70	1252	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01252	__cxa_allocate_exception
64	1085	QPDFLogger::defaultLogger()	call site: 01085	__cxa_end_catch
60	2265	QPDF::Doc::Objects::readTrailer()	call site: 02265	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
44	703	qpdf::impl::Parser::parse_remainder(bool)	call site: 00703	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

461

Functions that are reachable but not covered

789

Reachable functions

1499

Percentage of reachable functions covered

47.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	15
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	26
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	89
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	62
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2372	75.8%
gold	[1:9]	25	0.79%
yellow	[10:29]	50	1.59%
greenyellow	[30:49]	17	0.54%
lawngreen	50+	663	21.2%
All colors	3127	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
227	2664	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02664	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
201	2055	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02055	__cxa_allocate_exception
180	1650	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01650	__cxa_allocate_exception
158	1896	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01896	__cxa_allocate_exception
97	2422	QPDFObjectHandle::getObjectID() const	call site: 02422	__cxa_allocate_exception
86	1371	QPDFObjectHandle::getIntValueAsInt() const	call site: 01371	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
85	1466	QPDFObjectHandle::getName() const	call site: 01466	__cxa_allocate_exception
77	804	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00804	__cxa_allocate_exception
70	1252	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01252	__cxa_allocate_exception
64	1085	QPDFLogger::defaultLogger()	call site: 01085	__cxa_end_catch
60	2265	QPDF::Doc::Objects::readTrailer()	call site: 02265	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
44	703	qpdf::impl::Parser::parse_remainder(bool)	call site: 00703	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

460

Functions that are reachable but not covered

789

Reachable functions

1499

Percentage of reachable functions covered

47.36%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	4
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Util.hh	15
/src/qpdf/libqpdf/QUtil.cc	12
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	25
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	26
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	89
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	62
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: future_runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	35.7%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	8.92%
greenyellow	[30:49]	5	8.92%
lawngreen	50+	26	46.4%
All colors	56	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
12	16	FuzzHelper::doChecks()	call site: 00016
5	9	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00009	__cxa_allocate_exception
2	36	FuzzHelper::doChecks()	call site: 00036
1	54	FuzzHelper::run()	call site: 00054	__cxa_begin_catch

Runtime coverage analysis

Covered functions

23

Functions that are reachable but not covered

24

Reachable functions

61

Percentage of reachable functions covered

60.66%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_RunLength.cc	8
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/libqpdf/qpdf/Util.hh	4
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	603	16.9%
gold	[1:9]	111	3.11%
yellow	[10:29]	68	1.90%
greenyellow	[30:49]	33	0.92%
lawngreen	50+	2751	77.1%
All colors	3566	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	2368	std::__1::shared_ptr QPDFObject::create , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)	call site: 02368	__cxa_allocate_exception
23	2343	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02343	__cxa_allocate_exception
15	1247	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01247	__cxa_allocate_exception
12	1227	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01227
11	175	qpdf::Tokenizer::inBeforeToken(char)	call site: 00175	__cxa_allocate_exception
10	911	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00911	__cxa_allocate_exception
9	2749	QPDF::Doc::Objects::parse(char const*)	call site: 02749	__cxa_begin_catch
8	22	long long QIntC::to_offset (unsigned long const&)	call site: 00022	__cxa_allocate_exception
8	1398	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01398
7	347	QPDF::warn(QPDFExc const&)	call site: 00347	__cxa_allocate_exception
7	1154	QPDFObjectHandle::getName() const	call site: 01154	__cxa_allocate_exception
7	1373	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01373

Runtime coverage analysis

Covered functions

1031

Functions that are reachable but not covered

235

Reachable functions

1669

Percentage of reachable functions covered

85.92%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	30
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	19
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	32
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	24
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	107
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	67
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	943	16.7%
gold	[1:9]	109	1.93%
yellow	[10:29]	121	2.15%
greenyellow	[30:49]	63	1.11%
lawngreen	50+	4390	78.0%
All colors	5626	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	5245	(anonymous namespace)::JSONParser::getToken()	call site: 05245	__cxa_allocate_exception
23	2400	qpdf::BaseHandle::copy(bool) const	call site: 02400	__cxa_allocate_exception
19	4260	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04260	__cxa_allocate_exception
19	5373	(anonymous namespace)::JSONParser::handleToken()	call site: 05373	__cxa_allocate_exception
19	5458	(anonymous namespace)::JSONParser::handleToken()	call site: 05458	__cxa_allocate_exception
14	4108	qpdf::Stream::copy_data_to(qpdf::Stream&)	call site: 04108	__cxa_allocate_exception
13	5095	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 05095
11	175	qpdf::Tokenizer::inBeforeToken(char)	call site: 00175	__cxa_allocate_exception
11	4890	void QIntC::range_check_error (long long const&, long long const&)	call site: 04890	__cxa_allocate_exception
11	5326	(anonymous namespace)::JSONParser::getToken()	call site: 05326	__cxa_allocate_exception
11	5339	(anonymous namespace)::JSONParser::getToken()	call site: 05339	__cxa_allocate_exception
10	911	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00911	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1455

Functions that are reachable but not covered

236

Reachable functions

2308

Percentage of reachable functions covered

89.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/include/qpdf/QIntC.hh	48
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	38
/src/qpdf/libqpdf/QPDF_objects.cc	51
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	27
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	118
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	115
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	25
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	11
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/libqpdf/qpdf/AcroForm.hh	17
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: future_dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	182	55.3%
gold	[1:9]	18	5.47%
yellow	[10:29]	6	1.82%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	123	37.3%
All colors	329	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	99	init_simd	call site: 00099	jinit_forward_dct
32	50	std_huff_tables	call site: 00050	jpeg_start_compress
30	156	unsigned int QIntC::to_uint (int const&)	call site: 00156	jpeg_finish_compress
19	233	master_selection	call site: 00233	jinit_1pass_quantizer
11	34	jinit_memory_mgr	call site: 00034	jpeg_set_defaults
9	209	jpeg_core_output_dimensions	call site: 00209	jdiv_round_up
7	201	jpeg_calc_output_dimensions	call site: 00201	jdiv_round_up
5	12	Pl_DCT::Pl_DCT(char const*, Pipeline*)	call site: 00012	__cxa_allocate_exception
3	25	Pl_DCT::finish()	call site: 00025	jpeg_CreateCompress
3	257	jinit_color_deconverter	call site: 00257	jsimd_can_ycc_rgb565
2	310	Pl_DCT::finish()	call site: 00310	jpeg_destroy_compress
1	20	FuzzHelper::doChecks()	call site: 00020

Runtime coverage analysis

Covered functions

208

Functions that are reachable but not covered

128

Reachable functions

237

Percentage of reachable functions covered

45.99%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	4
/src/qpdf/libqpdf/Pl_DCT.cc	13
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/x86_64/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	924	16.4%
gold	[1:9]	134	2.38%
yellow	[10:29]	106	1.88%
greenyellow	[30:49]	86	1.52%
lawngreen	50+	4374	77.7%
All colors	5624	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
54	5243	(anonymous namespace)::JSONParser::getToken()	call site: 05243	__cxa_allocate_exception
23	2398	qpdf::BaseHandle::copy(bool) const	call site: 02398	__cxa_allocate_exception
19	4258	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04258	__cxa_allocate_exception
19	5371	(anonymous namespace)::JSONParser::handleToken()	call site: 05371	__cxa_allocate_exception
19	5456	(anonymous namespace)::JSONParser::handleToken()	call site: 05456	__cxa_allocate_exception
14	4106	qpdf::Stream::copy_data_to(qpdf::Stream&)	call site: 04106	__cxa_allocate_exception
13	5093	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 05093
11	166	qpdf::Tokenizer::inBeforeToken(char)	call site: 00166	__cxa_allocate_exception
11	5324	(anonymous namespace)::JSONParser::getToken()	call site: 05324	__cxa_allocate_exception
11	5337	(anonymous namespace)::JSONParser::getToken()	call site: 05337	__cxa_allocate_exception
10	909	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00909	__cxa_allocate_exception
10	1245	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01245	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1444

Functions that are reachable but not covered

236

Reachable functions

2308

Percentage of reachable functions covered

89.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	8
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	3
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	38
/src/qpdf/libqpdf/QPDF_objects.cc	51
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	22
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	48
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	27
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	118
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	115
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	25
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	11
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/libqpdf/qpdf/AcroForm.hh	17
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1647	34.3%
gold	[1:9]	83	1.73%
yellow	[10:29]	103	2.14%
greenyellow	[30:49]	66	1.37%
lawngreen	50+	2896	60.3%
All colors	4795	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
236	3209	qpdf::impl::Writer::write()	call site: 03209	__assert_fail
79	4502	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04502	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
76	3026	ObjTable ::large_element(unsigned long)	call site: 03026	__cxa_allocate_exception
57	4407	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04407	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
50	4693	qpdf::impl::Writer::writeStandard()	call site: 04693
47	2916	qpdf::impl::Writer::doWriteSetup()	call site: 02916
39	4618	BitWriter::flush()	call site: 04618
34	4345	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04345	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
30	4587	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04587	__cxa_allocate_exception
29	3486	(anonymous namespace)::Pl_stack::popper()	call site: 03486	fopen
27	4658	qpdf::pl::Count::~Count()	call site: 04658	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
26	2397	qpdf::BaseHandle::copy(bool) const	call site: 02397	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1287

Functions that are reachable but not covered

488

Reachable functions

2156

Percentage of reachable functions covered

77.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	98
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	619	17.3%
gold	[1:9]	124	3.47%
yellow	[10:29]	69	1.93%
greenyellow	[30:49]	39	1.09%
lawngreen	50+	2713	76.1%
All colors	3564	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
61	2366	std::__1::shared_ptr QPDFObject::create , std::__1::allocator >&>(std::__1::basic_string , std::__1::allocator >&)	call site: 02366	__cxa_allocate_exception
25	1381	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01381
23	2341	QPDF::Doc::Pages::getAllPagesInternal(QPDFObjectHandle, QPDFObjGen::set&, QPDFObjGen::set&, bool, bool)	call site: 02341	__cxa_allocate_exception
15	1245	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01245	__cxa_allocate_exception
12	1225	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01225
11	166	qpdf::Tokenizer::inBeforeToken(char)	call site: 00166	__cxa_allocate_exception
10	909	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00909	__cxa_allocate_exception
10	1368	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01368
9	2747	QPDF::Doc::Objects::parse(char const*)	call site: 02747	__cxa_begin_catch
8	41	unsigned long QIntC::to_size (long const&)	call site: 00041	__cxa_allocate_exception
7	338	QPDF::warn(QPDFExc const&)	call site: 00338	__cxa_allocate_exception
7	1152	QPDFObjectHandle::getName() const	call site: 01152	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1034

Functions that are reachable but not covered

237

Reachable functions

1669

Percentage of reachable functions covered

85.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	7
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	1
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	2
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	20
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	30
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	19
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	32
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	24
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	107
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	67
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: future_qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	976	20.5%
gold	[1:9]	136	2.86%
yellow	[10:29]	102	2.15%
greenyellow	[30:49]	61	1.28%
lawngreen	50+	3469	73.1%
All colors	4744	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
88	4635	qpdf::impl::Writer::write()	call site: 04635	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
39	4412	qpdf::impl::Writer::writeLinearized()	call site: 04412	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
28	2975	ObjTable ::large_element(unsigned long)	call site: 02975	__cxa_allocate_exception
26	2395	qpdf::BaseHandle::copy(bool) const	call site: 02395	__cxa_allocate_exception
22	4189	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04189
18	3437	qpdf::impl::Writer::writeLinearized()	call site: 03437	fopen
17	4119	qpdf::BaseHandle::unparse() const	call site: 04119	__cxa_allocate_exception
16	2747	QPDF::Doc::Objects::parse(char const*)	call site: 02747	__cxa_begin_catch
16	2913	qpdf::impl::Writer::doWriteSetup()	call site: 02913
15	1245	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01245	__cxa_allocate_exception
15	3689	deflate	call site: 03689	crc32
13	3006	qpdf::BaseDictionary::crbegin()	call site: 03006

Runtime coverage analysis

Covered functions

1381

Functions that are reachable but not covered

327

Reachable functions

2140

Percentage of reachable functions covered

84.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	98
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	84
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	940	19.6%
gold	[1:9]	98	2.04%
yellow	[10:29]	118	2.46%
greenyellow	[30:49]	50	1.04%
lawngreen	50+	3589	74.8%
All colors	4795	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
88	4686	qpdf::impl::Writer::write()	call site: 04686	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
47	2916	qpdf::impl::Writer::doWriteSetup()	call site: 02916
26	2395	qpdf::BaseHandle::copy(bool) const	call site: 02395	__cxa_allocate_exception
26	2816	qpdf::impl::Writer::generateID(bool)	call site: 02816	__cxa_allocate_exception
18	3488	qpdf::impl::Writer::writeLinearized()	call site: 03488	fopen
17	4170	qpdf::BaseHandle::unparse() const	call site: 04170	__cxa_allocate_exception
16	2747	QPDF::Doc::Objects::parse(char const*)	call site: 02747	__cxa_begin_catch
16	2853	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02853	__cxa_allocate_exception
16	2964	qpdf::impl::Writer::doWriteSetup()	call site: 02964
15	1245	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01245	__cxa_allocate_exception
15	3740	deflate	call site: 03740	crc32
15	4282	qpdf::impl::Writer::writeTrailer(qpdf::impl::Writer::trailer_e, int, bool, long long, int)	call site: 04282	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1380

Functions that are reachable but not covered

337

Reachable functions

2158

Percentage of reachable functions covered

84.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	98
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1647	34.3%
gold	[1:9]	112	2.33%
yellow	[10:29]	95	1.98%
greenyellow	[30:49]	68	1.41%
lawngreen	50+	2871	59.8%
All colors	4793	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
236	3207	qpdf::impl::Writer::write()	call site: 03207	__assert_fail
79	4500	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04500	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
76	3024	ObjTable ::large_element(unsigned long)	call site: 03024	__cxa_allocate_exception
57	4405	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04405	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
50	4691	qpdf::impl::Writer::writeStandard()	call site: 04691
47	2914	qpdf::impl::Writer::doWriteSetup()	call site: 02914
39	4616	BitWriter::flush()	call site: 04616
34	4343	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04343	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
30	4585	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04585	__cxa_allocate_exception
29	3484	(anonymous namespace)::Pl_stack::popper()	call site: 03484	fopen
27	4656	qpdf::pl::Count::~Count()	call site: 04656	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
26	2395	qpdf::BaseHandle::copy(bool) const	call site: 02395	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1291

Functions that are reachable but not covered

488

Reachable functions

2156

Percentage of reachable functions covered

77.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	98
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	945	19.6%
gold	[1:9]	124	2.58%
yellow	[10:29]	98	2.04%
greenyellow	[30:49]	66	1.37%
lawngreen	50+	3564	74.2%
All colors	4797	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
88	4688	qpdf::impl::Writer::write()	call site: 04688	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
47	2918	qpdf::impl::Writer::doWriteSetup()	call site: 02918
26	2397	qpdf::BaseHandle::copy(bool) const	call site: 02397	__cxa_allocate_exception
26	2818	qpdf::impl::Writer::generateID(bool)	call site: 02818	__cxa_allocate_exception
18	3490	qpdf::impl::Writer::writeLinearized()	call site: 03490	fopen
17	4172	qpdf::BaseHandle::unparse() const	call site: 04172	__cxa_allocate_exception
16	2749	QPDF::Doc::Objects::parse(char const*)	call site: 02749	__cxa_begin_catch
16	2855	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02855	__cxa_allocate_exception
16	2966	qpdf::impl::Writer::doWriteSetup()	call site: 02966
15	1247	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01247	__cxa_allocate_exception
15	3742	deflate	call site: 03742	crc32
15	4284	qpdf::impl::Writer::writeTrailer(qpdf::impl::Writer::trailer_e, int, bool, long long, int)	call site: 04284	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1378

Functions that are reachable but not covered

337

Reachable functions

2158

Percentage of reachable functions covered

84.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	98
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1431	30.1%
gold	[1:9]	96	2.02%
yellow	[10:29]	67	1.41%
greenyellow	[30:49]	97	2.04%
lawngreen	50+	3052	64.3%
All colors	4743	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
225	3157	qpdf::impl::Writer::write()	call site: 03157	__assert_fail
120	4409	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04409	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3678	Pl_Flate::checkError(char const*, int)	call site: 03678	deflate
50	4641	qpdf::impl::Writer::writeStandard()	call site: 04641
42	2856	qpdf::impl::Writer::generateID(bool)	call site: 02856
39	4566	BitWriter::flush()	call site: 04566
30	4535	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04535	__cxa_allocate_exception
27	4606	qpdf::pl::Count::~Count()	call site: 04606	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
26	2397	qpdf::BaseHandle::copy(bool) const	call site: 02397	__cxa_allocate_exception
23	3434	(anonymous namespace)::Pl_stack::popper()	call site: 03434	fopen
23	3483	qpdf::impl::Writer::openObject(int)	call site: 03483	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
23	3637	unsigned int QIntC::to_uint (unsigned long const&)	call site: 03637	deflateInit_

Runtime coverage analysis

Covered functions

1319

Functions that are reachable but not covered

438

Reachable functions

2136

Percentage of reachable functions covered

79.49%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	98
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	82
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: future_qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1424	30.0%
gold	[1:9]	119	2.51%
yellow	[10:29]	65	1.37%
greenyellow	[30:49]	78	1.64%
lawngreen	50+	3055	64.4%
All colors	4741	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
225	3155	qpdf::impl::Writer::write()	call site: 03155	__assert_fail
120	4407	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04407	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3676	Pl_Flate::checkError(char const*, int)	call site: 03676	deflate
50	4639	qpdf::impl::Writer::writeStandard()	call site: 04639
42	2854	qpdf::impl::Writer::generateID(bool)	call site: 02854
39	4564	BitWriter::flush()	call site: 04564
30	4533	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04533	__cxa_allocate_exception
27	4604	qpdf::pl::Count::~Count()	call site: 04604	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
26	2395	qpdf::BaseHandle::copy(bool) const	call site: 02395	__cxa_allocate_exception
23	3432	(anonymous namespace)::Pl_stack::popper()	call site: 03432	fopen
23	3481	qpdf::impl::Writer::openObject(int)	call site: 03481	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
23	3635	unsigned int QIntC::to_uint (unsigned long const&)	call site: 03635	deflateInit_

Runtime coverage analysis

Covered functions

1321

Functions that are reachable but not covered

442

Reachable functions

2136

Percentage of reachable functions covered

79.31%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	98
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	82
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1

Fuzzer: qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1000	21.0%
gold	[1:9]	108	2.27%
yellow	[10:29]	96	2.02%
greenyellow	[30:49]	74	1.55%
lawngreen	50+	3468	73.0%
All colors	4746	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
88	4637	qpdf::impl::Writer::write()	call site: 04637	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
39	4414	qpdf::impl::Writer::writeLinearized()	call site: 04414	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
28	2977	ObjTable ::large_element(unsigned long)	call site: 02977	__cxa_allocate_exception
26	2397	qpdf::BaseHandle::copy(bool) const	call site: 02397	__cxa_allocate_exception
25	1383	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01383
22	4191	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04191
18	3439	qpdf::impl::Writer::writeLinearized()	call site: 03439	fopen
17	4121	qpdf::BaseHandle::unparse() const	call site: 04121	__cxa_allocate_exception
16	2749	QPDF::Doc::Objects::parse(char const*)	call site: 02749	__cxa_begin_catch
16	2915	qpdf::impl::Writer::doWriteSetup()	call site: 02915
15	1247	QPDFObjectHandle::hasKey(std::__1::basic_string , std::__1::allocator > const&) const	call site: 01247	__cxa_allocate_exception
15	3691	deflate	call site: 03691	crc32

Runtime coverage analysis

Covered functions

1376

Functions that are reachable but not covered

329

Reachable functions

2140

Percentage of reachable functions covered

84.63%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	9
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/libqpdf/Pl_DCT.cc	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	13
/src/qpdf/libqpdf/Pl_RunLength.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	10
/src/qpdf/libqpdf/BufferInputSource.cc	1
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDF.cc	27
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	30
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/libqpdf/QUtil.cc	21
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/global_private.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	98
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	23
/src/qpdf/libqpdf/QPDFObjectHandle.cc	73
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	84
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1