High level conclusions

Fuzzers reach 62.87% code coverage.

Fuzzers reach 58.57% of cyclomatic complexity.

Fuzzers reach 48.87% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1739 / 3558

Cyclomatic complexity statically reachable by fuzzers

21139 / 36091

Runtime code coverage of functions

2237 / 3558

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: future_hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.9%
gold	[1:9]	1	2.70%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	6	16.2%
lawngreen	50+	23	62.1%
All colors	37	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	31	FuzzHelper::run()	call site: 00031
1	35	FuzzHelper::run()	call site: 00035	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

15

Reachable functions

42

Percentage of reachable functions covered

64.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: future_ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.5%
gold	[1:9]	5	10.4%
yellow	[10:29]	12	25.0%
greenyellow	[30:49]	2	4.16%
lawngreen	50+	22	45.8%
All colors	48	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	42	FuzzHelper::run()	call site: 00042
1	46	FuzzHelper::run()	call site: 00046	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

16

Reachable functions

45

Percentage of reachable functions covered

64.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	30.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	38	69.0%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
5	13	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00013	__cxa_allocate_exception
4	29	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00029
2	52	Pl_Discard::~Pl_Discard()	call site: 00052	__clang_call_terminate
1	47	FuzzHelper::run()	call site: 00047	__cxa_end_catch

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

16

Reachable functions

70

Percentage of reachable functions covered

77.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/libqpdf/qpdf/Util.hh	7
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: future_runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	45	45.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	5.10%
greenyellow	[30:49]	5	5.10%
lawngreen	50+	43	43.8%
All colors	98	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	21	qpdf::global::Options::fuzz_mode(bool)	call site: 00021	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
12	58	FuzzHelper::run()	call site: 00058
11	39	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00039	__cxa_allocate_exception
2	78	FuzzHelper::run()	call site: 00078
1	5	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00005
1	55	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00055
1	96	FuzzHelper::run()	call site: 00096	__cxa_begin_catch

Runtime coverage analysis

Covered functions

38

Functions that are reachable but not covered

45

Reachable functions

107

Percentage of reachable functions covered

57.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	10
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/libqpdf/Pl_RunLength.cc	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	165	61.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	38.6%
All colors	269	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	200	deflate	call site: 00200	inflate
17	21	qpdf::global::Options::fuzz_mode(bool)	call site: 00021	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
15	129	deflate	call site: 00129	crc32
13	87	deflateResetKeep	call site: 00087	crc32_z
11	39	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00039	__cxa_allocate_exception
11	186	deflate	call site: 00186	_tr_flush_block
8	56	unsigned long QIntC::to_size (unsigned int const&)	call site: 00056	__cxa_allocate_exception
8	106	deflateReset	call site: 00106	inflateInit_
7	251	Pl_Flate::finish()	call site: 00251	__cxa_begin_catch
6	228	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00228	__cxa_allocate_exception
6	238	FuzzHelper::run()	call site: 00238	__cxa_allocate_exception
5	71	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00071	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

86

Functions that are reachable but not covered

77

Reachable functions

184

Percentage of reachable functions covered

58.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	9
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1

Fuzzer: future_lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.84%
greenyellow	[30:49]	5	6.84%
lawngreen	50+	43	58.9%
All colors	73	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	19	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00019	__cxa_allocate_exception
5	7	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00007	__cxa_allocate_exception
5	34	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00034	__cxa_allocate_exception
1	40	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00040
1	71	FuzzHelper::run()	call site: 00071	__cxa_begin_catch

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

25

Reachable functions

80

Percentage of reachable functions covered

68.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	207	56.7%
gold	[1:9]	1	0.27%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	156	42.7%
All colors	365	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	135	init_simd	call site: 00135	jinit_forward_dct
32	90	std_huff_tables	call site: 00090	jpeg_start_compress
30	192	unsigned int QIntC::to_uint (int const&)	call site: 00192	jpeg_finish_compress
19	269	master_selection	call site: 00269	jinit_1pass_quantizer
17	22	qpdf::global::Options::fuzz_mode(bool)	call site: 00022	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
11	40	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00040	__cxa_allocate_exception
11	74	jinit_memory_mgr	call site: 00074	jpeg_set_defaults
9	245	jpeg_core_output_dimensions	call site: 00245	jdiv_round_up
7	237	jpeg_calc_output_dimensions	call site: 00237	jdiv_round_up
3	65	Pl_DCT::finish()	call site: 00065	jpeg_CreateCompress
3	293	jinit_color_deconverter	call site: 00293	jsimd_set_ycc_rgb565
2	346	Pl_DCT::finish()	call site: 00346	jpeg_destroy_compress

Runtime coverage analysis

Covered functions

223

Functions that are reachable but not covered

149

Reachable functions

279

Percentage of reachable functions covered

46.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	8
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_DCT.cc	10
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	49.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	50.5%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	35	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00035	__cxa_allocate_exception
10	50	BitStream::getBitsSigned(unsigned long)	call site: 00050	__cxa_allocate_exception
5	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
5	13	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00013	__cxa_allocate_exception
5	63	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00063	__cxa_allocate_exception
2	82	Pl_Discard::~Pl_Discard()	call site: 00082	__clang_call_terminate
1	69	Pl_TIFFPredictor::processRow()	call site: 00069
1	77	FuzzHelper::run()	call site: 00077	__cxa_end_catch

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

30

Reachable functions

92

Percentage of reachable functions covered

67.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: future_dct_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	207	56.7%
gold	[1:9]	1	0.27%
yellow	[10:29]	1	0.27%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	156	42.7%
All colors	365	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	135	init_simd	call site: 00135	jinit_forward_dct
32	90	std_huff_tables	call site: 00090	jpeg_start_compress
30	192	unsigned int QIntC::to_uint (int const&)	call site: 00192	jpeg_finish_compress
19	269	master_selection	call site: 00269	jinit_1pass_quantizer
17	22	qpdf::global::Options::fuzz_mode(bool)	call site: 00022	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
11	40	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00040	__cxa_allocate_exception
11	74	jinit_memory_mgr	call site: 00074	jpeg_set_defaults
9	245	jpeg_core_output_dimensions	call site: 00245	jdiv_round_up
7	237	jpeg_calc_output_dimensions	call site: 00237	jdiv_round_up
3	65	Pl_DCT::finish()	call site: 00065	jpeg_CreateCompress
3	293	jinit_color_deconverter	call site: 00293	jsimd_set_ycc_rgb565
2	346	Pl_DCT::finish()	call site: 00346	jpeg_destroy_compress

Runtime coverage analysis

Covered functions

223

Functions that are reachable but not covered

149

Reachable functions

279

Percentage of reachable functions covered

46.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/dct_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	8
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_DCT.cc	10
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/libjpeg-turbo/src/jerror.c	1
/src/libjpeg-turbo/src/jcapimin.c	4
/src/libjpeg-turbo/src/jmemmgr.c	1
/src/libjpeg-turbo/src/jmemnobs.c	3
/src/libjpeg-turbo/src/jcparam.c	7
/src/libjpeg-turbo/src/jcomapi.c	4
/src/libjpeg-turbo/src/jstdhuff.c	2
/src/libjpeg-turbo/src/wrapper/../jcapistd.c	2
/src/libjpeg-turbo/src/jcinit.c	1
/src/libjpeg-turbo/src/jcmaster.c	4
/src/libjpeg-turbo/src/wrapper/../jutils.c	2
/src/libjpeg-turbo/src/wrapper/../jccolor.c	3
/src/libjpeg-turbo/simd/jsimd.c	20
/src/libjpeg-turbo/src/wrapper/../jcsample.c	3
/src/libjpeg-turbo/src/wrapper/../jcprepct.c	4
/src/libjpeg-turbo/src/wrapper/../jclossls.c	3
/src/libjpeg-turbo/src/jclhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jcdiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jcdctmgr.c	2
/src/libjpeg-turbo/src/jcarith.c	1
/src/libjpeg-turbo/src/jcphuff.c	1
/src/libjpeg-turbo/src/jchuff.c	1
/src/libjpeg-turbo/src/wrapper/../jccoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jcmainct.c	3
/src/libjpeg-turbo/src/jcmarker.c	1
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/libjpeg-turbo/src/jdapimin.c	6
/src/libjpeg-turbo/src/jdmarker.c	2
/src/libjpeg-turbo/src/jdinput.c	1
/src/libjpeg-turbo/src/jdmaster.c	6
/src/libjpeg-turbo/src/wrapper/../jdapistd.c	3
/src/libjpeg-turbo/src/wrapper/../jquant1.c	8
/src/libjpeg-turbo/src/wrapper/../jquant2.c	3
/src/libjpeg-turbo/src/wrapper/../jdmerge.c	3
/src/libjpeg-turbo/src/wrapper/../jdcolor.c	5
/src/libjpeg-turbo/src/wrapper/../jdsample.c	3
/src/libjpeg-turbo/src/wrapper/../jdpostct.c	3
/src/libjpeg-turbo/src/wrapper/../jdlossls.c	3
/src/libjpeg-turbo/src/jdlhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jddiffct.c	3
/src/libjpeg-turbo/src/wrapper/../jddctmgr.c	2
/src/libjpeg-turbo/src/jdarith.c	1
/src/libjpeg-turbo/src/jdphuff.c	1
/src/libjpeg-turbo/src/jdhuff.c	1
/src/libjpeg-turbo/src/wrapper/../jdcoefct.c	2
/src/libjpeg-turbo/src/wrapper/../jdmainct.c	4

Fuzzer: future_flate_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	165	61.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	104	38.6%
All colors	269	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
26	200	deflate	call site: 00200	inflate
17	21	qpdf::global::Options::fuzz_mode(bool)	call site: 00021	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
15	129	deflate	call site: 00129	crc32
13	87	deflateResetKeep	call site: 00087	crc32_z
11	39	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00039	__cxa_allocate_exception
11	186	deflate	call site: 00186	_tr_flush_block
8	56	unsigned long QIntC::to_size (unsigned int const&)	call site: 00056	__cxa_allocate_exception
8	106	deflateReset	call site: 00106	inflateInit_
7	251	Pl_Flate::finish()	call site: 00251	__cxa_begin_catch
6	228	unsigned long QIntC::to_ulong (unsigned long const&)	call site: 00228	__cxa_allocate_exception
6	238	FuzzHelper::run()	call site: 00238	__cxa_allocate_exception
5	71	Pl_Flate::handleData(unsigned char const*, unsigned long, int)	call site: 00071	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

86

Functions that are reachable but not covered

77

Reachable functions

184

Percentage of reachable functions covered

58.15%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/flate_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	9
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_Flate.cc	8
/src/qpdf/include/qpdf/QIntC.hh	9
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1

Fuzzer: lzw_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	20	27.3%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	6.84%
greenyellow	[30:49]	5	6.84%
lawngreen	50+	43	58.9%
All colors	73	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
8	19	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00019	__cxa_allocate_exception
5	7	Pl_LZWDecoder::Pl_LZWDecoder(char const*, Pipeline*, bool)	call site: 00007	__cxa_allocate_exception
5	34	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00034	__cxa_allocate_exception
1	40	Pl_LZWDecoder::getFirstChar(unsigned int)	call site: 00040
1	71	FuzzHelper::run()	call site: 00071	__cxa_begin_catch

Runtime coverage analysis

Covered functions

33

Functions that are reachable but not covered

25

Reachable functions

80

Percentage of reachable functions covered

68.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/lzw_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_LZWDecoder.cc	7
/src/qpdf/libqpdf/qpdf/Util.hh	5
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	1
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/qpdf/Pl_LZWDecoder.hh	1

Fuzzer: future_json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2425	75.9%
gold	[1:9]	25	0.78%
yellow	[10:29]	32	1.00%
greenyellow	[30:49]	39	1.22%
lawngreen	50+	672	21.0%
All colors	3193	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
229	2726	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02726	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
200	2097	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02097	__cxa_allocate_exception
179	1678	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01678	__cxa_guard_acquire
130	1931	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01931	__cxa_allocate_exception
106	1510	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01510	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
97	2485	QPDFObjectHandle::getObjectID() const	call site: 02485	__cxa_allocate_exception
88	1418	QPDFObjectHandle::getIntValueAsInt() const	call site: 01418	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
77	850	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00850	__cxa_allocate_exception
73	1296	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01296	__cxa_allocate_exception
64	1130	QPDFLogger::defaultLogger()	call site: 01130	__cxa_end_catch
60	2306	QPDF::Doc::Objects::readTrailer()	call site: 02306	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
53	1623	qpdf::BaseDictionary::replace(std::__1::basic_string , std::__1::allocator > const&, QPDFObjectHandle)	call site: 01623	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

481

Functions that are reachable but not covered

817

Reachable functions

1544

Percentage of reachable functions covered

47.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	21
/src/qpdf/libqpdf/QUtil.cc	13
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	24
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	26
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	94
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	59
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: ascii85_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	14.5%
gold	[1:9]	5	10.4%
yellow	[10:29]	7	14.5%
greenyellow	[30:49]	7	14.5%
lawngreen	50+	22	45.8%
All colors	48	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_ASCII85Decoder::Pl_ASCII85Decoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	42	FuzzHelper::run()	call site: 00042
1	46	FuzzHelper::run()	call site: 00046	__cxa_begin_catch

Runtime coverage analysis

Covered functions

17

Functions that are reachable but not covered

16

Reachable functions

45

Percentage of reachable functions covered

64.44%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/ascii85_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCII85Decoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	2
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCII85Decoder.hh	1

Fuzzer: json_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2425	75.9%
gold	[1:9]	25	0.78%
yellow	[10:29]	28	0.87%
greenyellow	[30:49]	34	1.06%
lawngreen	50+	681	21.3%
All colors	3193	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
229	2726	std::__1::shared_ptr QPDFObject::create (bool&)	call site: 02726	_ZN4qpdf7IntegerC2ITkNSt3__18integralEmEET_
200	2097	QUtil::hex_decode(std::__1::basic_string , std::__1::allocator > const&)	call site: 02097	__cxa_allocate_exception
179	1678	std::__1::shared_ptr QPDFObject::create , std::__1::allocator > >(std::__1::basic_string , std::__1::allocator >&&)	call site: 01678	__cxa_guard_acquire
130	1931	QPDF::EncryptionParameters::initialize(QPDF&)	call site: 01931	__cxa_allocate_exception
106	1510	QPDF::warn(qpdf_error_code_e, std::__1::basic_string , std::__1::allocator > const&, long long, std::__1::basic_string , std::__1::allocator > const&)	call site: 01510	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
97	2485	QPDFObjectHandle::getObjectID() const	call site: 02485	__cxa_allocate_exception
88	1418	QPDFObjectHandle::getIntValueAsInt() const	call site: 01418	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralExEEv
77	850	QPDFObject::move_to(std::__1::shared_ptr &, bool)	call site: 00850	__cxa_allocate_exception
73	1296	qpdf::BaseDictionary::BaseDictionary(QPDFObjectHandle const&)	call site: 01296	__cxa_allocate_exception
64	1130	QPDFLogger::defaultLogger()	call site: 01130	__cxa_end_catch
60	2306	QPDF::Doc::Objects::readTrailer()	call site: 02306	_ZNK4qpdf7IntegercvT_ITkNSt3__18integralEjEEv
53	1623	qpdf::BaseDictionary::replace(std::__1::basic_string , std::__1::allocator > const&, QPDFObjectHandle)	call site: 01623	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

480

Functions that are reachable but not covered

817

Reachable functions

1544

Percentage of reachable functions covered

47.09%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/json_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	21
/src/qpdf/libqpdf/QUtil.cc	13
/src/qpdf/libqpdf/JSON.cc	28
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	37
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/include/qpdf/JSON.hh	7
/src/qpdf/libqpdf/QPDF.cc	24
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/QPDF_json.cc	5
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	26
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	8
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	94
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	17
/src/qpdf/libqpdf/QPDFObjectHandle.cc	59
/src/qpdf/libqpdf/QPDF_Dictionary.cc	16
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6

Fuzzer: tiffpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	42	49.4%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	43	50.5%
All colors	85	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
13	35	unsigned int QIntC::to_uint (unsigned long const&)	call site: 00035	__cxa_allocate_exception
10	50	BitStream::getBitsSigned(unsigned long)	call site: 00050	__cxa_allocate_exception
5	7	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
5	13	Pl_TIFFPredictor::Pl_TIFFPredictor(char const*, Pipeline*, Pl_TIFFPredictor::action_e, unsigned int, unsigned int, unsigned int)	call site: 00013	__cxa_allocate_exception
5	63	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 00063	__cxa_allocate_exception
2	82	Pl_Discard::~Pl_Discard()	call site: 00082	__clang_call_terminate
1	69	Pl_TIFFPredictor::processRow()	call site: 00069
1	77	FuzzHelper::run()	call site: 00077	__cxa_end_catch

Runtime coverage analysis

Covered functions

35

Functions that are reachable but not covered

30

Reachable functions

92

Percentage of reachable functions covered

67.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/tiffpredictor_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_TIFFPredictor.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/BitStream.cc	3
/src/qpdf/include/qpdf/QIntC.hh	3
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	2
/src/qpdf/libqpdf/qpdf/bits_functions.hh	2
/src/qpdf/libqpdf/qpdf/Pl_TIFFPredictor.hh	1

Fuzzer: runlength_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	45	45.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	5	5.10%
greenyellow	[30:49]	5	5.10%
lawngreen	50+	43	43.8%
All colors	98	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
17	21	qpdf::global::Options::fuzz_mode(bool)	call site: 00021	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
12	58	FuzzHelper::run()	call site: 00058
11	39	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00039	__cxa_allocate_exception
2	78	FuzzHelper::run()	call site: 00078
1	5	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00005
1	55	Pl_RunLength::Pl_RunLength(char const*, Pipeline*, Pl_RunLength::action_e)	call site: 00055
1	96	FuzzHelper::run()	call site: 00096	__cxa_begin_catch

Runtime coverage analysis

Covered functions

38

Functions that are reachable but not covered

45

Reachable functions

107

Percentage of reachable functions covered

57.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/runlength_fuzzer.cc	3
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	13
/src/qpdf/libqpdf/qpdf/Util.hh	10
/src/qpdf/libqpdf/QUtil.cc	1
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	3
/src/qpdf/libqpdf/Pl_RunLength.cc	7
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1

Fuzzer: hex_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	7	18.9%
gold	[1:9]	1	2.70%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	29	78.3%
All colors	37	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_ASCIIHexDecoder::Pl_ASCIIHexDecoder(char const*, Pipeline*)	call site: 00007	__cxa_allocate_exception
1	31	FuzzHelper::run()	call site: 00031
1	35	FuzzHelper::run()	call site: 00035	__cxa_begin_catch

Runtime coverage analysis

Covered functions

16

Functions that are reachable but not covered

15

Reachable functions

42

Percentage of reachable functions covered

64.29%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/hex_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_ASCIIHexDecoder.cc	4
/src/qpdf/libqpdf/qpdf/Util.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/libqpdf/qpdf/Pl_ASCIIHexDecoder.hh	1

Fuzzer: future_pngpredictor_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	17	30.9%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	38	69.0%
All colors	55	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5	7	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00007	__cxa_allocate_exception
5	13	Pl_PNGFilter::Pl_PNGFilter(char const*, Pipeline*, Pl_PNGFilter::action_e, unsigned int, unsigned int, unsigned int)	call site: 00013	__cxa_allocate_exception
4	29	Pl_PNGFilter::write(unsigned char const*, unsigned long)	call site: 00029
2	52	Pl_Discard::~Pl_Discard()	call site: 00052	__clang_call_terminate
1	47	FuzzHelper::run()	call site: 00047	__cxa_end_catch

Runtime coverage analysis

Covered functions

31

Functions that are reachable but not covered

16

Reachable functions

70

Percentage of reachable functions covered

77.14%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/pngpredictor_fuzzer.cc	3
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	1
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/libqpdf/qpdf/Util.hh	7
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1

Fuzzer: future_qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	586	16.2%
gold	[1:9]	142	3.93%
yellow	[10:29]	71	1.96%
greenyellow	[30:49]	34	0.94%
lawngreen	50+	2780	76.9%
All colors	3613	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
11	44	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00044	__cxa_allocate_exception
11	196	qpdf::Tokenizer::inBeforeToken(char)	call site: 00196	__cxa_allocate_exception
11	1399	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01399
9	1289	qpdf::BaseDictionary::dict() const	call site: 01289	__cxa_allocate_exception
9	2412	qpdf::BaseHandle::copy(bool) const	call site: 02412
9	2782	QPDF::Doc::Objects::parse(char const*)	call site: 02782	__cxa_begin_catch
8	71	unsigned long QIntC::to_size (long const&)	call site: 00071	__cxa_allocate_exception
8	933	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00933	__cxa_allocate_exception
7	368	QPDF::warn(QPDFExc const&)	call site: 00368	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1054

Functions that are reachable but not covered

249

Reachable functions

1706

Percentage of reachable functions covered

85.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	25
/src/qpdf/libqpdf/QUtil.cc	25
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	30
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	112
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	65
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: future_qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1677	34.5%
gold	[1:9]	107	2.20%
yellow	[10:29]	109	2.24%
greenyellow	[30:49]	85	1.75%
lawngreen	50+	2871	59.2%
All colors	4849	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
234	3258	qpdf::impl::Writer::write()	call site: 03258	__assert_fail
79	4549	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04549	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
73	3077	ObjTable ::large_element(unsigned long)	call site: 03077
57	4454	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04454	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
47	4740	qpdf::impl::Writer::writeStandard()	call site: 04740	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
46	2967	qpdf::impl::Writer::doWriteSetup()	call site: 02967
39	4665	BitWriter::flush()	call site: 04665
34	4392	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04392	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
30	4634	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04634	__cxa_allocate_exception
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
29	3533	(anonymous namespace)::Pl_stack::popper()	call site: 03533	fopen

Runtime coverage analysis

Covered functions

1304

Functions that are reachable but not covered

517

Reachable functions

2204

Percentage of reachable functions covered

76.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	37
/src/qpdf/libqpdf/QUtil.cc	23
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	987	20.3%
gold	[1:9]	127	2.61%
yellow	[10:29]	131	2.70%
greenyellow	[30:49]	54	1.11%
lawngreen	50+	3552	73.2%
All colors	4851	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
85	4735	qpdf::impl::Writer::write()	call site: 04735	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
46	2969	qpdf::impl::Writer::doWriteSetup()	call site: 02969
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
26	2858	qpdf::impl::Writer::generateID(bool)	call site: 02858	__cxa_allocate_exception
18	3537	qpdf::impl::Writer::writeLinearized()	call site: 03537	fopen
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
17	4219	qpdf::BaseHandle::unparse() const	call site: 04219	__cxa_allocate_exception
16	2782	QPDF::Doc::Objects::parse(char const*)	call site: 02782	__cxa_begin_catch
16	2907	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02907	__cxa_allocate_exception
16	3016	qpdf::impl::Writer::doWriteSetup()	call site: 03016
15	3787	deflate	call site: 03787	crc32

Runtime coverage analysis

Covered functions

1392

Functions that are reachable but not covered

362

Reachable functions

2206

Percentage of reachable functions covered

83.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	37
/src/qpdf/libqpdf/QUtil.cc	23
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	87
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: future_qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1466	30.5%
gold	[1:9]	118	2.45%
yellow	[10:29]	82	1.70%
greenyellow	[30:49]	77	1.60%
lawngreen	50+	3054	63.6%
All colors	4797	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	3206	qpdf::impl::Writer::write()	call site: 03206	__assert_fail
120	4456	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04456	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3723	Pl_Flate::checkError(char const*, int)	call site: 03723	deflate
47	4688	qpdf::impl::Writer::writeStandard()	call site: 04688	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
41	2907	qpdf::impl::Writer::generateID(bool)	call site: 02907
39	4613	BitWriter::flush()	call site: 04613
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
30	4582	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04582	__cxa_allocate_exception
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
27	4653	qpdf::pl::Count::~Count()	call site: 04653	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
23	3481	(anonymous namespace)::Pl_stack::popper()	call site: 03481	fopen
23	3530	qpdf::impl::Writer::openObject(int)	call site: 03530	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_

Runtime coverage analysis

Covered functions

1335

Functions that are reachable but not covered

467

Reachable functions

2184

Percentage of reachable functions covered

78.62%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	37
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	83
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: qpdf_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1476	30.7%
gold	[1:9]	93	1.93%
yellow	[10:29]	85	1.77%
greenyellow	[30:49]	83	1.73%
lawngreen	50+	3060	63.7%
All colors	4797	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
223	3206	qpdf::impl::Writer::write()	call site: 03206	__assert_fail
120	4456	qpdf::impl::Writer::writeObjectStream(QPDFObjectHandle)	call site: 04456	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
81	3723	Pl_Flate::checkError(char const*, int)	call site: 03723	deflate
47	4688	qpdf::impl::Writer::writeStandard()	call site: 04688	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
41	2907	qpdf::impl::Writer::generateID(bool)	call site: 02907
39	4613	BitWriter::flush()	call site: 04613
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
30	4582	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04582	__cxa_allocate_exception
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
27	4653	qpdf::pl::Count::~Count()	call site: 04653	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
23	3481	(anonymous namespace)::Pl_stack::popper()	call site: 03481	fopen
23	3530	qpdf::impl::Writer::openObject(int)	call site: 03530	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_

Runtime coverage analysis

Covered functions

1333

Functions that are reachable but not covered

463

Reachable functions

2184

Percentage of reachable functions covered

78.8%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	37
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	83
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: qpdf_outlines_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	587	16.2%
gold	[1:9]	110	3.04%
yellow	[10:29]	81	2.24%
greenyellow	[30:49]	30	0.83%
lawngreen	50+	2805	77.6%
All colors	3613	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
11	44	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00044	__cxa_allocate_exception
11	196	qpdf::Tokenizer::inBeforeToken(char)	call site: 00196	__cxa_allocate_exception
9	1289	qpdf::BaseDictionary::dict() const	call site: 01289	__cxa_allocate_exception
9	2412	qpdf::BaseHandle::copy(bool) const	call site: 02412
9	2782	QPDF::Doc::Objects::parse(char const*)	call site: 02782	__cxa_begin_catch
8	71	unsigned long QIntC::to_size (long const&)	call site: 00071	__cxa_allocate_exception
8	933	qpdf::Stream::Stream(std::__1::shared_ptr const&)	call site: 00933	__cxa_allocate_exception
8	1402	QPDF::decryptStream(std::__1::shared_ptr , std::__1::shared_ptr , QPDF&, Pipeline*&, QPDFObjGen, QPDFObjectHandle&, bool, std::__1::unique_ptr >&)	call site: 01402
7	368	QPDF::warn(QPDFExc const&)	call site: 00368	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1050

Functions that are reachable but not covered

249

Reachable functions

1706

Percentage of reachable functions covered

85.4%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_outlines_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	4
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	25
/src/qpdf/libqpdf/QUtil.cc	25
/src/qpdf/libqpdf/QPDF.cc	23
/src/qpdf/libqpdf/QPDFTokenizer.cc	33
/src/qpdf/libqpdf/QPDF_objects.cc	50
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	43
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	30
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	8
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	34
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	3
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	112
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	30
/src/qpdf/libqpdf/QPDFObjectHandle.cc	65
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	12
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	3
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	3
/src/qpdf/libqpdf/NNTree.cc	32
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1

Fuzzer: future_qpdf_crypt_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	982	20.2%
gold	[1:9]	106	2.18%
yellow	[10:29]	114	2.35%
greenyellow	[30:49]	57	1.17%
lawngreen	50+	3592	74.0%
All colors	4851	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
85	4735	qpdf::impl::Writer::write()	call site: 04735	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
46	2969	qpdf::impl::Writer::doWriteSetup()	call site: 02969
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
26	2858	qpdf::impl::Writer::generateID(bool)	call site: 02858	__cxa_allocate_exception
18	3537	qpdf::impl::Writer::writeLinearized()	call site: 03537	fopen
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
17	4219	qpdf::BaseHandle::unparse() const	call site: 04219	__cxa_allocate_exception
16	2782	QPDF::Doc::Objects::parse(char const*)	call site: 02782	__cxa_begin_catch
16	2907	qpdf::impl::Writer::setEncryptionParameters(char const*, char const*)	call site: 02907	__cxa_allocate_exception
16	3016	qpdf::impl::Writer::doWriteSetup()	call site: 03016
15	3787	deflate	call site: 03787	crc32

Runtime coverage analysis

Covered functions

1395

Functions that are reachable but not covered

362

Reachable functions

2206

Percentage of reachable functions covered

83.59%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	37
/src/qpdf/libqpdf/QUtil.cc	23
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	87
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: future_qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	940	16.5%
gold	[1:9]	87	1.53%
yellow	[10:29]	120	2.11%
greenyellow	[30:49]	75	1.31%
lawngreen	50+	4460	78.4%
All colors	5682	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	5288	(anonymous namespace)::JSONParser::getToken()	call site: 05288	__cxa_allocate_exception
23	2446	qpdf::BaseHandle::copy(bool) const	call site: 02446	__cxa_allocate_exception
19	4293	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04293	__cxa_allocate_exception
19	5417	(anonymous namespace)::JSONParser::handleToken()	call site: 05417	__cxa_allocate_exception
19	5502	(anonymous namespace)::JSONParser::handleToken()	call site: 05502	__cxa_allocate_exception
17	28	qpdf::global::Options::fuzz_mode(bool)	call site: 00028	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
14	4142	qpdf::Stream::copy_data_to(qpdf::Stream&)	call site: 04142	__cxa_allocate_exception
13	5132	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 05132
11	46	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00046	__cxa_allocate_exception
11	199	qpdf::Tokenizer::inBeforeToken(char)	call site: 00199	__cxa_allocate_exception
11	1264	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01264	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
11	5370	(anonymous namespace)::JSONParser::getToken()	call site: 05370	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1476

Functions that are reachable but not covered

257

Reachable functions

2350

Percentage of reachable functions covered

89.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	5
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	28
/src/qpdf/libqpdf/QUtil.cc	28
/src/qpdf/libqpdf/QPDF.cc	26
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/QPDF_objects.cc	51
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	38
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	126
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	115
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/libqpdf/QPDF_Stream.cc	25
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	11
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/libqpdf/qpdf/AcroForm.hh	17
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/BufferInputSource.cc	2
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: qpdf_pages_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	951	16.7%
gold	[1:9]	91	1.60%
yellow	[10:29]	177	3.11%
greenyellow	[30:49]	61	1.07%
lawngreen	50+	4402	77.4%
All colors	5682	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
56	5288	(anonymous namespace)::JSONParser::getToken()	call site: 05288	__cxa_allocate_exception
23	2446	qpdf::BaseHandle::copy(bool) const	call site: 02446	__cxa_allocate_exception
19	4293	qpdf::Name::normalize(std::__1::basic_string , std::__1::allocator > const&)	call site: 04293	__cxa_allocate_exception
19	5417	(anonymous namespace)::JSONParser::handleToken()	call site: 05417	__cxa_allocate_exception
19	5502	(anonymous namespace)::JSONParser::handleToken()	call site: 05502	__cxa_allocate_exception
17	28	qpdf::global::Options::fuzz_mode(bool)	call site: 00028	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
14	4142	qpdf::Stream::copy_data_to(qpdf::Stream&)	call site: 04142	__cxa_allocate_exception
13	5132	qpdf::BaseHandle::write_json(int, JSON::Writer&) const	call site: 05132
11	46	qpdf::global::set_uint32(qpdf_param_e, unsigned int)	call site: 00046	__cxa_allocate_exception
11	199	qpdf::Tokenizer::inBeforeToken(char)	call site: 00199	__cxa_allocate_exception
11	1264	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01264	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
11	4920	void QIntC::range_check_error (long long const&, long long const&)	call site: 04920	__cxa_allocate_exception

Runtime coverage analysis

Covered functions

1534

Functions that are reachable but not covered

257

Reachable functions

2350

Percentage of reachable functions covered

89.06%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_pages_fuzzer.cc	5
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	28
/src/qpdf/libqpdf/QUtil.cc	28
/src/qpdf/libqpdf/QPDF.cc	26
/src/qpdf/libqpdf/QPDFTokenizer.cc	44
/src/qpdf/libqpdf/QPDF_objects.cc	51
/src/qpdf/include/qpdf/InputSource.hh	4
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	5
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	38
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	11
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	22
/src/qpdf/include/qpdf/ObjectHandle.hh	10
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	126
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	35
/src/qpdf/libqpdf/QPDFObjectHandle.cc	115
/src/qpdf/libqpdf/QPDF_Dictionary.cc	18
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/libqpdf/QPDF_Stream.cc	25
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	2
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	1
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	42
/src/qpdf/libqpdf/MD5.cc	5
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	7
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	11
/src/qpdf/include/qpdf/QPDFDocumentHelper.hh	1
/src/qpdf/libqpdf/QPDFPageLabelDocumentHelper.cc	4
/src/qpdf/libqpdf/NNTree.cc	40
/src/qpdf/libqpdf/qpdf/NNTree.hh	15
/src/qpdf/libqpdf/QPDFDocumentHelper.cc	1
/src/qpdf/libqpdf/QPDFOutlineDocumentHelper.cc	6
/src/qpdf/include/qpdf/QPDFOutlineObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFOutlineObjectHelper.cc	5
/src/qpdf/include/qpdf/QPDFObjectHelper.hh	6
/src/qpdf/libqpdf/QPDFObjectHelper.cc	1
/src/qpdf/libqpdf/QPDFAcroFormDocumentHelper.cc	11
/src/qpdf/include/qpdf/QPDFPageDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFPageObjectHelper.cc	10
/src/qpdf/include/qpdf/QPDFAnnotationObjectHelper.hh	2
/src/qpdf/libqpdf/QPDFFormFieldObjectHelper.cc	34
/src/qpdf/libqpdf/qpdf/AcroForm.hh	17
/src/qpdf/include/qpdf/QPDFFormFieldObjectHelper.hh	3
/src/qpdf/libqpdf/QPDFAnnotationObjectHelper.cc	7
/src/qpdf/libqpdf/Pl_QPDFTokenizer.cc	3
/src/qpdf/libqpdf/BufferInputSource.cc	2
/src/qpdf/libqpdf/QPDF_String.cc	4
/src/qpdf/libqpdf/QPDFMatrix.cc	11
/src/qpdf/include/qpdf/QPDFNumberTreeObjectHelper.hh	1
/src/qpdf/libqpdf/JSON.cc	29
/src/qpdf/libqpdf/qpdf/JSON_writer.hh	8
/src/qpdf/include/qpdf/JSON.hh	5
/src/qpdf/libqpdf/Pl_String.cc	2
/src/qpdf/include/qpdf/QPDFNameTreeObjectHelper.hh	1
/src/qpdf/include/qpdf/QPDFAcroFormDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFOutlineDocumentHelper.hh	1
/src/qpdf/include/qpdf/QPDFPageLabelDocumentHelper.hh	1

Fuzzer: qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1043	21.7%
gold	[1:9]	111	2.31%
yellow	[10:29]	93	1.93%
greenyellow	[30:49]	82	1.70%
lawngreen	50+	3470	72.3%
All colors	4799	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
85	4684	qpdf::impl::Writer::write()	call site: 04684	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
39	4461	qpdf::impl::Writer::writeLinearized()	call site: 04461	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
25	1387	QPDF::EncryptionParameters::interpretCF(qpdf::Name const&) const	call site: 01387
25	3028	ObjTable ::large_element(unsigned long)	call site: 03028
22	4238	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04238
18	3486	qpdf::impl::Writer::writeLinearized()	call site: 03486	fopen
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
17	4168	qpdf::BaseHandle::unparse() const	call site: 04168	__cxa_allocate_exception
16	2782	QPDF::Doc::Objects::parse(char const*)	call site: 02782	__cxa_begin_catch
16	2965	qpdf::impl::Writer::doWriteSetup()	call site: 02965

Runtime coverage analysis

Covered functions

1389

Functions that are reachable but not covered

358

Reachable functions

2188

Percentage of reachable functions covered

83.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	37
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: qpdf_crypt_insecure_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1675	34.5%
gold	[1:9]	112	2.30%
yellow	[10:29]	81	1.67%
greenyellow	[30:49]	86	1.77%
lawngreen	50+	2895	59.7%
All colors	4849	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
234	3258	qpdf::impl::Writer::write()	call site: 03258	__assert_fail
79	4549	qpdf::impl::Writer::writeEncryptionDictionary()	call site: 04549	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralExEERS1_T_
73	3077	ObjTable ::large_element(unsigned long)	call site: 03077
57	4454	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04454	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEmEERS1_T_
47	4740	qpdf::impl::Writer::writeStandard()	call site: 04740	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
46	2967	qpdf::impl::Writer::doWriteSetup()	call site: 02967
39	4665	BitWriter::flush()	call site: 04665
34	4392	qpdf::impl::Writer::writeObject(QPDFObjectHandle, int)	call site: 04392	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
30	4634	BitWriter::writeBits(unsigned long long, unsigned long)	call site: 04634	__cxa_allocate_exception
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
29	3533	(anonymous namespace)::Pl_stack::popper()	call site: 03533	fopen

Runtime coverage analysis

Covered functions

1301

Functions that are reachable but not covered

513

Reachable functions

2204

Percentage of reachable functions covered

76.72%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	37
/src/qpdf/libqpdf/QUtil.cc	23
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	50
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	86
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1

Fuzzer: future_qpdf_lin_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1019	21.2%
gold	[1:9]	131	2.72%
yellow	[10:29]	113	2.35%
greenyellow	[30:49]	59	1.22%
lawngreen	50+	3477	72.4%
All colors	4799	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
85	4684	qpdf::impl::Writer::write()	call site: 04684	_ZN4qpdf6Stream6LengthITkNSt3__18integralEmEEvT_
39	4461	qpdf::impl::Writer::writeLinearized()	call site: 04461	_ZN4qpdf4impl6Writer5writeITkNSt3__18integralEiEERS1_T_
32	1244	qpdf::Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool)	call site: 01244	_ZN4qpdfeqITkNSt3__18integralExEEbT_RKNS_7IntegerE
29	2437	qpdf::BaseHandle::copy(bool) const	call site: 02437	__cxa_allocate_exception
25	3028	ObjTable ::large_element(unsigned long)	call site: 03028
22	4238	qpdf::impl::Writer::unparseObject(QPDFObjectHandle, unsigned long, int, unsigned long, bool)	call site: 04238
18	3486	qpdf::impl::Writer::writeLinearized()	call site: 03486	fopen
17	26	qpdf::global::Options::fuzz_mode(bool)	call site: 00026	_ZN4qpdf4util4fitsIiTkNSt3__18integralEjQsr3stdE8integralIT_EEEbT0_
17	4168	qpdf::BaseHandle::unparse() const	call site: 04168	__cxa_allocate_exception
16	2782	QPDF::Doc::Objects::parse(char const*)	call site: 02782	__cxa_begin_catch
16	2965	qpdf::impl::Writer::doWriteSetup()	call site: 02965
15	3736	deflate	call site: 03736	crc32

Runtime coverage analysis

Covered functions

1394

Functions that are reachable but not covered

356

Reachable functions

2188

Percentage of reachable functions covered

83.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
/src/qpdf/fuzz/qpdf_lin_fuzzer.cc	4
/src/qpdf/libqpdf/Buffer.cc	5
/src/qpdf/libqpdf/Pl_Discard.cc	2
/src/qpdf/libqpdf/Pipeline.cc	6
/src/qpdf/include/qpdf/global.hh	3
/src/qpdf/libqpdf/global.cc	4
/src/qpdf/libqpdf/qpdf/global_private.hh	18
/src/qpdf/libqpdf/qpdf/Util.hh	37
/src/qpdf/libqpdf/QUtil.cc	22
/src/qpdf/libqpdf/QPDF.cc	30
/src/qpdf/libqpdf/QPDFTokenizer.cc	34
/src/qpdf/libqpdf/QPDF_objects.cc	57
/src/qpdf/include/qpdf/InputSource.hh	3
/src/qpdf/libqpdf/InputSource.cc	7
/src/qpdf/include/qpdf/QTC.hh	1
/src/qpdf/include/qpdf/QIntC.hh	47
/usr/local/bin/../include/c++/v1/sstream	2
/usr/local/bin/../include/c++/v1/stdexcept	6
/src/qpdf/libqpdf/QPDFExc.cc	3
/src/qpdf/libqpdf/qpdf/QPDF_private.hh	43
/src/qpdf/libqpdf/QPDFLogger.cc	8
/src/qpdf/include/qpdf/QPDFExc.hh	2
/src/qpdf/libqpdf/qpdf/InputSource_private.hh	9
/src/qpdf/include/qpdf/QPDFTokenizer.hh	9
/src/qpdf/include/qpdf/QPDFObjGen.hh	12
/src/qpdf/include/qpdf/QPDFXRefEntry.hh	2
/src/qpdf/libqpdf/QPDFParser.cc	35
/src/qpdf/libqpdf/qpdf/QPDFParser.hh	5
/src/qpdf/libqpdf/qpdf/QPDFTokenizer_private.hh	4
/src/qpdf/include/qpdf/QPDFObjectHandle.hh	13
/src/qpdf/include/qpdf/ObjectHandle.hh	9
/src/qpdf/libqpdf/qpdf/QPDFObjectHandle_private.hh	105
/src/qpdf/libqpdf/qpdf/QPDFObject_private.hh	47
/usr/local/bin/../include/c++/v1/__exception/exception.h	1
/src/qpdf/libqpdf/QPDF_Array.cc	25
/src/qpdf/libqpdf/QPDFObjectHandle.cc	72
/src/qpdf/libqpdf/QPDF_Dictionary.cc	17
/src/qpdf/libqpdf/QPDFObject.cc	1
/src/qpdf/libqpdf/Pl_OStream.cc	1
/src/qpdf/include/qpdf/Pipeline.hh	2
/src/qpdf/libqpdf/QPDF_Stream.cc	20
/src/qpdf/libqpdf/qpdf/Pipeline_private.hh	15
/src/qpdf/libqpdf/qpdf/SF_FlateLzwDecode.hh	2
/src/qpdf/libqpdf/qpdf/SF_RunLengthDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_DCTDecode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCII85Decode.hh	1
/src/qpdf/libqpdf/qpdf/SF_ASCIIHexDecode.hh	1
/src/qpdf/libqpdf/qpdf/ContentNormalizer.hh	3
/src/qpdf/libqpdf/Pl_Flate.cc	9
/src/qpdf/libqpdf/Pl_Count.cc	3
/src/qpdf/libqpdf/QPDF_encryption.cc	44
/src/qpdf/libqpdf/MD5.cc	7
/src/qpdf/libqpdf/QPDFCryptoProvider.cc	6
/src/qpdf/include/qpdf/QPDFCryptoProvider.hh	1
/src/qpdf/libqpdf/qpdf/MD5.hh	3
/src/qpdf/libqpdf/RC4.cc	3
/src/qpdf/libqpdf/qpdf/RC4.hh	1
/src/qpdf/libqpdf/Pl_SHA2.cc	4
/src/qpdf/libqpdf/Pl_Buffer.cc	4
/src/qpdf/libqpdf/Pl_AES_PDF.cc	8
/src/qpdf/libqpdf/CryptoRandomDataProvider.cc	1
/src/qpdf/libqpdf/qpdf/Pl_AES_PDF.hh	1
/src/qpdf/libqpdf/qpdf/Pl_SHA2.hh	1
/src/qpdf/libqpdf/QPDF_pages.cc	6
/src/qpdf/libqpdf/QPDFWriter.cc	85
/src/qpdf/libqpdf/qpdf/QPDFWriter_private.hh	27
/src/qpdf/libqpdf/QPDFUsage.cc	1
/src/qpdf/include/qpdf/QPDFUsage.hh	1
/src/qpdf/libqpdf/qpdf/ObjTable.hh	19
/src/qpdf/libqpdf/QPDF_linearization.cc	24
/src/qpdf/libqpdf/QPDFSystemError.cc	2
/src/qpdf/include/qpdf/QPDFSystemError.hh	1
/src/qpdf/libqpdf/qpdf/Pl_MD5.hh	3
/src/qpdf/libqpdf/Pl_PNGFilter.cc	12
/src/qpdf/include/qpdf/QUtil.hh	1
/src/qpdf/libqpdf/qpdf/Pl_PNGFilter.hh	1
/src/zlib/deflate.c	16
/src/zlib/crc32.c	5
/src/zlib/adler32.c	2
/src/zlib/trees.c	20
/src/zlib/inflate.c	9
/src/zlib/inftrees.c	2
/src/zlib/inffast.c	1
/src/qpdf/libqpdf/QPDF_String.cc	3
/src/qpdf/libqpdf/Pl_RC4.cc	3
/src/qpdf/libqpdf/qpdf/Pl_RC4.hh	1
/src/qpdf/libqpdf/BitWriter.cc	4
/src/qpdf/libqpdf/qpdf/bits_functions.hh	1
/src/qpdf/include/qpdf/QPDFWriter.hh	1